Thursday, December 4, 2008

The start of December and goings on...

December is here and we have only a few weeks until the end of the year. Jason is doing well and his is growing. He is up to 10 lbs, 7 oz. He is starting to make vocal noises with us from time to time. To us that is a big deal to watch him start interacting with us like this or when he smiles in response to seeing us come into his view.

Work has been pretty good and I am keeping myself busy with the caseload. Lately there has been a lot of talk about the MS RPC vulnerability (08-067) and it appears to be drawing attention of the hacking and bot-net worm authors out there.

That's all for now.

Thursday, November 20, 2008

Latest Jason Pics...Its been a while


Sorry that it has been a while but everyone should know that Jason is doing well. He is up to 10 pounds and he is becoming more active. he is starting to fit into bigger clothes and do more too. He still has regular visits to the Dr's office. They like what they see from him and his progress so far. I had the time today to pull two pictures off the camera and my camera-phone so you can get a current look at him.

Here he is laying next to one of the cats and reaching out to him. He just started learning about the cats and he seems to be aware that they are unlike us.
Here is a picture of him in one of the outfits that he had seemed to get, I don't know how. Its like he's telling us, "You can't see me."

Saturday, October 25, 2008

Doing the data analysis job better

As I was talking to a collegue this week, there is something that makes me think that we can do stuff better. We agreed that there is a certain mentality to not be satisfied with the way things are and to try to build upon things and improve process, flow, efficiency. (Please don't confuse me as a humorless German because of that- I just like things to work better and I abhore the tedious tasks whenever possible.)

So on Friday I was looking at this matter I have been assigned to and itmhad a ton of Event logs to go through and examine for information that may lead me to understand how a group of servers may have been compromised in the first place. In this case there were about 25 different Event log files with many of them in different places in the directory structure that was sent to me. Going through each of these was going to be a challenge. I am always hesitant of moving files around when it involves a case I am working on, mainly because you making track into a situation. (Keep in mind that I always work on the backup of the data so if the rare occasion disaster strikes, I dont have to go back to the client asking for a do-over. Bad Ju Ju!) I also think when you move the data around you may have issues keeping one set event logs separated and distiguisable from another set. I put into use a tool that Harlan Carvey came up with in his book Windows Forensic Analysis, that takes event logs and can output them in .CSV format so they can be inported into Excel or any other spreadsheet. (I like to run them through a strings-searching tool myself, as sometimes the resultant .CSV files are too big for Excel to handle.) So you would think it is easy; just take each of the event logs and run them through LSEVT2.EXE and I would get my .CSV files to search through! Easy for one or two, but for 25, its a pain.

So I figured out the way to make a list of each of the files, in each of the directories they resided in; remove the white-space (I hate white-space; only in a few cases does anything good ever comes from it and you will see one of those today) from the listings; put a numerical designation beside each file listing so I could tell them apart when the .CSV files were made; and perform a For - Do batch file loop that would read my listfile and for each listing take the filename and run it through LSEVT2.EXE and then redirect the output to a .CSV file with the number as the file name. It worked and I was able to get off the keyboard and let this run by itself without me directly managing it. It took just under 2 hours to run so in my mind it saved me (and the client) 2 hours of tedious bordom just by spending 20 minutes of a little programming, researching, troubleshooting, and testing. Here is what it looks like in a 'more visual sense':

Suppose I have 6 event logs, all in separate directories and the only thing similar is their extention (.EVT):

F:\Big Case\Web Server\SystemEvent.evt
F:\Big Case\Web Server\ApplicationEvent.evt
F:\Big Case\Web Server\SecurityEvent.evt
F:\Big Case\BES Server\System.evt
F:\Big Case\BES Server\Application.evt
F:\Big Case\BES Server\Security.evt

A DIR /s *.evt >> filelist.txt would put the files in one file, filelist.txt. But it still has white-space (which broke it the first couple times I tried it.) I would put it through Notepad and replace all white space so it would look something like this:

F:\Big_Case\Web_Server\SystemEvent.evt
F:\Big_Case\Web_Server\ApplicationEvent.evt
F:\Big_Case\Web_Server\SecurityEvent.evt
F:\Big_Case\BES_Server\System.evt
F:\Big_Case\BES_Server\Application.evt
F:\Big_Case\BES_Server\Security.evt

Then I would put a number next to each (the only time I approve of white-spaces is with tokens) and it would look like this:

F:\Big_Case\Web_Server\SystemEvent.evt 1
F:\Big_Case\Web_Server\ApplicationEvent.evt 2
F:\Big_Case\Web_Server\SecurityEvent.evt 3
F:\Big_Case\BES_Server\System.evt 4
F:\Big_Case\BES_Server\Application.evt 5
F:\Big_Case\BES_Server\Security.evt 6

This file would be saved as filelist.txt and in my program code I would designate %%num as the number and %%fil as the path-and-filename.

The heart of the for-do command would look something like this:
for /f "tokens=1,2" %%fil in (filelist.txt) do echo %%num && LSEVT2.EXE -c -f %%fil > %%num.csv

That is the general gist of how it works and it became a complete time saver. I owe heaps of gratitude to my colleague, Harlan Carvey. If it wasn't for his expertise and talent, I would never have dreamed this up.

Time form me to stop blogging and get on back to the case.

Weight gain and growth development

Jason has put on some additional weight this week. We weighed him the other day and he was at 8 pounds and 8 ounces. He looks like he has gotten bigger and he also is doing more. This is a big delight to us. We have noticed him lifting his head more and even once or twice reaching out for things. He certainly eyeballs us and its taking notice of things around him like the TV and some of his playthings.

That's all for now until I have more to go in this posting

Saturday, October 18, 2008

At home care of Jason

This week was pretty good with Jason. He is doing well at home and he is now up to 8 pounds and 3 oz. His oxygen needs have been reduced by his cardiologist and it makes thing better all though out the day.l He is only on supplemental oxygen in the night time while he sleeps. This makes it easy to move about the house with him during the day without having to have an oxygen delivery tube snaking behind us as we go.

Today was a really big day because we finally got up the courage to replace Jason's nasogastrc (NG) tube. I can say there is nothing funny about taking a tube and passing it down your your nose down into the stomach. Its been a month since Jason had his last one put in and we have been home since we left UCSF. We were trained very well on the proper insertion and placement techniques in case we would have to actually do it at home. I really admire the coaching and encouragement they gave us, and today we had to draw upon it. We took out his old NG tube and gave him about two hours without it which was right between feedings. Then when it came time for another feeding, we put in the replacement NG tube. It can be very nerve-wracking to do on anyone, let alone a small infant who you can't instruct to swallow on command or have to listen to the crys as it goes it. But Jason was very good about it and settled down very quickly after it was in and we veriefied (4 times) that it had gone into the proper place.


(Really, I am not without a sense of humor. If you wan to see a funny video on the subject, check out these guys who posted a video on YouTube. They appear to be servicemembers so Im sure they can handle the discompfort.)

Monday, October 6, 2008

This past week (busy)


This past week has been pretty busy with all that goes on. So that everyone knows, Jason is doing well and he has gotten bigger. As of the other night, he now weighs 8 pounds. He is making good progress and he appears to be developing well. We also have time to catch the cats making nice with Jason. The other day I took a picture of one of the cats, Max, with a bib around his neck. My wife and I could not stop laughing

Sunday, September 28, 2008

Garage sale,haircuts, cable outage, and project creep

Jason is doing well at home the past few days and this gives us time to take care of some of these other things that had a need to be done. So today I was able to get up early and get somethings done while my wife kept an eye on Jason.

First was go and get a haircut. Frankly I never look forward to getting my hair cut in town because of two factors. The first being that they dont seem to know or care what they are doing. The 4 times I have let this place cut my hair, they have let me down twice-50% satisfaction. The other reason is that it is usually a long wait for just to get into the chair. I usually go over first thing in the morning and there is one barber there but two or sometimes three patrons ahead of me, so it will be an hour of waiting around before I get my unsatisfactory service. Bottom line, I am committed to finding a new babershop to spend my money-enough is enough.

When I got back to the house, I took some excess furniture that we had in the garage and home and got a hastily established garge sale going on the drive way. In our town, every weekend there seems to be one or two garge sales in the neighborhood and it makes it easy, so easy that I rarely ever have to post signs and car and foot traffic are a-plenty. by 1PM I got rid of an extra bed and Ikea chair-footstool set we had and that made for big space savings in the garage!

The pasf few days I have been working on setting up a DOS bootdisk that works with many network cards that are used in systems I have to work with. I have come up with a pretty good boot disk that supports most of these network cards and USB drive support so running Ghost to image and reload systems will be easy. I am finding more and more support features to put into this, but it is bordering on what is known as project-creep. My understanding of this term is when a small project grows and grows and grows beyond initial expectations. Lets see how it goes later on the week.

Thursday, September 25, 2008

A visit to the doctor and Thomas's furry helper at work

Today we took Jason to his pediatrician and we got a good report from her and some helpful information. Jason is also growing well and she likes his progress. Jason appears to be up to 7 lb 2 oz or 3.23 kg which is all very good. And his cry is getting louder too, which is a good sign as it means he is recovering from the surgery a little more each day.

On the way to and from the medical center, Jason got to see some of the 'wildlife' we have here in the Central Valley in California. It really means mostly goats, dairy cows, and other than livestock, some ducks and cranes in ponds and irrigation canals. Exciting, eh?

I spent more time at work when we all returned in the afternoon and I started working on data aquisition exercises using EnCase (remote/crossover-cable, Linux, USB flash drives, etc) so I can come up with some teaching plans for work that are easy to deliver to clients. I got a kick out of my cat, Max, who came in the office to 'supervise' me. I think this cat certainly has a personality that is very unique.

Its funny because he actually waited until I had gotten out of my seat and he jumped right in and took my place from behind my back- as if he worked it out that way! In fact as I type this out, he is sitting in the same chair as if this is his domain.

Tuesday, September 23, 2008

Following Instructions (especially when it counts!)


Ok people; I have this thing about following instructions in good faith, especially if the person/group/organization knows more about something than you do, its someone else's money, or if lives are at stake. Take a gander at the little photo exhibit and read on.

I noticed an event while I was at the hospital where another child was admitted into the Pediatric Cardiac Intensive Care Unit (PCICU) transition floor at UCSF. The parents of this young child appeared to be pretty young themselves and their little young one had a serious need for open heart surgury. When the morning of the scheduled surgury came around, the nursing staff posted NPO notices ("Nothing per Oral"-no food or formula) on and about crib-side. But one of the parents later admitted to giving chips to the patient just hours prior to going into surgury.

Well, the surgical team of doctors and nurses got wind of this and decided they had to scrub the mission, out of possible risk of the child choking while under anesthesia. In my mind this is unexcusable; no amount of quibbiling will fix it or make any corrections. Later in the week the surgury was rescheduled and the instructions were explicit as the tolerance to stupidity was then low at that point. Well deserved, in my book.

Bottom line:Grow up; follow instructions, and take the responsibility when you fail to heed the word of expertise.

Olympus Mons of email to go through....


Folks. I've been back with the nose to the grindstone and I found a ton of email to go through, including numerous computer vulnerability reports from US-CERT and SANS. Its not even the silly season (Thanksgiving, Christmas, etc) yet. So this might provide for an over-abundance of work to do. Great! That is a good thing.

Check out the coin I was presented while I was deployed in 2007. I do love the work!

Home and feeding Jason


Jason is adapting to having his parents around him full-time. The house is certainly quieter than at the hospital, but Jason seems to get in sleep when he needs to. He gets fed often enough and here is a picture of me feeding him by bottle.

We weighed him last night and he is almost up to 6 lb, 13 oz, or 3.10 Kg for those metrically-minded.

Monday, September 22, 2008

First things to deal with coming home...

We got home late in the afternoon on Thursday and the event was not without some difficulties. We had to wait at the pharmacy to get meds ready while they were being prepared and consulted on; then the arrival home was a bit tough as we got a delivery from the oxygen and food supply delivery company.

(Jason is getting a special low-fat formula that is mixed and prepared daily. And he gets food in little bits continuously at night by the help of a feeding machine that doles out a small bit from a feeding bag every few minutes.) Well, our trouble was that the bags were not availble at the time we got home and the machine was delivered. So that made for some tense moments until the issue was resolved later in the evening. My thanks go out to the delivery supervisor that braved traffic and a late night to get the required supplies. It was definatly above and beyond the job description in my book

Then on Friday we had our first outing as Jason had his first doctors appointment. The doctor said that Jason looked really well and he was *especially impressed* with the sound of his heart as he performed the examination. (Big, big kudos to everyone to UCSF!!)

Our challenge that we faced was we had to lug the oxygen tank around in the car and into public. Its pretty big (its a bit bigger than a baby car seat) and can be cumbersome even in a two-wheeled cart. In the picture it is the tank in the silver hand cart. Trust me, it was not easy to deal with and it kept running into things despite our efforts. Its a big pain inside the house as you have to move it along with the baby from room to room.

But things got better. On Friday afternoon and Saturday we got more oxygen tanks. The big tank stays in one place and a long tube goes throughout the house as we move Jason about.

The large tanks are expected to last for bit over a week at Jason's rate of consumption, and smaller tanks are easier to carry around and they should last about 4-6 hours for each one.
We have not tried them out yet, but you can be sure we will soon as Jason will need to go to regular doctor's appointments with his pediatrition and cardiologist in the future. That's all for now

Friday, September 19, 2008

Finally home!!!


Yes, the rumor is true. The hospital let us go home yesterday. It took some doing but we finally made it home and got some things worked out by late evening so Jason was taken care of. This is going to be a short post but I will have more to put up later as I unpack and my wife and I work out how to deal with all of Jason's needs (O2 tank, feeding pump machine, etc.)

Here is a picture of Jason and what I look like after a month in the hospital looking after Jason. Note the long hair..you may never see it that long again for a long, long while....

Gotta split.

Monday, September 15, 2008

Jason's homeward preparations and carseats and bigger boy


Great News! We've been told that Jason can leave the hospital this week. We have some preparations to get ready to bring him home. Some of the hospital staff visited us today and explained some of the plan going forward and the required medication. We get tons of medical and and care information every day.

A big milestone that we did today was the "Carseat" test. This event was to ensure we could strap him in securely into an approved car seat and test Jason's fortitude in tolerating it without adverse effects. The cool thing about the event is that it is a sure sign that a familiy is going home with their child and we are eager with anticipation. The picture here shows what Jason looks like in his car seat...sleeping. He might take after someone.....

Jason is getting bigger; we were told that he was 2.8 Kg ( or 6 pounds, 2 oz) and it shows. His features are filling out, and he appears to be getting longer and stronger. I guess there will be many of these observations just like this.

Friday, September 12, 2008

Jason's lil trip in the hospital


On Thursday Jason was treated to a trip to another wing of the hospital. The staff wanted to see how well his swallowing mechanisms worked before we take him home (as choking is never good and it can be prevented if they know how well a baby swallows his milk or formula.) So they put him in a little red chair and watched his profile in an X-ray that took successive pictures while he drank a milk mixture.

The test took about 15 minutes but we had about an hour outside of the transition ward that Jason was assigned to for the last two weeks. Its relieving to us that he did really well. Here is another picture of the X-ray action as I captured it. Jason loved the whole experience and he was pretty tired out after the trip was done. I was amazed how long he stayed active and awake; and the best part was he was a happy charming baby through the entire activity.

Other news is that Jason is growing! He is up to 2.7 Kg, just about 6 pounds.

Wednesday, September 10, 2008

Jason 's progress-fun with bottles

For all those that want to know, Jason is doing well this week. He is gaining weight (now 2.56 Kg) and the hospital staff is suggesting that he may premitted to go home soon. Soon as sometime in a week. That could mean that I could be going back to work too! Here is my viewpoint: I *really enjoy* my work. So I am excited about both Jason coming home and returning to a line of work that I am into; this is the best of two worlds!

Also Jason is starting to drink a little from the bottle. This is big news because he has been fed through a tube before Monday and he is just learning how to do something (that we take for granted) that is pretty tough to coordinate (breath, suck, swallow, breath again) and tiring for little heart patient babies. So each instance where Jason feeds from the bottle, it is an exercise that makes him stronger and better equipped for other tasks.

Saturday, September 6, 2008

Big, big happenings today

Of the big things that happend today, first we were told when we got to his cribside was that he was up to 2.45 Kg in weight. That means he is getting closer to what is considered a discharge weight.

Jason was also getting some of his medication orally, but not through the NG-tube. Today's nurse that was watching and caring over Jason demonstrated he can swallow liquid medication. So they got both my wife and I to administer his medications using a syringe and watched us through the process to ensure it was done right and we could successfully do it at home should he need it. It was actually really exciting to see him swallow. He can use a pacifier a litle bit and this shows his sucking reflex is working well too. (He spent a lot of time intubated on a breathing machine when he was first born and after surgury and we were worried that he may be adverse to anything placed in his mouth for a while.)

Today our nurse wanted to us to emplace a NG tube into the mouth as part of his discharge plan. So it was pretty nerve racking to thread a thin plastic tubing through one of Jason's nostril and down to his stomach, all while he was squirming and really agitatedly crying. (You do the same to your nose and see how you like it.) I was thrilled that once it was in place and I verified it was indeed in the stomach, Jason calmed right down and went to sleep.

In summary Jason had a big day today.

Friday, September 5, 2008

Week wrapup with Jason

Today Jason had a pretty good day and he is making progress. He weighs around 2.45 Kg (5 1/2 pounds) and his oxygen saturation stayed pretty good today. Therer are the first mentions this week about the possibility of going home in a couple weeks. That is great news for us!

One of the big things that needs to happen for Baby Jason to be discharged is a increase of his weight to about 5.5 pounds (or 2.5 Kg.) So he is getting plenty of calories and nutients automaticly fed to him (though a nasogastric tube that goes from the pump to the nostrils, down the nasal cavity and down the esophogus to the stomach.) This type of intubation is called 'NG' for short.

The challenge we face is making sure we can keep the tube in place and when it is pulled out by Jason's curious hands, we can reinsert it into the proper place.

Wednesday, September 3, 2008

Jason Millar's progress today

Today was another day where we made a trip to visit Jason in his room at UCSF Medical Center & Children's Hospital. (By the way if you are interested about the work that UCSF MC/Chldrens' Hospital does, consider going to this link to learn more.) When we arrived in the afternoon we got there just in time when Jason woke up.

In the past few days the nurses have been weening him off of oxygen (supplied by tubes to the nostrils) by lowering both the volume and percentage of oxygen as part of the medical plan to his transition for leaving the hospital and going home. This afternoon the nursing staff took him off of it completely and allowed him to breath in room-air (what the rest of us breath) while keeping a close eye on his oxygen saturation in his blood. For those that don't know, most humans maintain a near 100% arterial saturation (blood fresh from the lungs being sent out to the systemic body by way of arteries) Since Jason is getting venous blood mixed in with his oxygenated blood, it is expected to be less that 90% for the time being until the next two heart surgeries. He did pretty well with the transition and we saw that he handled it pretty well. We saw him in various activity states such as sleeping, and then later on in a grumpy crying state and his saturation levels stayed above 77%.

We also saw what happens when Jason was held while a little upset. My wife picked him up and held him in her arms, and he settled down almost immediately. We were pretty surprised by this and a bit apprehensive about this becoming habitual as I of the mind that Jason will be training us as much as we will be trying to train him.

On a final note for this post is that I am an aficionado of anything technical or scientific in nature. If its math based, or it has some basis in chemistry or physics, then I become interested in it. But but by no way am I any sort of expert in the field of medicine. I am just a guy that is into how life 'ticks' and what makes carbon-based life one of the most efficient machines known to mankind in this day. My disclaimer is that I might stand to have a erroneous interpretation in the present or future on a medical subject and I will assert now that it can come from human error in understanding. If anyone has any correction or clarification on the matter, I wholeheartedly invite them to advise me so I learn and grow with the correct knowlege. Thank you for your understaning

Ok, that's it for now. Lets' see about posting a picture....

Start to a new blog

This week I started thinking about setting up a blog space on the Internet to allow greater ease in getting my messages out as events go on in my life. I work in the computer forensics and incident response business so the dealings with details are my bag. I now have an outlet for the many particulars now can have a home. For those waiting with baited breath, sorry, but nothing that violates non-disclosure agreements or national secrecy statutes will be found here to the best of my ability.

I am delighted for those who wander in and take a look. I intend to post most anything that goes on in my life and the subject matter can get pretty eclectic. For instance, I enjoy reading about discrete electronics and digital logic, so sometimes I can open up discussions about Don Lancaster's CMOS and TTL papers and books and single-board computer systems. Then the next day there might be a discussion of arcane computing (as I grew up with my first computers being the Apple IIgs and the Commodore 64). Then to close out the week, one may anticipate a posting about running or the backyard area-beautification project that always seems to be on-going. So please read on and you may never go without a surprise..