EBOOK Digital Forensics With Open Source Tools Using Open Source Platform Tools For Performing Computer Forensics On Target Systems Windows Mac Linux Unix Etc Ebook Pdf Version download full chapter pdf kindle
EBOOK Digital Forensics With Open Source Tools Using Open Source Platform Tools For Performing Computer Forensics On Target Systems Windows Mac Linux Unix Etc Ebook Pdf Version download full chapter pdf kindle
Cory Altheide
Harlan Carvey
Technical Editor
Ray Davidson
MOV (Quicktime)������������������������������������������������������������������191
MKV��������������������������������������������������������������������������������������� 192
Archives�������������������������������������������������������������������������������������� 192
ZIP������������������������������������������������������������������������������������������192
RAR����������������������������������������������������������������������������������������193
7-zip����������������������������������������������������������������������������������������195
TAR, GZIP, and BZIP2����������������������������������������������������������195
Documents����������������������������������������������������������������������������������196
OLE Compound Files (Office Documents)����������������������������197
Office Open XML������������������������������������������������������������������201
OpenDocument Format����������������������������������������������������������204
Rich Text Format��������������������������������������������������������������������205
PDF����������������������������������������������������������������������������������������� 206
Summary�������������������������������������������������������������������������������������210
References�����������������������������������������������������������������������������������210
CHAPTER 9 Automating Analysis and Extending Capabilities������������������� 211
Introduction���������������������������������������������������������������������������������211
Graphical Investigation Environments���������������������������������������� 211
PyFLAG���������������������������������������������������������������������������������212
Digital Forensics Framework�������������������������������������������������221
Automating Artifact Extraction���������������������������������������������������229
Fiwalk�������������������������������������������������������������������������������������229
Timelines�������������������������������������������������������������������������������������231
Relative Times������������������������������������������������������������������������233
Inferred Times������������������������������������������������������������������������234
Embedded Times��������������������������������������������������������������������236
Periodicity������������������������������������������������������������������������������236
Frequency Patterns and Outliers (Least Frequency
of Occurrence)�������������������������������������������������������������������237
Summary�������������������������������������������������������������������������������������239
References�����������������������������������������������������������������������������������239
Appendix A Free, Non-open Tools of Note���������������������������������������������� 241
Introduction���������������������������������������������������������������������������������241
Chapter 3: Disk and File System Analysis����������������������������������242
FTK Imager����������������������������������������������������������������������������242
ProDiscover Free��������������������������������������������������������������������242
Chapter 4: Windows Systems and Artifacts��������������������������������244
Windows File Analysis�����������������������������������������������������������244
Event Log Explorer����������������������������������������������������������������244
Log Parser�������������������������������������������������������������������������������245
x Contents
Index���������������������������������������������������������������������������������������������������������� 257
About the Authors
Cory Altheide is a security engineer at Google, focused on forensics and incident
response. Prior to Google, Cory was a principal consultant with MANDIANT, an
information security consulting firm that works with the Fortune 500, the defense
industrial base, and banks of the world to secure their networks and combat cyber
crime. In this role he responded to numerous incidents for a variety of clients in
addition to developing and delivering training to corporate and law enforcement
customers.
Cory also worked as the senior network forensics specialist in the National
Nuclear Security Administration’s Information Assurance Response Center (NNSA
IARC). In this capacity he analyzed potentially hostile code, performed wireless
assessments of Department of Energy facilities, and researched new forensic tech-
niques. He also developed and presented hands-on forensics training for various DoE
entities and worked closely with members of the Southern Nevada Cyber Crimes
Task Force to develop their skills in examining less common digital media.
Cory has authored several papers for the computer forensics journal Digital
Investigation and was a contributing author for UNIX and Linux Forensic Analysis
(2008) and The Handbook of Digital Forensics and Investigation (2010). Addition-
ally, Cory is a recurring member of the program committee of the Digital Forensics
Research Workshop.
xi
This page intentionally left blank
Acknowledgments
Cory Altheide
First off I want to thank Harlan Carvey. In addition to serving as my coauthor and
sounding board, he has been a good friend and colleague for many years. He has
proven to be one of the most consistently knowledgeable and helpful individuals
I have met in the field. Harlan, thanks again for adding your considerable expertise to
the book and for never failing to buy me a beer every time I see you.
I also thank Ray Davidson for his work as technical editor. His early insights and
commentary helped focus the book and made me target my subsequent writing on
the intended audience.
Tremendous thanks go out to the “usual suspects” that make the open source
forensics world the wonderful place it is. First, thank you to Wietse Venema and Dan
Farmer for creating open source forensics with “The Coroner’s Toolkit.” Thanks to
Brian Carrier for picking up where they left off and carrying the torch to this day.
Simson Garfinkel, you have my gratitude for providing the invaluable resource that is
the Digital Forensics Corpora. Special thanks to Eoghan Casey, who first encouraged
me to share my knowledge with the community many years ago.
To my parents, Steve and Jeanine Altheide, thank you for buying my first Com-
modore-64 (and the second… and the third). Thanks to my brother Jeremy Altheide
and the Old Heathen Brewing Company for producing some of the finest beers
around… someday.
I express infinite gratitude to my incredible wife Jamie Altheide for her never-
ending patience, love, and support during the research and writing of this book.
Finally, I thank my daughters Winter and Lily for reminding me every day that I will
never have all the answers, and that’s okay.
Harlan Carvey
I begin by thanking God for the many blessings He’s given me in my life, the first of
which has been my family. I try to thank Him daily, but I find myself thinking that
that’s not nearly enough. A man’s achievements are often not his alone, and in my
heart, being able to write books like this is a gift and a blessing in many ways.
I thank my true love and the light of my life, Terri, and my stepdaughter, Kylie.
Both of these wonderful ladies have put up with my antics yet again (intently staring
off into space, scribbling in the air, and, of course, my excellent imitations taken from
some of the movies we’ve seen), and I thank you both as much for your patience as
for being there for me when I turned away from the keyboard. It can’t be easy to have
a nerd like me in your life, but I do thank you both for the opportunity to “put pen to
paper” and get all of this stuff out of my head. Yes, that was a John Byrne reference.
Finally, whenever you meet Cory, give him a thundering round of applause. This
book was his idea, and he graciously asked me to assist. I, of course, jumped at the
chance to work with him again. Thanks, Cory.
xiii
This page intentionally left blank
Introduction
Intended Audience
When writing a technical book, one of the first questions the authors must answer
is “Who is your audience?” The authors must then keep this question in mind at all
times when writing. While it is hoped that this book is useful to everyone that reads
it, the intended audience is primarily two groups.
The first group is new forensic practitioners. This could range from students who
are brand new to the world of digital forensics, to active practitioners that are still
early in their careers, to seasoned system administrators looking to make a career
change. While this book is not a singular, complete compendium of all the forensic
knowledge you will need to be successful, it is, hopefully, enough to get you started.
The second audience is experienced digital forensics practitioners new to open
source tools. This is a fairly large audience, as commercial, proprietary tools have
had a nearly exhaustive hold on working forensic examiners. Many examiners oper-
ating today are reliant upon a single commercial vendor to supply the bulk of their
examination capabilities. They rely on one vendor for their core forensic platform
and may have a handful of other commercial tools used for specific tasks that their
main tool does not perform (or does not perform well). These experienced examiners
who have little or no experience with open source tools will also hopefully benefit
greatly from the content of this book.
xv
xvi Introduction
malware-related intrusion cases are becoming more and more prevalent, we discuss
some of the artifacts that can be retrieved from Windows executable files.
We continue on to Chapter 5, Linux Systems and Artifacts, where we dis-
cuss analysis of the most common Linux file systems (Ext2 and 3) and identifi-
cation, extraction, and analysis of artifacts found on Linux servers and desktops.
System level artifacts include items involved in the Linux boot process, service
control scripts, and user account management. User-generated artifacts include
Linux graphical user environment traces indicating recently opened files, mounted
volumes, and more.
Chapter 6 is the final operating system-specific chapter, in which we examine
Mac OS X Systems and Artifacts. We examine the HFS+ file system using the
Sleuth Kit as well as an HFS-specific tool, HFSXplorer. We also analyze the Property
List files that make up the bulk of OS X configuration information and user artifacts.
Chapter 7 reviews Internet Artifacts. Internet Explorer, Mozilla Firefox, Apple
Safari, and Google Chrome artifacts are processed and analyzed, along with Outlook,
Maildir, and mbox formatted local mail.
Chapter 8 is all about File Analysis. This chapter covers the analysis of files
that aren’t necessarily bound to a single system or operating system—documents,
graphics files, videos, and more. Analysis of these types of files can be a big part of
any investigation, and as these files move frequently between systems, many have the
chance to carry traces of their source system with them. In addition, many of these
file formats contain embedded information that can persist beyond the destruction of
the file system or any other malicious tampering this side of wiping.
Chapter 9 covers a range of topics under the themes of Automating Analysis
and Extending Capabilities. We discuss the PyFLAG and DFF graphical inves-
tigation environments. We also review the fiwalk library designed to take the pain
out of automated forensic data extraction. Additionally, we discuss the generation
and analysis of timelines, along with some alternative ways to think about temporal
analysis during an examination.
The Appendix discusses some non-open source tools that fill some niches not
yet covered by open source tools. These tools are all available free of charge, but are
not provided as open source software, and as such did not fit directly into the main
content of the book. That said, the authors find these tools incredibly valuable and
would be remiss in not including some discussion of them.
1
2 CHAPTER 1 Digital Forensics with Open Source Tools
presentation of digital evidence derived from digital sources for the purpose of
facilitating or furthering the reconstruction of events found to be criminal, or
helping to anticipate unauthorized actions shown to be disruptive to planned
operations [1].
While digital forensics techniques are used in more contexts than just criminal
investigations, the principles and procedures are more or less the same no matter the
investigation. While the investigation type may vary widely, the sources of evidence gen-
erally do not. Digital forensic examinations use computer-generated data as their source.
Historically this has been limited to magnetic and optical storage media, but increasingly
snapshots of memory from running systems are the subjects of examination.
Digital forensics is alternately (and simultaneously!) described as an art and a
science. In Forensic Discovery, Wietse Venema and Dan Farmer make the argument
that at times the examiner acts as a digital archaeologist and, at other times, a digital
geologist.
Digital archaeology is about the direct effects from user activity, such as file con-
tents, file access time stamps, information from deleted files, and network flow
logs. … Digital geology is about autonomous processes that users have no direct
control over, such as the allocation and recycling of disk blocks, file ID numbers,
memory pages or process ID numbers [2].
This mental model of digital forensics may be more apropos than the “digital
ballistics” metaphor that has been used historically. No one ever faults an archaeolo-
gist for working on the original copy of a 4000-year-old pyramid, for example. Like
archaeology and anthropology, digital forensics combines elements from “hard” or
natural science with elements from “soft” or social science.
Many have made the suggestion that the dichotomy of the art and science of
forensic analysis is not a paradox at all, but simply an apparent inconsistency arising
from the conflation of the two aspects of the practice: the science of forensics com-
bined with the art of investigation. Applying scientific method and deductive reason-
ing to data is the science—interpreting these data to reconstruct an event is the art.
On his Web site, Brian Carrier makes the argument that referring to the practice
as “digital forensics” may be partially to blame for some of this. While traditional
crime scene forensic analysts are tasked with answering very discrete questions
about subsets of evidence posed to them by detectives, digital forensic examiners
often wear both hats. Carrier prefers the term “digital forensic investigation” to make
this distinction clear [3].
lawyers in writing, we prefer to avoid overusing the term evidence due to the loaded
legal connotations. Evidence is something to be used during a legal proceeding, and
using this term loosely may get an examiner into trouble. Artifacts are traces left
behind due to activities and events, which can be innocuous, or not.
As stated by Locard’s exchange principle, “with contact between two items, there
will be an exchange [4].” This simple statement is the fundamental principle at the
core of evidence dynamics and indeed all of digital forensics. Specific to digital
forensics, this means that an action taken by an actor on a computer system will
leave traces of that activity on the system. Very simple actions may simply cause
registers to change in the processor. More complex actions have a greater likelihood
of creating longer-lasting impressions to the system, but even simple, discreet tasks
can create artifacts. To use a real-world crime scene investigation analogy, kicking
open a door and picking a lock will both leave artifacts of their actions (a splintered
door frame and microscopic abrasions on the tumblers, respectively). Even the act of
cleaning up artifacts can leave additional artifacts—the digital equivalent to the smell
of bleach at a physical crime scene that has been “washed.”
It is important to reiterate the job of the examiner: to determine truth. Every
examination should begin with a hypothesis. Examples include “this computer was
hacked into,” “my spouse has been having an affair,” or “this computer was used
to steal the garbage file.” The examiner’s task is not to prove these assertions. The
examiner’s task is to uncover artifacts that indicate the hypothesis to be either valid
or not valid. In the legal realm, these would be referred to as inculpatory and exculpa-
tory evidence, respectively.
An additional hitch is introduced due to the ease with which items in the digi-
tal realm can be manipulated (or fabricated entirely). In many investigations, the
examiner must determine whether or not the digital evidence is consistent with the
processes and systems that were purported to have generated it. In some cases, deter-
mining the consistency of the digital evidence is the sole purpose of an examination.
to the appropriate analysis. This can be file system analysis, file content exami-
nation, log analysis, statistical analysis, or any number of other types of review.
Finally, the examiner interprets results of this analysis based on the examiner’s
training, expertise, experimentation, and experience.
• Presentation refers to the process by which the examiner shares results of the
analysis phase with the interested party or parties. This consists of generating a
report of actions taken by the examiner, artifacts uncovered, and the meaning of
those artifacts. The presentation phase can also include the examiner defending
these findings under challenge.
Note that findings from the analysis phase can drive additional acquisitions, each
of which will generate additional analyses, etc. This feedback loop can continue for
numerous cycles given an extensive network compromise or a long-running criminal
investigation.
This book deals almost exclusively with the analysis phase of the process,
although basic acquisition of digital media is discussed.
Note
Free for Some
Note that under the Open Source Initiative’s definition, any license that restricts the use of
software for certain tasks or that restricts distribution among certain groups cannot be an
open source license. This includes the “Law Enforcement Only” or “Non-Commercial Use”
restrictions commonly placed on freeware tools in the digital forensics community.
This core material of this book is focused on the use of open source software to
perform digital forensic examinations. “Freeware” closed source applications that
perform a function not met by any available open source tools or that are otherwise
highly useful are discussed in the Appendix.
Education
When the authors entered the digital forensics field, there were two routes to becom-
ing an examiner. The first was via a law enforcement or military career, and the
second was to teach yourself (with the authors representing each of these routes).
In either scenario, one of the best ways to learn was by using freely available tools
6 CHAPTER 1 Digital Forensics with Open Source Tools
(and in the self-taught scenario, the only way!). Today, there are numerous college
programs and training programs available to an aspiring examiner, but there is still
something to be said for learning by doing. The authors have been using open source
tools throughout their careers in digital forensics, and we both have no doubt that we
are far better examiners than we would have been otherwise.
Using open source tools to learn digital forensics has several benefits. First,
open source tools innately “show their work.” You can execute the tool, examine
the options and output, and finally examine the code that produced the output to
understand the logic behind the tool’s operation. For the purposes of small examina-
tion scenarios, you can run the tools on any old hardware you have access to—no
multithousand dollar deluxe forensic workstation required. Finally, you also have
access to a dedicated community of examiners, developers, and enthusiasts ready to
help you—provided you’ve done a modicum of legwork before firing off questions
answered trivially by a Google search.
Price
In addition to being open source, all of the tools covered in this work are free of
cost. This is great for individuals looking to learn forensics on their own, students
taking formal coursework in digital forensics, or examiners looking to build a digital
forensics capability on a budget. This is also a great benefit for anyone already using
a full complement of commercial tools. Adding a set of open source tools to your
toolkit will usually cost you nothing, save for a bit of time. Even if you continue
using proprietary, commercial tools on a daily basis, you can use the tools in this
book as an adjunct to cover gaps in your tools coverage or to validate or calibrate
your tools’ findings and operation.
Another random document with
no related content on Scribd:
DANCE ON STILTS AT THE GIRLS’ UNYAGO, NIUCHI
I see increasing reason to believe that the view formed some time
back as to the origin of the Makonde bush is the correct one. I have
no doubt that it is not a natural product, but the result of human
occupation. Those parts of the high country where man—as a very
slight amount of practice enables the eye to perceive at once—has not
yet penetrated with axe and hoe, are still occupied by a splendid
timber forest quite able to sustain a comparison with our mixed
forests in Germany. But wherever man has once built his hut or tilled
his field, this horrible bush springs up. Every phase of this process
may be seen in the course of a couple of hours’ walk along the main
road. From the bush to right or left, one hears the sound of the axe—
not from one spot only, but from several directions at once. A few
steps further on, we can see what is taking place. The brush has been
cut down and piled up in heaps to the height of a yard or more,
between which the trunks of the large trees stand up like the last
pillars of a magnificent ruined building. These, too, present a
melancholy spectacle: the destructive Makonde have ringed them—
cut a broad strip of bark all round to ensure their dying off—and also
piled up pyramids of brush round them. Father and son, mother and
son-in-law, are chopping away perseveringly in the background—too
busy, almost, to look round at the white stranger, who usually excites
so much interest. If you pass by the same place a week later, the piles
of brushwood have disappeared and a thick layer of ashes has taken
the place of the green forest. The large trees stretch their
smouldering trunks and branches in dumb accusation to heaven—if
they have not already fallen and been more or less reduced to ashes,
perhaps only showing as a white stripe on the dark ground.
This work of destruction is carried out by the Makonde alike on the
virgin forest and on the bush which has sprung up on sites already
cultivated and deserted. In the second case they are saved the trouble
of burning the large trees, these being entirely absent in the
secondary bush.
After burning this piece of forest ground and loosening it with the
hoe, the native sows his corn and plants his vegetables. All over the
country, he goes in for bed-culture, which requires, and, in fact,
receives, the most careful attention. Weeds are nowhere tolerated in
the south of German East Africa. The crops may fail on the plains,
where droughts are frequent, but never on the plateau with its
abundant rains and heavy dews. Its fortunate inhabitants even have
the satisfaction of seeing the proud Wayao and Wamakua working
for them as labourers, driven by hunger to serve where they were
accustomed to rule.
But the light, sandy soil is soon exhausted, and would yield no
harvest the second year if cultivated twice running. This fact has
been familiar to the native for ages; consequently he provides in
time, and, while his crop is growing, prepares the next plot with axe
and firebrand. Next year he plants this with his various crops and
lets the first piece lie fallow. For a short time it remains waste and
desolate; then nature steps in to repair the destruction wrought by
man; a thousand new growths spring out of the exhausted soil, and
even the old stumps put forth fresh shoots. Next year the new growth
is up to one’s knees, and in a few years more it is that terrible,
impenetrable bush, which maintains its position till the black
occupier of the land has made the round of all the available sites and
come back to his starting point.
The Makonde are, body and soul, so to speak, one with this bush.
According to my Yao informants, indeed, their name means nothing
else but “bush people.” Their own tradition says that they have been
settled up here for a very long time, but to my surprise they laid great
stress on an original immigration. Their old homes were in the
south-east, near Mikindani and the mouth of the Rovuma, whence
their peaceful forefathers were driven by the continual raids of the
Sakalavas from Madagascar and the warlike Shirazis[47] of the coast,
to take refuge on the almost inaccessible plateau. I have studied
African ethnology for twenty years, but the fact that changes of
population in this apparently quiet and peaceable corner of the earth
could have been occasioned by outside enterprises taking place on
the high seas, was completely new to me. It is, no doubt, however,
correct.
The charming tribal legend of the Makonde—besides informing us
of other interesting matters—explains why they have to live in the
thickest of the bush and a long way from the edge of the plateau,
instead of making their permanent homes beside the purling brooks
and springs of the low country.
“The place where the tribe originated is Mahuta, on the southern
side of the plateau towards the Rovuma, where of old time there was
nothing but thick bush. Out of this bush came a man who never
washed himself or shaved his head, and who ate and drank but little.
He went out and made a human figure from the wood of a tree
growing in the open country, which he took home to his abode in the
bush and there set it upright. In the night this image came to life and
was a woman. The man and woman went down together to the
Rovuma to wash themselves. Here the woman gave birth to a still-
born child. They left that place and passed over the high land into the
valley of the Mbemkuru, where the woman had another child, which
was also born dead. Then they returned to the high bush country of
Mahuta, where the third child was born, which lived and grew up. In
course of time, the couple had many more children, and called
themselves Wamatanda. These were the ancestral stock of the
Makonde, also called Wamakonde,[48] i.e., aborigines. Their
forefather, the man from the bush, gave his children the command to
bury their dead upright, in memory of the mother of their race who
was cut out of wood and awoke to life when standing upright. He also
warned them against settling in the valleys and near large streams,
for sickness and death dwelt there. They were to make it a rule to
have their huts at least an hour’s walk from the nearest watering-
place; then their children would thrive and escape illness.”
The explanation of the name Makonde given by my informants is
somewhat different from that contained in the above legend, which I
extract from a little book (small, but packed with information), by
Pater Adams, entitled Lindi und sein Hinterland. Otherwise, my
results agree exactly with the statements of the legend. Washing?
Hapana—there is no such thing. Why should they do so? As it is, the
supply of water scarcely suffices for cooking and drinking; other
people do not wash, so why should the Makonde distinguish himself
by such needless eccentricity? As for shaving the head, the short,
woolly crop scarcely needs it,[49] so the second ancestral precept is
likewise easy enough to follow. Beyond this, however, there is
nothing ridiculous in the ancestor’s advice. I have obtained from
various local artists a fairly large number of figures carved in wood,
ranging from fifteen to twenty-three inches in height, and
representing women belonging to the great group of the Mavia,
Makonde, and Matambwe tribes. The carving is remarkably well
done and renders the female type with great accuracy, especially the
keloid ornamentation, to be described later on. As to the object and
meaning of their works the sculptors either could or (more probably)
would tell me nothing, and I was forced to content myself with the
scanty information vouchsafed by one man, who said that the figures
were merely intended to represent the nembo—the artificial
deformations of pelele, ear-discs, and keloids. The legend recorded
by Pater Adams places these figures in a new light. They must surely
be more than mere dolls; and we may even venture to assume that
they are—though the majority of present-day Makonde are probably
unaware of the fact—representations of the tribal ancestress.
The references in the legend to the descent from Mahuta to the
Rovuma, and to a journey across the highlands into the Mbekuru
valley, undoubtedly indicate the previous history of the tribe, the
travels of the ancestral pair typifying the migrations of their
descendants. The descent to the neighbouring Rovuma valley, with
its extraordinary fertility and great abundance of game, is intelligible
at a glance—but the crossing of the Lukuledi depression, the ascent
to the Rondo Plateau and the descent to the Mbemkuru, also lie
within the bounds of probability, for all these districts have exactly
the same character as the extreme south. Now, however, comes a
point of especial interest for our bacteriological age. The primitive
Makonde did not enjoy their lives in the marshy river-valleys.
Disease raged among them, and many died. It was only after they
had returned to their original home near Mahuta, that the health
conditions of these people improved. We are very apt to think of the
African as a stupid person whose ignorance of nature is only equalled
by his fear of it, and who looks on all mishaps as caused by evil
spirits and malignant natural powers. It is much more correct to
assume in this case that the people very early learnt to distinguish
districts infested with malaria from those where it is absent.
This knowledge is crystallized in the
ancestral warning against settling in the
valleys and near the great waters, the
dwelling-places of disease and death. At the
same time, for security against the hostile
Mavia south of the Rovuma, it was enacted
that every settlement must be not less than a
certain distance from the southern edge of the
plateau. Such in fact is their mode of life at the
present day. It is not such a bad one, and
certainly they are both safer and more
comfortable than the Makua, the recent
intruders from the south, who have made USUAL METHOD OF
good their footing on the western edge of the CLOSING HUT-DOOR
plateau, extending over a fairly wide belt of
country. Neither Makua nor Makonde show in their dwellings
anything of the size and comeliness of the Yao houses in the plain,
especially at Masasi, Chingulungulu and Zuza’s. Jumbe Chauro, a
Makonde hamlet not far from Newala, on the road to Mahuta, is the
most important settlement of the tribe I have yet seen, and has fairly
spacious huts. But how slovenly is their construction compared with
the palatial residences of the elephant-hunters living in the plain.
The roofs are still more untidy than in the general run of huts during
the dry season, the walls show here and there the scanty beginnings
or the lamentable remains of the mud plastering, and the interior is a
veritable dog-kennel; dirt, dust and disorder everywhere. A few huts
only show any attempt at division into rooms, and this consists
merely of very roughly-made bamboo partitions. In one point alone
have I noticed any indication of progress—in the method of fastening
the door. Houses all over the south are secured in a simple but
ingenious manner. The door consists of a set of stout pieces of wood
or bamboo, tied with bark-string to two cross-pieces, and moving in
two grooves round one of the door-posts, so as to open inwards. If
the owner wishes to leave home, he takes two logs as thick as a man’s
upper arm and about a yard long. One of these is placed obliquely
against the middle of the door from the inside, so as to form an angle
of from 60° to 75° with the ground. He then places the second piece
horizontally across the first, pressing it downward with all his might.
It is kept in place by two strong posts planted in the ground a few
inches inside the door. This fastening is absolutely safe, but of course
cannot be applied to both doors at once, otherwise how could the
owner leave or enter his house? I have not yet succeeded in finding
out how the back door is fastened.