OT: Bitshift, howto

[Carlos Macedo Gomes]

Hi Eric,

I believe Hex Workshop [1] (a Windows based tool) will do what you
want.  It can handle file and sector circular bitwise shifts in either
direction and has options for taking into account the data's
Endian-ness.  I'm not sure about doing an entire partition but since
you can open an entire drive w/ the tool you may be able to do the
shift.  If you have the ability to write the partition to an image
file (e.g., using something akin to DriveSpy's [2] SavePart command)
then you can bitshift the image file and possibly achieve your
objective.

Let me know if this helps or, if not, what alternatives you find as
I'd be interested in the results.  I do some digital forensics support
at work (for a local Fortune 50) and teach cybercrime/digitalforensics
at night.

thanks,
C.G.

[1] http://www.bpsoft.com/
[2] http://www.digitalintelligence.com/software/disoftware.php

On 3/7/07, evb <dsmntl at cox.net> wrote:
>
> Sorry for the OT post, but all my other avenues have failed.  Thus I am
> seeking out the advice of the technorati on this list.
>
> I would like a tool(Linux or Windows)  that would bitshift all bits within a
> defined scope (file/sector/partition/etc).  Specifically, I would like a
> tool that will perform the following operation at the file/sector level:
> http://en.wikipedia.org/wiki/Circular_shift
>
> I already have a tool that will shift bits at the sector level, but only if
> the data is on a floppy disk and only in DOS; other media and Oses are not
> supported.  VMWare also is not supported.  (That tool is called Anadisk; you
> can find a trial version here, fyi:
> http://retro.icequake.net/dob/files/bleuge/anadisk.207/).
>
> The tool "Winhex" already has a simple feature (Edit > Modify Data >
> Invert/XOR/RightShiftby1/LeftShiftby1) but for various reasons I cannot use
> it.
>
> Any suggestions are appreciated.
>
> Eric Van Buskirk
> Assistant City Prosecutor/CISSP
> City of Phoenix
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>


-- 
powerofprimes at gmail.com
Carlos Macedo Gomes
_sic itur ad astra_