SANS typical menu missing from along the top in 3.0 download vmware appliance

[teamdfir]

SANS typical menu missing from along the top in 3.0 download vmware appliance

[ekristen]

Hi @wrkrbee at this time that menu will not be returning. Several of the more common applications are in the sidebar, the rest are searchable using the ubuntu start menu.

[wrkrbee]

I have no sidebar either ---

---

In accordance with applicable privacy protection laws, this email and its contents are a private communication and are intended only for the expressed recipient. I do not authorize disclosure to a third party without my direct written consent.

If you have received this email in error or are not the intended recipient, securely destroy it (as well as all copies) and notify me via separate email immediately.

---

From: Erik Kristensen [mailto:[email protected]]
Sent: Friday, October 24, 2014 3:48 PM
To: sans-dfir/sift
Cc: wrkrbee
Subject: Re: [sift] SANS typical menu missing from along the top in 3.0 download vmware appliance (#38)

Hi @wrkrbee https://github.com/wrkrbee at this time that menu will not be returning. Several of the more common applications are in the sidebar, the rest are searchable using the ubuntu start menu.

—
Reply to this email directly or view it on GitHub #38 (comment) . https://github.com/notifications/beacon/AFfjCMgjAJC3Rr7rmkuU-HoyZFjAZASRks5nGqRkgaJpZM4Cyzzm.gif

[ekristen]

Provide screenshot please.

[wrkrbee]

I did in the last one; however, this is what I see:

The 2.14 appliance was fine. A 3.0 appliance I built myself shows the dash and everything. I've downloaded the 3.0 appliance 2 separate times thus far (verifying the hash each time) and both have the same issue on two separate computers -- one a Windows 7 box running VmWare 10, and the other on Linux running VMWare 9.0

---

In accordance with applicable privacy protection laws, this email and its contents are a private communication and are intended only for the expressed recipient. I do not authorize disclosure to a third party without my direct written consent.

If you have received this email in error or are not the intended recipient, securely destroy it (as well as all copies) and notify me via separate email immediately.

---

From: Erik Kristensen [mailto:[email protected]]
Sent: Friday, October 24, 2014 4:12 PM
To: sans-dfir/sift
Cc: wrkrbee
Subject: Re: [sift] SANS typical menu missing from along the top in 3.0 download vmware appliance (#38)

Provide screenshot please.

—
Reply to this email directly or view it on GitHub #38 (comment) . https://github.com/notifications/beacon/AFfjCAQP4K7Vezhgt6iLoitG87KjWc1Lks5nGqn-gaJpZM4Cyzzm.gif

[ekristen]

You will have to login to github and post the image in the issue that way, it will not work via email.

[wrkrbee]

I'm signed in to github right now, and I don't see anywhere to attach or post an image.

Here, I posted a pic to my Google drive....

https://drive.google.com/folderview?id=0B97byuS4_lCLNkVmZVVNcHpEWWM&usp=sharing

[ekristen]

I've not seen that happen, nor can I reproduce it. @SANS-SIFT have you seen this on the VM?

[wrkrbee]

I can get it working on Ubuntu 14.04LTS, running VMware 10 with the Sift 3.0 appliance, but not under Windows 7. I downloaded it again, extracted it again and I get the same thing. When I bring the appliance up on my Ubuntu box; however, it notifies me it's disabling 3D. I can't run it from there though because I really don't have enough RAM on that system.

[ekristen]

Sounds like a vmware issue on Windows 7 then.

[wrkrbee]

It's interesting that you say that because the SIFT 3.0 appliance I built manually on Ubuntu 14.04 LTS seems to also have problems with the rendering capabilities of the graphics. For instance, when I open a Window, it takes a while to open, and then slooooowly pops up. When I type, it doesn't immediately show on the screen. When I switch to another desktop other than Unity, the slow response disappears.

Now that I'm having a problem with Unity in the 3.0 downloaded appliance, I'm starting to wonder if it's not something to do with 3D graphics acceleration and Unity -- as I said, on Ubuntu, 3d disabled itself on startup.

However, there were no problems with prior versions of appliances with speed, and when I change away from Unity, the problems go away.

[wrkrbee]

FYI, in case you see others with this problem, they just need to enable gnome classic rather than unity. Once they do so, they will have the video will stop wigging out and full functionality will return. They'll just need to create the Wireshark, Hexeditors, calc, etc. so that they are readily accessible. One quick question -- why isn't Autopsy the newest version (4.x)?

[ekristen]

I can look into the autopsy version.

As for the video issues, it sounds like a hardware issue or vm settings for your specific setup.

[wrkrbee]

I would concur had I modified the default settings for video or hardware in anyway, but I didn't before I started noticing this issue. Then, I did modify processors to include the 4 I'm running and up to 4GB of RAM (this machine has a lot more than that and at least 6 GB) was free. The only thing that makes it work is dumping Unity - which many people naturally do, but I actually use 14.04LTS and Unity a lot on my other box, so I kind of miss it.

[arls1481]

I cannot get the VM Appliance to work in Win 7 either. it will not boot at all and generates a grub error:
Error: file not found
grub rescue>

[ekristen]

It sounds like a driver or VM version issue.

@SANS-SIFT might be able to comment, as they build the VM. However you can install a vanilla 14.04 install of ubuntu and then run the bootstrap script https://github.com/sans-dfir/sift-bootstrap/ and you will get everything that is in the VM.

[ekristen]

Closing this out. If you still are having problems feel free to re-open it.