mac forensics

I was just trying to get some scripts out of my old macbook air install. Back when it broke I took a snapshot of the disk with dd and now had the image lying around.

What I usually do (and tried is something like this:)

• Have a look with fdisk -l into the image where the partitions are (fdisk -l img)
• Take the offset of the partition I want, multiply by the block size and use that to mount it, e.g. 

  mount -t hfsplus -o ro,loop,offset=209736192 mbabackup /mnt

Now that didn't work out for two reasons, first it's a gpt table so fdisk is of no help. parted knows about them but I found no way to get the exact number, so in the end I used mmls (sleuthkit). Using the offset i found there I got this error:

mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

This apparently is a bug in the hfs(plus) driver, since the exact same approach works with everything else.
In comes kpartx:

kpartx -l img

  shows us the table of partitions (-g for force gpt if in doubt)

kpartx -av img

creates new loop block devices which you can then just mount

mount -o ro -v /dev/mapper/loop1p2 /mnt/

That's actually a lot easier than before, great.

Visualizing Dimens in Latex Documents

Rule based typesetting like LaTeX (or CSS for the matter) uses lots and lots of lengths that can be adjusted (or adjust itself in relation to some other quantity like the font size or other length). I believe there are over ten regulating how a list is typeset alone. If you typeset for a while you'll pick up a few over time, I'd say parindent and parskip usually come first, some are so obscure you'll never need them, some shouldn't even be touched, since you risk screwing your layout in ways that you thought only MS Word is capable of. For the middle category of the ones you don't know and still want to adjust I just found a great package. The layouts package enables you to actually see how they all play together for most major latex features. This is so insanely helpful and you don't actually need the package sice everything is reprinted in the manual of course. To see how great it really is see this picture for lists.

ampersand and that

I just read a great article about the letters historically part of the english alphabet but got left out. While I knew a few already I've never heard of number 8 before and it's really interesting to know it exists. Language development is something I really should delve in some day.

NRA/Right wing crazies on Jon Stewart

Another brilliant Jon Stewart Daily Show calling out NRA bullshit. I know it's been all over the net, but the claims made are just so outrageous, it's unbelievable anyone can utter them without cracking up. Also Jon Stewart is just awesome.

Find messages in skypes new database format

The db changed from that custom format similar to Kazaa to sqlite3, so to find stuff you now just write sql (sqlite3 flavour is a bit weird though). See this example and use .help, if you are stuck.

select author, body_xml from messages where strftime('%Y-%m-%d', timestamp, 'unixepoch') == '2013-01-18' and author == 'user';

Gnome, Ubuntu Idiocy

I just found this post on superuser and it triggered all my buttons at the same time.

It has to be the ultimate negative example. It shows what's wrong with gnome, ubuntu and superuser (I love most of the other sites from the stackoverflow family although they all have their problems, just not superuser ). This post shall remind me to stay away from these areas.

When the \TeX gods get bored.

Every \@@par you take, \everypar you make, every risk you take, it's your own fate, TeX'll be watching you.              

  by Paulo Cereda