Knoppix Questions!

[Zeb]

Hey,

Sorry if these have been answered elsewhere - I'm just hoping to get a straight answer soon as a friend asked me these questions yesterday when he saw me downloading 3.4 and it would be cool if I could answer them, for sure, today:

1) Does Knoppix save ANYTHING the HDD?

2) What you're browsing the web on it how does it deal with cookies/movies/websites/etc if it cannot save to HDD? Eg, Say a website has a movie on it, can you stream it like on Windows? Then what happens when you remove the CD at the end of the session - Does it stay somewhere on the HDD (Where?) or does it get deleted?

3) Once the disk has been taken out is there anyway to trace what you have been doing on it/retrive anything you have been doing on it?

4) Some programs like the text editors when closed ask if you would to save - If you do not have drive access how and where can you save?

Knowing me there will be more questions if and when I remeber, lol :P

Thanks in advanced for any answers!

Dan

[pulsar]

* Normaly when run from cd, changes in the configuration will not be saved and the next time you reboot you have to start all over again. Knoppix only uses the RAM. So after the pc is shutdown all traces are gone.
* But there are a view options to save the changes you made as well as files made on a texteditor for instance. You can safe it on a hd-partition (even a windows partition), memorystick and even on a floppy. Also downloads from the web can be saved. Next time you reboot knoppix finds your configuration and saved files.

[Craig2]

1) Does Knoppix save ANYTHING the HDD?

Only if you want it to. You can save your configurations by going to start (kde button on bottom left toolbar in kde (kicker panel), in this sequence: start (K) ->Knoppix->configure->save knoppix configuration, and then walk through the screens. It asks you where to store the configuration file, which hard disk (if more than one), floppy, usb keychain drive if detected, etc. You can also create a persistant home directory, where you save your data. You can also create a swap partition, or a swap file. If you create any of these on fat, vfat, ntfs, or other partition from another operating system, you can erase the file from the other operating system later, without going back into knoppix. If you save data to a different mounted partition, you can access that data from windows if windows can see that partition (yes on fat, vfat, ntfs, no on ext2, ext3, reiserfs, etc), and it may be able to see the data on a persistant home as well, if on a recognizable partition, although I don't use a persistant home in that manner (and I don't use windows) so I can't confirm this. Also, for security reasons, be aware that knoppix does write to the hard disk for persistant home, for configuration, and for swap partitions. If you have a crash, or if someone else examines the swap partition later, they can recover just about everything written to the swap partition the last time it was used, unless the swap partition is encrypted. If you run the system for a long period of time (which is quite common with linux) and leave a lot of windows open and use a lot of tabs in konqueror, most of it is going to be written to swap, especially when idle for long periods. With a lot of windows and tabs open, and a lot of applications running, after several weeks, I've had situations where 800-900 MB of a 1 GB swap partition was used. And I've even run out of swap at one point.

2) What you're browsing the web on it how does it deal with cookies/movies/websites/etc if it cannot save to HDD?

Streaming media that is "buffered" is saved in /tmp I believe, or in a tmp file in the partition where the application is located. Obviously it can't be saved to the /tmp directory on a non-writable cd, but when knoppix is started up, it creates a ramdisk out of 1) your ram, and if available and needed, out of 2) your swap partition or swap file. Inside that ramdisk, knoppix recreates a file system that includes /etc /tmp /home, /root /var /usr /bin /sbin and other directories. In some of these directories, the applications and other files are transferred, and in others, links are created that lead to the cd. The files that don't need to be written to are links, and for files that need to be written to, they are placed on the ramdisk.

For konqueror, kde's web browser, and for Mozilla, look in the dot configuration files in each user's home directory (for knoppix, look in /home/knoppix/) using the ls -a command. Find the .kde or .kde2 or .kde3 or whatever, then look in one of the subdirectories to find konqueror specific directories. In a directory below konqueror, you will find the cache files, if you are using cache. If not, the data that is saved so that your back button works, may be in /tmp. I remember seeing a discussion about where to save data if cache isn't used, so the back button works, on one of the kde discussion boards, but I don't remember where exactly. For Mozilla, same thing. Data is saved in the user's home directory, in a dot configuration file, .mozilla probably, and page cache is saved in a sub directory. If no cache is used, some data may be saved in /tmp (which is on ramdisk).

Someone who knows better, or has more info, please correct me on the above where necessary. And I'd like to know where the cookies for both konqueror and mozilla are kept myself. I googled for this a while back (that's how I found the discussion on kde about no cache/where to put data for the back button to work), but wasn't able to find info on finding cookies.

I've also been trying to find info on saving Real Media streams (I'd like to archive some news streams, and some streams about the Mars probes, among others). From what I've seen, the only way to do that is to watch the stream on a windows computer, move the temp or temporary internet files directory from windows on to a nfs partition on linux, and then save the stream file as soon as its finished downloading, using the linux computer because linux won't recognize the permissions if the setup is like this. I'd sure like an easier way to do this, if anyone knows how. Especially if it can be done using knoppix, without requiring software or codecs I can't install.

Eg, Say a website has a movie on it, can you stream it like on Windows?

Yes, you can watch Real Media movies, and I believe with some apps (mplayer? xine? myth?) you might even be able to see wmv files. The files are saved to /tmp, or in a subdirectory of where the application is, (all of which are located on the ramdisk), and when the movie is finished, its "gone".

Then what happens when you remove the CD at the end of the session -

The ramdisk disappears (it was, after all, in ram), and if you didn't save the configuration or save anything to a persistant home, or didn't save anything to another writeable partition, no obvious trace exists of the session.

Does it stay somewhere on the HDD (Where?) or does it get deleted?-

It disappears, first because it was in your ramdisk, which ran off of RAM. But if your session included a swap file or swap partition, a forensics examination (one of the uses of knoppix btw) can recover parts of the data of your session. If your session did not create a swap partition or swap file, or use one already on the system, or you ran knoppix with cheatcodes that did not create writeable partitions/disks (and you didn't save configuration data), then nothing is left behind.

3) Once the disk has been taken out is there anyway to trace what you have been doing on it/retrive anything you have been doing on it?-

If you saved a configuration file, then stuff like what password you set for root (if any), and other settings (what nameservers, what ip address was set, what you named the box if you changed the name, etc) can be easily recovered. If you are using it in a cyber cafe in a restrictive country (or in a country that is getting more restrictive), then a keystroke logger may record your every keystroke, and I wouldn't be surprised if these type of applications ran independent of the operating system, which means that they can record everything even if you boot into knoppix. So dig, tunnel, hang glide, or hop on a plane from wherever you are, buy your own island, and don't worry about operating systems. Watch Survivor for a while prior to your dash to freedom.

4) Some programs like the text editors when closed ask if you would to save - If you do not have drive access how and where can you save?

If you are using the text editor to edit configuration files, as long as you save the configuration (and you REMEMBER to do this every time), your configuration will be saved. iirc, the first time you use knoppix and save a cofiguration, it may give you a warning that it is writing to disk, and allow you to stop the process. iirc, the pop up box also tells you that you can erase the configuration file from the other operating system if you run low on space or whatever other reason you have to want to erase the configuration file. Even if you have the partition/drive unmounted, or read-only mounted, I believe that the script that you triggered when you told the system to save the configuration file mounts the partittion, or unmounts the read-only partition and then remounts it read-write, or just changes the flag to read-write, then writes the configuration file, and then immediately unmounts it again, or changes the flag back to read-only. At least that's what it appears to be doing when I save configuration.

Knowing me there will be more questions if and when I remeber, lol :P

Thanks in advanced for any answers!

Dan

Now let me state a few things. If you are that concerned about leaving a trace, you shouldn't be using a computer, period. Use pen and paper, and then shred and burn the paper when done, making sure there's no leakage under the paper, you don't leave impressions on the paper pad (don't use a pad), and no one is watching over your shoulder. That being said, I have the same concerns you have, as I've had members in my family (yes, more than one, separate incidents) who's identity has been stolen. So I understand exactly where you are getting your paranoia, as others see it.

Also, if you are in a repressive country (which ones aren't btw?) which can take away your liberty simply for your speech, you should be very careful about your computer use, as just about anything you do can be traced/found out, as long as its worth looking for you. The nature of computing has made it ever easier to find things out, because so much data is saved in so many different places of a computer system that its very difficult to get a handle on it all. Slashdot has the stories of capturing screen output by measuring magnetism of the monitor, recording the flashing light on the ethernet port/card on the back of the computer, etc. These are extremes, but are examples of ever incremental steps that can be taken, all dependent on how much resources (money and/or effort) the spyer is willing to spend to find out about the spyee.

I'll also state the following: while your questions are normal among the paranoid walking in our midst (myself included), they are also questions that a budding young person might be asking as a precursor to evil. A "white-hat" hacker is interested in these type of questions, but so is a "black-hat" hacker, or cracker. If you are planning on some mischief, remember that when you mess with someone else's computer system, you could be messing with people's lives. If you disrupt a computer, you could also be disrupting a phone system that someone may depend on for an emergency. Or you could disrupt someone's security cam setup, which then fails to record a crime in progress. Or you could cause somone's computer to crash, who uses that computer to trade stocks, and he subsequently jumps out a window because he couldn't get a trade through just before the bell closed. Or you take out a small business (he loses financial data he didn't backup recently), and the guy's marriage falls apart a year later, finances being the number one or two reason for divorces. Or he becomes an alcoholic. Or starts beating his wife.

Whatever the reason, someone doing something that shouldn't be done, whether on a computer, or elsewhere, has consequences. And those consequences, when it comes to computers, can be quite severe, no matter how innocent the original action may seem. Because so many things we do today is dependent on computers.

If you were planning on doing something that shouldn't be done, think about. Is that something that you can look back on, ten years from now, twenty years from now, and be proud, hold your head up high, and tell your kids what you did? Will they be proud of you? How about doing something else instead? Put knoppix to good use. Find some old hardware, get it working on knoppix, and donate it to a family with a young child, who can't afford a computer. Teach the child how to start the computer, and access the games on knoppix. I've seen a three year old load and operate a cd player to watch videos, and start and run a computer to play games. Volunteer at a local hospital. Call a few hospitals, and find one where you can go in and show sick kids how to use knoppix to play games. Or a hospice. Or a center for children with terminal diseases, such as cancer. You'll have fun doing it, and you'll be those kids' hero. Hospitals, and centers for children with terminal illnesses are a dreary place for those kids. But they can be made much better, simply by your presence, and your assistance in teaching them knoppix. And besides it being fun for you, it will look good on your resume, and if you haven't entered college/university yet, it may very well be the deciding factor in your acceptance to your school of choice.

Help to make this world better, not worse. You will feel better for it, your future spouse and children will be proud of you, and others in your personal life and your business life will credit you with your actions, and want to be associated with you. It is a differentiating quality of your character that will help you advance in life. Start building that character now.