An essential part of computer forensics is talking to the user. I talk about this in the presentation I gave to the campus technology conference last December and will probably be re-addressing that this year.
A key thing to remember is that talking to the user is the beginning of your forensic process, not the end. Too many people are willing to take what our users say at face value - "no, I don't run P2P software," ok, so it must be something else. Sometimes it turns out that the something else was Skype or some television viewing software. Both of those are (or can be) p2p as well, but since they're not BitTorrent, people forget about them.
This is not to say that we need to approach our users in a hostile manner, as some do - that is counterproductive. Rather, we need to take our time and doublecheck: "ok, so you don't use p2p, but this behaviour just started - what have you installed lately?" Sometimes that approach yields the answer you need. Other times, it's more digging.
This post was brought about because we've been seeing a lot of alerts on possible Kraken activity on our network courtesy of our Snort sensor, but in the one response I've received, it was to say "oh, I reinstalled the workstation, so no problem." I'd even asked specifically if the admin could check to see if there was a problem, since I don't know how well this rule is working for us.
Another admin did actually dig down, and the user's response was essentially nope, no p2p, but I just started using this software called UUSee to watch soccer games. Turns out there was a game on the same time we were receiving the alerts. I never claimed to be the sharpest crayon in the box, but I can connect two dots if they're put down for me.
February 2009 Archives
Tough game to lose. While the Oilers are down several key players who may have made a difference, so were the Stars. Turco was on his game, and Roloson less so - although Roli was still good. It was a chippy game. There's just something about the Stars that seems to bring out the physical side of the Oilers, ever since the famous Ron Low "100 hit" night. Only Horcoff and Roloson were credited with 0 hits, which is funny cos I think Steve Ott would disagree with the latter's assessment. JF Jacques drew in for his first game of the year, while Dallas was missing Brad Richards.
Dennis King hasn't posted his chances yet, so I'll have to go by memory and notes (where I don't tend to put down chances, as I don't like missing too much action while writing).
Smid, 6: only the one glaring error, he could have covered better on Sawada's goal (as Staples points out.) Credited with 7 hits and an assist. An above-average game that saw him play almost 18 minutes. Unlike last year, he's earning his icetime.
Horcoff, 6: he scored, but they really needed to be better on the power play and he's one of the keys. Special teams beast, he had 22:51 of icetime, including 4:03 of strong PK.
Nilsson, 4: an average game would have been salvaged by a point or two. He saw some PK time, I'm not sure if MacT was desperate or experimenting. I wasn't keeping track, but I'd guess it was near the end of the game when the teams were each trying to give the game away. He had an incredibly brutal giveaway in the second that dropped his grade a point; it only didn't go in the net because Roli bailed him out. Perfect drop pass by the side of the net, right onto the stick of a Star. He was skating hard all night though, and did earn the 17:23 of icetime he received.
Cogliano, 5: his shot was a good scoring chance, he was skating hard and hitting. Faceoffs were average - for Cogs. He can't centre a scoring line until he can win more than 2/5.
Moreau, 5: -1, 6 penalties for 23 PIM. I thought he got rooked on the double minor in the second, that should not have put the team down. I'm not sure why he pulled Grossman (?) out of the scrum in the third after Ott took down Gilbert, but that attack didn't really seem warranted. +1 for trying and caring so much, but -1000 for good sense. He forced some turnovers with hard hits.
Jacques, 5: if he keeps playing like that, he'll deserve to stay with the team. He had a decent hit every other shift, and was engaged and physical. He forced the first Dallas power play by being a bit too eager. And he finally got a point!
Staios, 6: an assist, nommed up 22:21 of ice, no huge mistakes, some good pinches. His shot block didn't leave him limping off or holding his face either, always good news for the Bullet Magnet from Hamilton.
Cole, 5: physical and tough, 5 credited hits, but only one shot and he wasn't driving the net. -2, but his PK was all right. He lost most of his PP time to Nilsson, I think.
Penner, 5: made a mistake on the one goal (see Staples' post), but he made some good defensive plays and was more physical than his single credited hit would indicate. In the first he made a terrible pass in his own end, but recovered and wound up drawing a penalty off Robidas driving the Dallas zone, a textbook example of what happens when the big man heads for the net. Only one shot but he was complicit in several Edmonton chances.
Strudwick, 5: quiet game, just the way I like it from him. Simple, effective 14:51 of icetime, and he was good on the PK.
Souray, 6: played with a nasty edge, 3 credited hits and an assist. 6:15 of PP time should result in a GF though. Still, he played nearly half the game and was evens, +1/-1, worth an above average score.
Stortini, 5 -1 with 4 credited hits, but 0 shots for the new scoring machine. His line (with Cogs and Moreau) was fairly effective cycling the puck early on, but seemed to wear off or down a bit later in the game.
Peckham, 4: he actually wasn't bad, doing what he needed to do in his own end, but that misconduct was a stupid penalty to take. Probably he wouldn't have gotten it if he'd been wearing #44 instead of 49, but veterans wearing the A get the benefit of the doubt from refs, and rookies don't.
Brodziak, 6: an assist and +1, his line was put out after all the Dallas goals to cause some trouble, and they were good at it. Effective on the PK, with nearly half his icetime coming there.
Gilbert, 6: 27:03 of icetime and he bounced back up after the dirty hit by Ott to try to defuse things. PP was ineffective, although he had a couple of shots and generally moved the puck well.
Hemsky, 5: +1 on the night, but his penalty was extremely poorly-advised and he flubbed some passes on the PP. When the low-percentage passes work, they work well, but when they don't it's a shorthanded clear or rush. He destroyed Grossman at his own blueline shortly after returning from the sin bin in the second period, a bit of payback. The Stars were playing him nasty and close all night.
Reddox, 6: skated hard and was in the right place at the right time for his goal. Right in front of the net is a hard place to be when you're the size of Dustin Penner or Stortini, never mind when you're five foot five and 160 pounds.
Gagner, 5: would have been a 4, but what he lacked in offense he made up for with grit. 3 credited hits, and that's probably a no-BS number, and he managed 2 shots on goal as well (3 more blocked).
Roloson, 6: one of the goals was soft, but he made some dandy saves he shouldn't have had to make (like the one off the Nilsson giveaway I noted) and was otherwise solid.
Delayed putting these up, had an early bedtime last night and I forgot my notebook at home, then worked late. Wah wah.
Decent game last night, better than a lot of the usual efforts lately, but there were a few little things, like the repeated turnovers at the bluelines, that are going to come back and bite them - again. Notes of the night: 71 was out with a dislocated shoulder, 27 lined up back with 10 and 83, and then in the third 10 and 77 bowed out. Brodziak did a decent job filling in for Horcoff on the top line. I noticed at one point that Penner was out with Cogliano and Reddox to take a defensive zone faceoff, then when he won it, he hotfooted it off the ice to give way to Moreau. I'm not sure and don't care to check how many times that repeated itself.
Smid, 5: almost the perfect third-pairing defenceman. Almost 19 minutes of icetime, all even strength, just one glaring mistake, a shot block, and no goals in on his watch. He was physical when required. The Blues had a few more chances for than against when he was skating, including early in the third when he let the puck trickle out front and the Blues pounced on it, getting a good chance.
Horcoff, 6: his penalty was in the defensive zone at least, but wasn't a particularly good one to take. Limited icetime what with missing the third period and all, and > 30% of his 9:20 was on the PK.
Nilsson, 7: high event game for the young feller, I had two pluses and a minus against his name on one shift. He was particularly prone to overhandling the puck at the blue lines; one turnover at the offensive blue led to a breakaway by Boyes and Roloson had to make a good save as Grebeshkov annoyed the Blue. Still, the set of two pluses led to Souray's goal, and he was skating hard all night, even if he probably did lead to a few more grey hairs for MacT. Great move on the shootout goal.
Cogliano, 6: obviously the coach doesn't trust him to take own-zone faceoffs. His line produced more than it gave up though, even if it didn't score; he had two shots himself.
Moreau, 6: a point would have given him a 7. Two shots, two hits, and a blocked shot, he was physical all night. Led the team in SH minutes, and the PK was particularly good, never allowing the Blues many chances to set up. +4/0 even strength chances.
Potulny, 4: pretty much a non-factor. He wasn't really physical, wasn't making plays, generated no offense and wasn't great defensively either.
Staios, 6: with Vis down and Gilbert gone in the third, he played 26:18. He was physical, often clearing the front of the net, and was part of the strong PK. No points, but he did get a shot on net; one giveaway, not bad for the amount of ice he saw. Gave up a lot of chances though, +3/-7 at even strength.
Cole, 6: same as Moreau, except moreso. A point would have been a 7. He had 5 hits and was skating hard all night. Two shots and almost as proficient as Cogliano in the faceoff circle. Another PKer who deserved lots of credit.
Penner, 6: -1 (SHGA), but I didn't think he really deserved the minus since the goal came off a Blues rush off the faceoff in their own end. Only one shot but he was physical all night, winding up with 3 hits. He had a glorious chance to get the go-ahead goal in the third but couldn't quite get his stick on it. He set up Hemsky and was making decent plays all night. Cole-lite with better hands last night. Needs to score on the PP though.
Grebeshkov, 6: played much more than he's used to and did fairly well with the time; 25:02, 4:14PP and 3:39 PK. He saw a bit of Keith Tkachuk and hemmed the big guy in fairly well. Like Penner, with that much PP time he needs to get a point.
Strudwick, 5: +4/-5, he saw almost 20 minutes of icetime, which must be nearly double his usual allotment. He was physical in front of the net and seemed to have something going with Tkachuk. Two hits and a shotblock, a workmanlike game for #43.
Souray, 7: nasty, generated more chances than he gave up in over 28 minutes of ice, 4 shots and the goal. He has had much softer hands this season than I expected; I figured most of his goals were cannon blasts and garbage, but he's adept at floating the puck in on net too. He played all of at least one of the power plays, staying on while everybody else changed.
Stortini, 5: only one credited hit, he was still fairly physical. Pretty decent tilt with Janssen, although it looked like he hurt his right hand. He didn't generate any chances and gave 3 up, although from memory none were grade A.
Brodziak, 6: second assist, 19:32 of icetime, +4/-5 ES chances, gave up not a sniff on the PK, and filled in well enough in the third for Horcoff. Strong 6. I'm not sure how he's the one that wound up with a penalty on the scrum that wound up with 6 players in the Oilers net or in the crease, but he definitely saved a goal there by curling up on the puck.
Gilbert, 5: only 4 shifts in the second and none in the third. Back spasms suck, and while we're not letting up for injury, I still respect the game. He managed 2 shots and 2 shot blocks.
Hemsky, 6: another high-event player. He had 3 shots and 3 more blocked, blocked one himself, and made some great plays that wound up nowhere, but he also made some great plays that wound up going the wrong way and gave it up at the blueline a few times too many for a player who's had plenty previous experiences to demonstrate that sometimes simpler is better. +1/-4 ES chances and 0/-1 on the PP - that one wound up in his own net. Weak 6.
Reddox, 6: part of a chance-generating machine +5/-1, he had two shots himself. His three hits likely weren't much more effective than my own would have been, but he was skating hard to get them all night.
Gagner, 6: the shootout goal pushed him up from 5 territory. Part of the crew that got scored on, he lost the faceoff. +3/-5 on the night, one of the chances against was a good one when he gave the puck away to Boyes in his own slot. Had a great chance with Cole in OT.
Roloson, 8: I thought he probably should have stopped the goal that went in, but he stopped several others that should have gone in, so it more than evens out. Only had to make two stops in OT, but they were good ones.
