March 15, 2006
New Video from al Qaeda in Saudi Arabia
Al Qaeda in Saudi Arabia has released a new high production value 16 minute video. An accompanying announcement in Word format is dated today, 3/15. Luckily, the 'martyr' Fahd Farraj al-Juwair, the former Emir of Al-Qaeda in the Land of Mohammed, was killed 2 weeks ago in Riyadh after the failed attack on the Abqaig oil facility. Unfortunately, this video is making its rounds rapidly on the internet. Worst yet, a lot of young men look to these videos as a source of inspiration. Thanks to Doubletap for the video. I will send it on request with accompanying announcement.
Comments are disabled.
Post is locked.
Posted by: Rusty at
02:58 PM
| Comments (7)
| Add Comment
Post contains 115 words, total size 1 kb.
1
Meanwhile Saddam Hussein has again turned the Iragi court into a circus, thereby escaping hanging for another 3 weeks! These people cannot be helped! Like putting a dog up in a palace. Wake up and smell the coffee!
Posted by: Justus at March 15, 2006 03:25 PM (Y2ILH)
2
That is great news. Microsoft Word format has lots of embedded metadata that can be used to identify the author/computer with Computer forensics:
Word Metadata analysis
This is an intelligence gathering method that the Government doesn't overlook.
Posted by: davec at March 15, 2006 04:00 PM (CcXvt)
3
Dave,
Does the metadata get saved even when the docs are compressed into a .zip or .rar file?
Posted by: Rusty at March 15, 2006 04:04 PM (JQjhA)
4
PS-how does one read the metadata as described in article you linked to?
Posted by: Rusty at March 15, 2006 04:09 PM (JQjhA)
5
yes, even using compression the original document contains the embedded metadata, it looks like he is using a perl script to do the extraction. I have always used the 'strings' binary, or hex editor to see most of the data, I believe forensic programs like encase have the ability to completely decode word format (and a whole range of files)
Posted by: davec at March 15, 2006 04:50 PM (CcXvt)
6
If you're using windows, a utility like 'strings' for windows is available at:
http://www.sysinternals.com/Utilities/Strings.html
You will see towards the bottom data that will be seperate from the body, it will contain names/paths/ms version, and sometimes things like printer names, sometimes you can see revision data.
you'll probably want to pipe it out to 'more' to read it.
strings word.doc | more
Posted by: davec at March 15, 2006 05:16 PM (CcXvt)
7
Does it have a back beat you can dance too?
Posted by: hondo at March 15, 2006 06:14 PM (9pQ6D)
19kb generated in CPU 0.0176, elapsed 0.1621 seconds.
119 queries taking 0.1542 seconds, 256 records returned.
Powered by Minx 1.1.6c-pink.
119 queries taking 0.1542 seconds, 256 records returned.
Powered by Minx 1.1.6c-pink.
