00:00:00.000-->00:00:04.004 >>Uh, so speaking at Def Con is kinda tough I'm gonna put this here so it'll be easier for 00:00:04.004-->00:00:09.376 everyone. There's- there's thousands of you, you all look like a swarm of people, so. 00:00:09.376-->00:00:16.383 >>Louder! We can't hear you! [inaudible] >>I'll just hold it, can you hear me now? >>Yeah! 00:00:16.383-->00:00:22.022 >>We're all good? Alright. Um. So you can see a quote here it's from a science fiction book it's 00:00:22.022-->00:00:26.593 about when we get out into space and we discovered that all the species we're expecting to run 00:00:26.593-->00:00:32.533 into, we missed em. Not by distance but by time, they're all dead. Millions of years gone 00:00:32.533-->00:00:35.202 they- we we we finally found them and they're millions of years gone and we go down to 00:00:35.202-->00:00:38.972 their planets and we try and figure out who they were and we discover that all the data from 00:00:38.972-->00:00:43.277 these advanced civilizations is lost. We don't know what they did because they stored all this 00:00:43.277-->00:00:48.048 stuff on things that evaporated quickly, they were destroyed by time, a term that we're going to 00:00:48.048-->00:00:53.921 get to called 'bit rot' and it's important as we move further into this digital age that we 00:00:53.921-->00:00:59.793 take time out of our lives to find and protect the data that needs to be protected. So a good 00:00:59.793-->00:01:05.499 bit of this talk is going to be discussing the methodology and the importance of what we- we as 00:01:05.499-->00:01:11.571 a group of hackers need to do to protect some of this data and some of our tools and certain 00:01:11.571-->00:01:18.011 aspects of our professional skillsets are uniquely suited to that. So without further adieu 00:01:18.011-->00:01:24.451 this is amateur digital archeology and uh hacker is just another word for amateur um if 00:01:24.451-->00:01:30.123 you wanna be professional you go over to Black Hat ha- Def Con is about the amateurs, it's about 00:01:30.123-->00:01:34.761 the new guys, the young guys, the people who don't know any better yet. That's what a hacker 00:01:34.761-->00:01:38.632 is. A hacker walks into something and says I'm a hobbyist I'm gonna figure this 00:01:38.632-->00:01:43.637 out. So you might be wondering why any of this is important. This is uh a subgenre of 00:01:45.739-->00:01:50.744 technology but if we're in Mosul watching Isis get annihilated and you have a reporter walking 00:01:53.046-->00:01:58.352 down the banks of River Tigris and finds three dead bodies he could either look at them take a 00:01:58.352-->00:02:02.255 photo write a blurb and keep going or he could dig through their pockets and if you dig 00:02:02.255-->00:02:06.927 through their pockets you might find that they have a cell phone on them and if they have a cell 00:02:06.927-->00:02:10.764 phone on them that cell phone might have a memory card and if there's a memory card there 00:02:10.764-->00:02:15.802 might be pictures and data. So there was a great article done by these two guys from BBC where 00:02:15.802-->00:02:19.806 one of the guys dug through some pockets, found some photos, was looking at the photos and 00:02:19.806-->00:02:22.943 realized the place he had been staying in was the same place they had been staying in, so he 00:02:22.943-->00:02:27.981 dug around and found a whole bunch of data related to these three guys, these three foot 00:02:27.981-->00:02:32.052 soldiers, he figured out that they were an artillery squad, that they had received certain 00:02:32.052-->00:02:36.289 orders, that they're- he identified who they all were then he start going back to the 00:02:36.289-->00:02:41.995 places they came from and built a composite sketch on who these guys were these random nobodies 00:02:41.995-->00:02:48.201 who worked for Isis. And this gives us a unique insight into who these people were at this 00:02:48.201-->00:02:52.973 momentous moment in time something that we are talking about right now, a hundred years 00:02:52.973-->00:02:55.976 from now people might not understand, they might look at a newspaper and go what the h**l 00:02:55.976-->00:03:00.914 is Isis, whose Mosul? Come on. Um and this is- this is what we call primary source information 00:03:03.016-->00:03:07.421 if you're familiar with uh Howard Zinn who wrote A People's History of the United States he 00:03:07.421-->00:03:11.391 wrote a history of the united states focused on primary source information the things that you 00:03:11.391-->00:03:15.562 find where people experienced history, saw history, and they provide a biased perspective but 00:03:15.562-->00:03:20.467 they provide a biased perspective that's unmarred by not knowing, not having been 00:03:20.467-->00:03:25.906 there. Um this is what the US National Archive has to say about primary sources and their 00:03:25.906-->00:03:30.043 importance in developing critical thinking for chi- children but it's also truly 00:03:30.043-->00:03:34.815 important for any historian to build an idea of where their version of history sits in 00:03:34.815-->00:03:40.220 relation to the people who lived it. Um this is what our friend Adam has to say at NYC Resistor 00:03:40.220-->00:03:45.492 on EEPROMs which are a primary source information, he says 'find a board with a brain.' if 00:03:45.492-->00:03:50.330 you're a hacker any sort of chip you see that has a brain, has memory, is primary source 00:03:50.330-->00:03:56.103 information. SO this is kind of the thrust of what we're gonna be talking about. And in regards 00:03:56.103-->00:04:02.242 to amateur archeology it's uh part of being an amateur is recognizing your limitations, 00:04:02.242-->00:04:05.245 you're not a professional archeologist or anthropologist and you shouldn't think of 00:04:05.245-->00:04:10.984 yourself as one, you should- you know- do what they expect you to do but also recognize that you 00:04:10.984-->00:04:15.188 have limitations, you're not gonna go up here and start dropping a professional grade 00:04:15.188-->00:04:20.594 pureview paper what you can do however is protect data for them to write their paper. And the 00:04:20.594-->00:04:23.797 other great thing is because you're dumb you can accomplish things that other people didn't 00:04:23.797-->00:04:29.703 think were possible, like flight. And uh I know some of you guys here might be a little 00:04:29.703-->00:04:33.273 pissed off that Joe Random Idiot managed to get their hands on something that's probably of 00:04:33.273-->00:04:37.778 historical significance and should probably be in a museum uh it's important that you 00:04:37.778-->00:04:42.883 remember this is Def Con and we are way more Lando Calrissian than we are Professor Jones 00:04:42.883-->00:04:46.219 [laughter] most of the people here are perfectly okay with that, but for those of you who 00:04:46.219-->00:04:51.057 are still concerned, the National Air and Space Museum has several GRiD compasses and 00:04:51.057-->00:04:56.429 several GRiD cases, these are the styles and machines that we have um they also have one that 00:04:56.429-->00:05:02.869 was flown several times and they have never released information related to what data was on them 00:05:02.869-->00:05:06.873 they've only ever said 'here's laptop, it's off, it's sitting in a booth' it's like a dead 00:05:06.873-->00:05:13.280 machine, you don't have a full composite idea of what they did and why they did it. Um this is 00:05:13.280-->00:05:18.585 from recent news, this was published maybe a couple weeks ago. It hit our Ars Technica and 00:05:18.585-->00:05:23.023 the photo there is a photo of an old tape system, these were the data systems that did the 00:05:23.023-->00:05:28.995 analysis for pioneer 8 through I believe 10 and that's the OIG report number uh that URL that I 00:05:28.995-->00:05:33.867 referenced in the beginning and will reference throughout has a lot of this data available if 00:05:33.867-->00:05:39.506 you wanna dig through the actual data I went through and it's sad that the machines that analyze 00:05:39.506-->00:05:44.678 pioneer missions basically ended up sitting outside of a contracting office, in the 00:05:44.678-->00:05:49.349 elements, and an engineer brought them home, put them in his basement, and they got so 00:05:49.349-->00:05:54.054 destroyed by mold and the elements that when OIG finally found them and tried to see if 00:05:54.054-->00:05:58.091 there's any data they can pull of them or any significance to them they actually said it's 00:05:58.091-->00:06:03.430 safer to destroy them than it is to try to analyze them because of the mold. It was a toxic uh 00:06:03.430-->00:06:09.169 health hazard to the investigators. Um it's important that we protect a lot of this 00:06:09.169-->00:06:13.073 data because it's starting to go away and I- this is a really good project that has a direct 00:06:13.073-->00:06:18.545 tie to Def Con and to NYC Resistor. Our friend Chris Fenton wrote a P- FPGA 00:06:18.545-->00:06:22.482 Implementation of the Cray 1. The Cray 1 if you've never heard of the Cray Supercomputer 00:06:22.482-->00:06:25.852 Company you can ask someone else here it's- it's a formative moment in supercomputing 00:06:25.852-->00:06:31.157 history. The Cray 1 operating system is gone as far as anyone knows, if anyone here has access 00:06:31.157-->00:06:35.962 to an original Cray 1, talk to me or enter it in the archive later, the reality is is as far 00:06:35.962-->00:06:39.733 as anyone knows that operating system is lost to history most of the people who had Cray's 00:06:39.733-->00:06:44.371 burned their media when they were done. Um he did find a guy who is willing to give him a 00:06:44.371-->00:06:49.109 disc pack that he thought had Cray 1 on it and brought it back from Australia and he built an 00:06:49.109-->00:06:54.180 analog reader, read the analog wave form, and I got an email while I was at Def Con saying 00:06:54.180-->00:06:59.619 'hey I've got about 40 gigs of analog wave form that I need to analyze and find bits in' and it 00:06:59.619-->00:07:04.391 just so happened I was sitting next to Jason Scott of Internet Archive and handed him the phone 00:07:04.391-->00:07:09.029 and he immediately helped them host it and within a couple days they had two guys from Sweden 00:07:09.029-->00:07:14.467 and Norway who had written a- analysis software to figure out the bits and they start figuring 00:07:14.467-->00:07:18.505 out file systems and then they were building it and writing it in emulation and the next thing 00:07:18.505-->00:07:22.008 you know the Cray 1 XMP Project's off and running to the races you're able to kind of 00:07:22.008-->00:07:27.981 ressurect maybe not Cray 1 but a Cray operating system that otherwise would have been lost. 00:07:27.981-->00:07:30.817 And none of these people are professionals or are getting paid for this, this is what 00:07:30.817-->00:07:35.588 people do in their free time. This is Jason Scott form the Internet Archive if you run into 00:07:35.588-->00:07:40.627 him at Def Con, give him a hug, he's a good guy. And the other question you might be asking is 00:07:40.627-->00:07:46.833 a Cray is an exotic machine, it's something cool from history why do I give a s**t about a 00:07:46.833-->00:07:51.204 386? And fundamentally the machine we're gonna be talking about is a 386 with a math co 00:07:51.204-->00:07:56.710 processor so maybe closer to a 486 or a 387 whatever you wanna call it, that's what it is, the 00:07:56.710-->00:08:02.982 importance of it is where it's at in history, what it did. And you should never judge a book by 00:08:02.982-->00:08:08.822 it's data, like, this guy writes 140 character messages and they are considered incredibly 00:08:08.822-->00:08:13.593 important, I'm not getting into the politics of the person, but the data is important it it 00:08:13.593-->00:08:18.498 defines aspects of our life, it defines market movements, and things like that, and I know 00:08:18.498-->00:08:21.868 europeans have this approach to data that says things should have- we have a right to be 00:08:21.868-->00:08:25.705 forgotten, Star Wars Kid has a right to be forgotten, he shouldn't be judged his entire 00:08:25.705-->00:08:32.178 life based off of a five minute video but at the same time we're losing so much data that defines 00:08:32.178-->00:08:35.949 who we are and is important in understanding the scope and impact of things that are of 00:08:35.949-->00:08:41.888 historical significance and sometimes the context matters. The Trump Presidential Library 00:08:41.888-->00:08:48.395 ironically does expose a major flaw in our archival knowledge. He writes so much s**t on 00:08:48.395-->00:08:52.832 Twitter, he just did a policy initiative on Twitter, and announced it there. That for the 00:08:52.832-->00:08:57.036 first time ever internet archivists who are real archivists actually have to 00:08:57.036-->00:09:01.341 figure out how they're gonna address social media. How do we get this data, store it, put it 00:09:01.341-->00:09:05.278 in a library because it is important, it's- it's incredibly important for future historians 00:09:05.278-->00:09:11.084 to understand how legislature evolved, how historically these things occurred. And the other 00:09:11.084-->00:09:14.254 one in this list is Soundcloud, I'm- I'm not sure how many of you are familiar with 00:09:14.254-->00:09:20.693 Soundcloud, but Soundcloud is a cultural um I'm not sure what you call that, just a huge 00:09:20.693-->00:09:25.965 value. It's all these ar- artists producing music, and then disappearing. Or becoming 00:09:25.965-->00:09:30.870 popular, but there's so much music in there that defines our culture as we evolve across an 00:09:30.870-->00:09:35.575 entire geo- geo political spectrum, as the internet begins to bring us together, we get to 00:09:35.575-->00:09:42.048 see these independent components start to, to meld and uh they just announced 40 percent 00:09:42.048-->00:09:45.552 layoffs and there's a real fear that Soundcloud will disappear and then all the data will 00:09:45.552-->00:09:49.889 disappear and a lot of these artists won't be able to repost it. So the internet archive's 00:09:49.889-->00:09:54.894 trying to figure that out. I recommend donating if you give a c**p. Um GRiD, why is the GRiD 00:09:57.030-->00:10:02.168 Laptop important? The GRiD laptop was the first laptop, arguably. It was the first 00:10:02.168-->00:10:07.373 clamshell ever and uh that was the GRiD Compass that was the pre generator, prior to the ones 00:10:07.373-->00:10:13.346 we're going to be talking about which are GRiD Case. Um this URL highly recommend grabbing it's 00:10:13.346-->00:10:18.818 uh Computer History Museum got 4 of the original founders of GRiD to talk about how GrID was 00:10:18.818-->00:10:24.123 developed, what it was important for, and it's kind of a great loser's story for the Pirates of 00:10:24.123-->00:10:28.828 Silicon Valley. These guys developed their own laptop, the first one ever, it was 00:10:28.828-->00:10:33.233 beautiful, they had Xerox PAR- park people, they stole people from the early Apple and they 00:10:33.233-->00:10:37.937 developed their own first operating system called GRiD OS and then they sat in a meeting 00:10:37.937-->00:10:41.741 with IBM and IBM was like 'hey would you like to license our- your operating system for our 00:10:41.741-->00:10:46.646 new IBM PC?' and they said 'no of course not why would we do that?' And then MS-DOS destroyed 00:10:46.646-->00:10:53.419 them. Billiot- Bill Gates is personally responsible for annihilating GRiD. and uh here's 00:10:53.419-->00:10:58.625 a further NASA history provided by one of the engineers that worked on GRiD. The Compass was 00:10:58.625-->00:11:03.696 the first laptop in space by a matter of microseconds. TI had a laptop on the same shuttle 00:11:03.696-->00:11:07.433 flight- and you have to think about this, this is the first personal computer that made it 00:11:07.433-->00:11:12.472 into space. That's huge! It's the tri-quarter, it's it's the first time that uh an an 00:11:12.472-->00:11:16.009 astronaut's able to use a computer on the space shuttle that isn't like a guidance 00:11:16.009-->00:11:20.713 system or a component that specifically does a job. It- It changed the way we approach 00:11:20.713-->00:11:26.419 space. Um GRiDs were huge in the US government as well. A lot of people who know anything about 00:11:26.419-->00:11:30.757 GRiDs know that they have a- a reputation as being the government's computer as being 00:11:30.757-->00:11:33.693 the rugged computer, they originally were designed for businessmen and none of that's 00:11:33.693-->00:11:37.463 entirely true but the US government did use a lot of them. The NSA used em. They had 00:11:37.463-->00:11:43.069 a software written called Scrubbing Bubbles that scrubbed bubble memory of any data. Um 00:11:43.069-->00:11:48.241 the NRO used em, supposedly the football was at one point a GRiD. Uh NASA used them, SPAWAR 00:11:48.241-->00:11:52.145 and other military forces used em, supposedly these guys brought, you know, demolition 00:11:52.145-->00:11:56.416 charges with them to destroy em when they were you know potentially compromised. And 00:11:56.416-->00:12:03.156 marines and aliens in 1986- used em to fight aliens, so. There's a gratuitous shot of a GRiD 00:12:03.156-->00:12:08.194 fighting aliens [laughter] I know a lot of you were expecting me to be like, 'I found aliens 00:12:08.194-->00:12:14.601 on the laptop' this is as close as I got. But before we get into the task of ripping apart this, 00:12:14.601-->00:12:19.105 let's talk about how the h**l you get your hands on old NASA gear and this is kind of a big 00:12:19.105-->00:12:23.977 storyline. Um you can buy pretty much anything as- at a government auction. The uh 00:12:23.977-->00:12:28.815 government auctions occur as like- Govliquidation Com or all these private enterprises that 00:12:28.815-->00:12:34.387 sell stuff or they occur at a state level, New York State for instance has an EBAY store and 00:12:34.387-->00:12:37.924 stuff gets sold there I mean it's whenever they're done with it and it no longer has value it 00:12:37.924-->00:12:44.130 gets sold and uh this is a great quote from a French guy, Francois, he was talking to a 00:12:44.130-->00:12:48.134 guy on Ebay who got visited by the FBI and they were like 'hey where the h**l did you get all 00:12:48.134-->00:12:55.041 this s**t?' cuz he started selling some stuff on Ebay and he had gotten it as scrap and 00:12:55.041-->00:13:01.848 what he was selling was Apollo Guidance Computers [laughter] anyone who knows anything about 00:13:01.848-->00:13:06.719 NASA or your own history knows the Apollo Guidance Computer is the first micro controller in 00:13:06.719-->00:13:11.457 silicon, it is a formative component of all of technological history, as we 00:13:11.457-->00:13:15.795 were landing people on the moon, we developed the first silicon parts, and we developed the 00:13:15.795-->00:13:20.800 first silicon micro controller. So everything that any of you do is in- is impacted by this, this 00:13:23.102-->00:13:28.107 device. And the AGC is formative. Some guy in France bought it off an Ebay guy who 00:13:32.245-->00:13:37.517 just happened to have a fully functional AGC. How does this happen? Like how does the AGC- 00:13:37.517-->00:13:41.187 any of them make it out into the world where some guy can buy it on Ebay, why was it sold as 00:13:41.187-->00:13:46.192 scrap? Nobody can tell you. And yet this one guy in France, if you hit his Youtube feed, has an 00:13:49.629-->00:13:56.335 AGC. Um I do recommend when you're done after this, he's got a great breakdown of how you 00:13:56.335-->00:14:02.542 access memory, how he read some of the data, and uh he talks about the operating system, he 00:14:02.542-->00:14:06.679 can't pull the operating system off the AGC he has without destroying it although there is 00:14:06.679-->00:14:12.318 a copy of data for another AGC component that he doesn't have um the question is how do we 00:14:12.318-->00:14:16.456 preserve the data that was on an AGC? And some of you may know that that's out there now, it's 00:14:16.456-->00:14:22.595 on GitHub. Uh the way it was preserved is one guy went to MIT and found the printed copies of 00:14:22.595-->00:14:27.767 all of the source code and transcribed them into a laptop. And he did this about 7 or 8 00:14:27.767-->00:14:34.107 years ago and uh just recently a NASA intern found out about it and posted it to GitHub and 00:14:34.107-->00:14:40.413 suddenly there's poll request against you know 1960s software [laughter] People were founding 00:14:40.413-->00:14:46.853 bugs. So in this case we found software hiding in hard copy, that's pretty cool. So you're 00:14:46.853-->00:14:50.890 al- some of you might be sitting here going this is entertaining, but it's- it's not great, we're 00:14:50.890-->00:14:55.628 talking about formative components of our history this is like, Wilbur and Orville's 00:14:55.628-->00:15:02.068 first flight, these, the- try to imagine going to a yard sale and finding the first airplane, it 00:15:02.068-->00:15:07.807 shouldn't happen. So you might be asking yourself, well what do I do about it? Where in my life 00:15:07.807-->00:15:14.247 do I find this sort of history lying around? And what I want to tell you is this is Def Con man, 00:15:14.247-->00:15:19.085 there's history happening here today. People are developing things, doing things, you don't 00:15:19.085-->00:15:24.557 know it at the time, I was at HAR, Hacking at Random in 2009, getting camera'd with a bunch of 00:15:24.557-->00:15:30.163 Italians that there- at their embassy, and two years later I'm watching in the news, and then 00:15:30.163-->00:15:36.035 I'm watching in a movie that exact event occurring because there was this young blonde 00:15:36.035-->00:15:40.173 haired jerk who was like 'I'm going to put all of your secrets on the internet' and that 00:15:40.173-->00:15:46.045 happened, so Wikileaks basically occurred initially lat HAR. History is happening all around 00:15:46.045-->00:15:51.117 us, all the time. So you might be asking specifically, 'well that's not like a NASA flight 00:15:51.117-->00:15:54.420 system, how the h**l do you get your hands on a NASA flight system?' I found them being 00:15:54.420-->00:15:59.592 auctioned um there are a couple auctions that specialize in space memorabilia and some of 00:15:59.592-->00:16:02.929 the lesser ones, not like Christie's, which will sell you things for ten grand will sell 00:16:02.929-->00:16:06.132 you things for nothing at all, because nobody knows what they are or whether or not they're 00:16:06.132-->00:16:09.402 important. The space shuttle is one of those areas where nobody really cares because it's not 00:16:09.402-->00:16:13.973 Apollo, we didn't land on the moon and a lot of people don't see it as formative, even though 00:16:13.973-->00:16:17.176 it's the early days of spaceflight, we're talking about the first laptops in space and 00:16:17.176-->00:16:22.181 yet nobody cares, but they will, it's history. If you're ordering from an auction be careful, 00:16:25.451-->00:16:30.690 everything about auctions are shady. A lot of upper tier auction houses put a lot of 00:16:30.690-->00:16:35.995 effort into establishing where something came from, what it is, we're going to talk in a moment 00:16:35.995-->00:16:41.367 about how you identify an artifact and authenticate it. Auctions don't necessarily do 00:16:41.367-->00:16:45.938 that. This is the original auction that I saw, there's two of them a year apart, the first 00:16:45.938-->00:16:50.943 one was the STS-41 PS - PGSC um as far as I can tell, they made that up. Uh the space shuttle 00:16:54.480-->00:16:58.384 payload and general support computer that came later, they didn't make up, I guess the 00:16:58.384-->00:17:02.989 first one had some paperwork with it so they just kind of assumed, the other one, had none 00:17:02.989-->00:17:05.825 so they just also kinda were like, 'well we have this thing, but we don't know where it's 00:17:05.825-->00:17:10.062 providence is from' Uh you might be wondering how much these things cost me when I bought 00:17:10.062-->00:17:15.268 them, they ca- the first one I actually put in the bid for 1,337 dollars [laughter] and 00:17:15.268-->00:17:20.273 that's what I got it for uh second one a little bit less. Um so authenticating artifacts, 00:17:23.609-->00:17:30.349 this is important uh as some of you may know, I once forged Shmoocon badges um easiest way 00:17:30.349-->00:17:33.819 was visually at first, because you're looking at images on the internet, how do you visually 00:17:33.819-->00:17:39.292 identify this as being accurate, this is a Smithsonian shot, from the Smithsonian website saying 00:17:39.292-->00:17:44.497 this is a PGSC GRiD case as opposed to a compass there are things that you can identify 00:17:44.497-->00:17:50.603 immediately the blue velcro, NASA loves velcro, they love that light blue color uh look 00:17:50.603-->00:17:55.908 for where it is placed, that sort of thing, look at the font used on the text and lettering 00:17:55.908-->00:18:00.046 added, look for the modification specifically done. You can see that they modify the power 00:18:00.046-->00:18:05.251 supply, you can see that they added a fan, and it's important, the fan. Anyone who knows 00:18:05.251-->00:18:10.122 anything about space travel knows that convection doesn't work in zero G so any laptop 00:18:10.122-->00:18:14.627 without a fan is gonna die. It's the same reason that an a- astronaut will die if the 00:18:14.627-->00:18:19.198 circulation stops in any of their spacecraft, the Co2 will pool in front of their face and 00:18:19.198-->00:18:25.638 they'll die from C02 even though there's plenty of oxygen, the convection doesn't work. Hard 00:18:25.638-->00:18:30.009 Copy is the other one, if you have the opportunity and you can find data, you can see on there 00:18:30.009-->00:18:35.014 there was a sed number listed, a- a part number as well um and you can go look on either Hard 00:18:37.183-->00:18:41.187 Copy files which I didn't have a tthe time, or you can go to their website and look for those 00:18:41.187-->00:18:46.392 sed numbers. I found exactly one reference to that particular sed number. But it did identify it 00:18:46.392-->00:18:50.930 as a PGSC system and it specifically identified that sed number and several others. This 00:18:50.930-->00:18:55.935 comes from the NASA website, also here's a snapshot of a video of a NASA astronaut on the 00:18:59.372-->00:19:04.310 shuttle, working with a PGSC, same style and design. So it looks legit, we buy it. 00:19:07.246-->00:19:12.652 Shouldn't the memory have been pulled right? I mean DOD did work for NASA did work for the 00:19:12.652-->00:19:18.791 DOD in the 1990s so here's the problem with buying something that's from that age, you don't 00:19:18.791-->00:19:23.229 want to accidentally release classified materials. They don't go dead until 50 years after. So 00:19:23.229-->00:19:27.800 if you see something classified, you don't put it on the internet, you call your local 00:19:27.800-->00:19:32.972 government agency and say 'hey guys I got this thing maybe you could you know not kill me and 00:19:32.972-->00:19:37.977 take it off my hands' be a good citizen you know. And put that guy up there so you know I've 00:19:41.047-->00:19:45.985 got both sides of the political spectrum. Um nothing that's ITAR covered there's- you're not 00:19:45.985-->00:19:49.188 going to get a notification on whether or not something's ITAR and that means International 00:19:49.188-->00:19:53.692 Traffic in Arms Regulation and if you ever work for a military contract you realize that 00:19:53.692-->00:19:58.264 certain things are verboten. You don't give them to other countries, for instance, 00:19:58.264-->00:20:03.369 anything that might show like how a rocket works. That could be used for a weapon. It used to 00:20:03.369-->00:20:09.108 be that crypto used to be under ITAR but you know not so much these days. The other one that 00:20:09.108-->00:20:13.312 you see is this unclassified mark that means cla- unclassified but not for public 00:20:13.312-->00:20:18.017 release. Don't release that either because even though it's not dropping classified data, if 00:20:18.017-->00:20:22.388 you've ever worked for the US government it's potential that you violated your own release 00:20:22.388-->00:20:28.928 clauses and you might go to jail anyways, so don't do that. Um storing an artifact is the other 00:20:28.928-->00:20:31.764 problem, you know bought something expensive and you don't want to see it destroyed 00:20:31.764-->00:20:35.534 over time also if any of you ever come across something like this and you wanna protect it 00:20:35.534-->00:20:42.141 you wanna know how you can put it in a shed without it you know deteriorating. So electronics 00:20:42.141-->00:20:47.980 like beer, love beer temperatures. Cool, not cold. Dark. Those are the things that 00:20:47.980-->00:20:54.320 electronics love and we'll talk about why. Um the cool environment cold is basically 00:20:54.320-->00:20:59.592 because a lot of things don't do well in heat, they get destroyed over time or rapidly, cold is an 00:20:59.592-->00:21:04.096 arresting thing and it's thermodynamics at the end of the day but it's- it's better for 00:21:04.096-->00:21:10.002 everything. Uh dark is good because some things are UV sensitive such as ROMS, uh 00:21:10.002-->00:21:13.906 displays, signage, housings, these things don't seem that important to a hacker, but 00:21:13.906-->00:21:18.711 they're important for storings. Uh not damp not humid but you also don't want super dry 00:21:18.711-->00:21:24.316 because you could destroy rubber gaskets. Um clean clutter super important you don't wanna have 00:21:24.316-->00:21:29.054 rats and roaches and other little bugs so wherever it's stored you want it to be clean 00:21:29.054-->00:21:33.125 and you want to treat it like evidence and that's where the forensics side of this comes in 00:21:33.125-->00:21:36.962 anyone who does digital forensics, you've got the skillsets to do digital 00:21:36.962-->00:21:43.102 archeology, you mark everything, you walk into a room you take photos, you mark and identify 00:21:43.102-->00:21:47.540 everything, you wanna know where it happened, how you found it, even if you bought it from an 00:21:47.540-->00:21:51.677 auction you wanna take a photo of the outside, see how everything was laid out, where 00:21:51.677-->00:21:55.881 things were um in in this laptop's case I'm gonna talk about I'm going to be talking 00:21:55.881-->00:22:00.085 about key caps that were on the top keys, they were falling off as soon as I pulled the thing 00:22:00.085-->00:22:04.990 open, in fact there are several taped to the outside, unless they're labeled, you don't know 00:22:04.990-->00:22:10.763 where they were so you wanna get that first photo before they all fall off. Important. Keep logs, 00:22:10.763-->00:22:14.300 log everything you do, so that people who come after you if someone finds it in your house 00:22:14.300-->00:22:18.304 and you've been hit by a bus they know what the h**l you did and where it came from um 00:22:18.304-->00:22:22.608 paperwork and chain of custody are huge this is something you talk about in evidence, you talk 00:22:22.608-->00:22:27.012 about who had it when, how did it get there as few hands as possible on it, same deal with 00:22:27.012-->00:22:31.350 anything that's an artifact, you wanna make sure that people know where it came from, how it got 00:22:31.350-->00:22:35.321 there and you wanna make sure that Jimmy who really believes in aliens didn't get his hands 00:22:35.321-->00:22:41.627 on it and added a bunch of data, you know? Um when working with the unit try to have someone 00:22:41.627-->00:22:44.563 else in the room cause what happens if you open the case and you find a wristwatch in there 00:22:44.563-->00:22:48.767 and you're now like 'well this is part of it' but everyone else is like 'that's just a random 00:22:48.767-->00:22:54.907 thing from Caseo you found', you know? And log everything you do, plan every action, don't ever do 00:22:54.907-->00:22:59.078 anything outside the plan. That's a hard one for us because we are very free form, and 00:22:59.078-->00:23:03.649 anyone who breaks computers is definitely freeform it's what we do but you do need to plan this 00:23:03.649-->00:23:06.418 is what I'm gonna do today, these are the things I'm gonna do, and here's how I'm gonna try 00:23:06.418-->00:23:11.257 to do it and if you fail you're done for the day you do it again the next day. This avoids you 00:23:11.257-->00:23:14.560 doing something stupid and breaking something we all end up down a rabbit hole and get 00:23:14.560-->00:23:20.833 creative, you don't want to accidentally destroy something. Plan stuff out. Now we're gonna 00:23:20.833-->00:23:25.804 talk about Bit Rot, every bit is bound by thermodynamics which means every bit will die, 00:23:25.804-->00:23:32.778 everything we love, everything we believe in will die eventually, sorry. [laughter] 00:23:32.778-->00:23:37.116 The lifespan of magnetic media is about 5 to 10 years effectively it can last about as 00:23:37.116-->00:23:42.655 long as 50 but don't expect it and we're gonna talk about that here the laptops that I have 00:23:42.655-->00:23:48.527 were originally commissioned in about 92 and the discs were not in good shape um you can fully 00:23:48.527-->00:23:53.799 expect a mechanical hard disc to fail, they suck. Cool environments do prolong life we 00:23:53.799-->00:23:57.536 all remember the old knock knock knock trick where you put it in the freezer for a little bit and 00:23:57.536-->00:24:01.874 the- the knock of death sometimes goes away, you get enough time to pull it off, cold 00:24:01.874-->00:24:07.146 environments help um but if it's too dry gaskets can go and s**t gets in and annihilates the 00:24:07.146-->00:24:12.818 disc. The other one is it's like a car if you don't spin up the disc regularly all of the juices 00:24:12.818-->00:24:18.791 inside, the mechanical oils and such, capacitors, they- they- they sit stagnant and they can 00:24:18.791-->00:24:25.431 become a problem, dangerous. Also read heads can get stuck, you never know. Lifespan of 00:24:25.431-->00:24:30.703 flash is a lot bigger I'm go- it says you can expect 10 years safely but perfectly honest, 00:24:30.703-->00:24:36.075 flash is good for about 100 years, generally. Um floating gate's gonna be a problem in the 00:24:36.075-->00:24:41.280 end it will kill any flash device in the end no matter what you do. Some ROMs are UV 00:24:41.280-->00:24:45.284 sensitive so if they have an exposed UV chip you've seen them they've got a little glass top 00:24:45.284-->00:24:48.854 on them and you see a chip exposed, if they're sitting in UV they're not gonna immediately 00:24:48.854-->00:24:53.992 go but you leave them there for you know, 3, 4 years you're gonna start losing bits. Extreme 00:24:53.992-->00:24:58.864 heat or cold is bad for them but not regular stuff we experience nuclear furnaces should be 00:24:58.864-->00:25:04.470 avoided [laughter] and uh do not store them in anything that takes skin off of people. 00:25:04.470-->00:25:08.941 They're very resilient except when you're on a rug and that's where this next bit comes from, 00:25:08.941-->00:25:12.077 grounding bracelets are important when dealing with chips, I remember working as a 00:25:12.077-->00:25:16.949 computer engineer when I was young and I actually annihilated several old PDIP chips just by 00:25:16.949-->00:25:21.920 standing on a rug and static electricity was enough to blow a fuze and now you're not reading 00:25:21.920-->00:25:27.960 s***t. Capacitors and other gooey elements, older stuff, if you have anything 50 years or 00:25:27.960-->00:25:33.465 old or you encounter it don't plug it in. Replace the f**king capacitors, and if you don't 00:25:33.465-->00:25:37.703 want to replace capacitors for whatever reason at least disconnect them and check them 00:25:37.703-->00:25:41.440 first to see if they're still firing within the tolerances that you're expecting. Most 00:25:41.440-->00:25:45.577 people what they do though is they'll actually haul them out and put the new capacitor inside 00:25:45.577-->00:25:51.183 the old one so you get the same aesthetic um I restore some old radios and that's how they do 00:25:51.183-->00:25:57.356 it. Anything new is going to die a lot quicker than anything old. We have laptops and motherboards 00:25:57.356-->00:26:01.560 that die within 3 years because some of the caps just go that quickly they- are s**t's more 00:26:01.560-->00:26:08.400 sensitive, it dies quicker. Um and when powering on thermal imaging can be super helpful. 00:26:08.400-->00:26:13.372 What you're seeing in this image is basically me trying to power on the laptop much later on and 00:26:13.372-->00:26:17.109 you can actually see the residual heat from the power supply we attached to it, this 00:26:17.109-->00:26:21.013 was not stock, and you can see power distribution running through one of the cables and 00:26:21.013-->00:26:25.784 then going nowhere. That's about a 3 degree variance and it lights up like a Christmas tree. 00:26:25.784-->00:26:31.089 If you see something approaching a thermal shock value, it's gonna light up a lot faster. So 00:26:31.089-->00:26:35.761 this is ghetto but it'll give you a pretty good idea if something's gone horribly wrong 00:26:35.761-->00:26:42.034 and usually with enough time to pull the power. Um before you get into going into the elements 00:26:42.034-->00:26:46.505 let's talk about physical inspection the device- of the device. We pulled out two of em 00:26:46.505-->00:26:50.108 initially I had one a year prior to the other but this is a photo of two of them together. You can 00:26:50.108-->00:26:54.112 do an initial physical inspection as we talked about you can see the uh the speaker 00:26:54.112-->00:27:00.285 uh the- the fan. Good indicator that it's- it's a space laptop, velcro good indicator. You can 00:27:00.285-->00:27:04.990 also see sed numbers which helped us identify it in space you can also see the key caps 00:27:04.990-->00:27:09.495 taped to the outside, that's not a good sign. The other thing you can see is the back the backs 00:27:09.495-->00:27:13.866 interesting cause it tells us this laptop was modified this tells us it was a flight system. 00:27:13.866-->00:27:19.538 The power adaptor's been changed. There's also two high density ports where the modems 00:27:19.538-->00:27:24.042 used to be so if you find the back of an old 1530 or 1520 and take a look at it you'll 00:27:24.042-->00:27:29.248 discover that those are just standard RJ45 modem ports and the power supply was just a 00:27:29.248-->00:27:35.187 standard socket, now gone. This is the front, you pop it open, looks like a standard old 1980's 00:27:35.187-->00:27:40.292 laptop, pretty cool, you gotta love the keyboard. And uh you also see the key caps, key caps 00:27:40.292-->00:27:44.663 are interesting and they're gonna become more interesting later. You also see a little 00:27:44.663-->00:27:49.501 door and if you flip it open you find two app ROMs sitting in there and you go 'hi there, 00:27:49.501-->00:27:54.806 what's your name?' You got you 26, and you 25 and what that tells you is somebody didn't 00:27:54.806-->00:28:00.178 pull the data from the unit, you got Christmas. It's- It's a great feeling and you also know 00:28:00.178-->00:28:05.817 because it's an app ROM it probably didn't die so you pull it out you throw it in your uh 00:28:05.817-->00:28:10.122 your little universal programmer and hit the read button and you can read all the data right off 00:28:10.122-->00:28:16.461 uh the GQs are kinda nice granted but they only run on Windows. And uh you run strings 00:28:16.461-->00:28:19.131 because you're a hacker and you know how to read a binary the first time you see it, and it's 00:28:19.131-->00:28:24.670 the 1980s no one was obfuscating s***t so you run strings. And you see a copyright, some guy 00:28:24.670-->00:28:31.510 from GRiD in 1988 his- he was funny, he's like 'my name's Slick'. So you get internet 00:28:31.510-->00:28:36.748 sleuth mode here's a photo of me in internet stock art you know sleuthing. And you find Timothy 00:28:36.748-->00:28:41.219 Slick Carlson and you send him an email because Timothy Slicks Carlson like everyone is on 00:28:41.219-->00:28:45.591 Linkedin and he lives in the Philippines and he's retired now, he's an awesome dude and 00:28:45.591-->00:28:51.730 Timothy responds and goes, 'holy s***t you found my code' [laughter] Tim had no idea that 00:28:51.730-->00:28:55.867 any of it had ever been on the- in space but he knew that the government had bought them, he 00:28:55.867-->00:28:59.504 knew that it had been used for stuff, but he was also kinda like, 'that's my code, but 00:28:59.504-->00:29:02.841 that's my code from 1988 and these laptops are from like the 90's why the h**l are they still 00:29:02.841-->00:29:07.713 using it?' he also was like, 'some of your code's from Peter Norton which we would never have 00:29:07.713-->00:29:12.718 used' so he's giving us a pretty good idea that maybe these are not things from GRiD and then he 00:29:15.354-->00:29:19.825 being a hacker starts you know hex sevening and pulling out and running in DOSbox and starts 00:29:19.825-->00:29:23.762 telling us you know the language it's written in and he's a super happy guy and tellin' us all the 00:29:23.762-->00:29:27.499 information we ever wanted to know. And that's where our story about the GRiD being the first 00:29:27.499-->00:29:33.305 in space came from. He also pointed out this, there's an echo line in one of the scripts 00:29:33.305-->00:29:39.845 that identifies the laptop as a PGSC Application ROM Diagnostics Utility, PGSC is payload and 00:29:39.845-->00:29:43.682 general support computer says it outside on the case, that's how it was advertised which means 00:29:43.682-->00:29:49.021 whoever put this thing together, custom built an app ROM for it, so it's probably not fake, 00:29:49.021-->00:29:54.493 right? Somebody wrote an app ROM, who would do that? And there's another uh thing that 00:29:54.493-->00:29:59.898 comes up when you start researching PGSC and that's a thing called SPOC um it's 00:29:59.898-->00:30:04.069 obviously not a reference to Star Trek, uh everyone who's ever mentioned it from US 00:30:04.069-->00:30:09.408 government has very clearly said it's not a man- it has nothing to do with with Star Trek but it 00:30:09.408-->00:30:15.847 is the space shuttle uh personal onboard computer, the first laptop in space and the PGSC is 00:30:15.847-->00:30:21.286 the pregenerator when they switched over to GRiD case and the GRiD compass and The SPOC 00:30:21.286-->00:30:25.791 has a marked moment in history as being the first laptop in space, being the first time they 00:30:25.791-->00:30:30.228 added one of the most important applications that they've ever had and we'll get to that in a 00:30:30.228-->00:30:34.900 moment, but here you can see the Smithsonian for instance pointing out it has nothing to 00:30:34.900-->00:30:41.640 do with Star Trek. Here is a SPOC in a forward compartment of the orbiter. Orbiter's just nerd 00:30:41.640-->00:30:46.545 for space shuttle and anyone who ever says orbiter they're either from the 1980's and have a beard 00:30:46.545-->00:30:51.550 and worked at NASA or they're a comic book nerd. According to the people who worked at GRiD at 00:30:53.952-->00:30:59.858 the time the SPOC survived the Challenger disaster, to give uh credit to the uh the compasses 00:30:59.858-->00:31:04.162 where credit is due, they were incredibly resilient machines and they used uh thing called 00:31:04.162-->00:31:08.633 bubble memory. So supposedly these two machines that were on the uh the Challenger did 00:31:08.633-->00:31:13.638 survive. Uh the PGSC took over for the SPOC in 1988 the P- The SPOC was very limited it ran 00:31:16.041-->00:31:21.012 basically two applications we're gonna talk about one of them that we've been able to recover 00:31:21.012-->00:31:25.016 but the other one's basically lost to history. The second ah- the first one was a tracking 00:31:25.016-->00:31:29.454 application for the order, the second one was basically a run book application where if they 00:31:29.454-->00:31:35.093 saw an error code they could type it in, get a list of what to do. It sounds ridiculous to 00:31:35.093-->00:31:37.996 us that this is something that would have been a problem back then but you have to remember 00:31:37.996-->00:31:42.734 that they're up there in space on a very complex machine with limited communications and no 00:31:42.734-->00:31:49.040 digital equipment at the time. Uh they didn't really have an app store but it is important to 00:31:49.040-->00:31:53.345 note that GRiD did have it's own version of cloud storage in the 1980s. A little bit ahead of 00:31:53.345-->00:31:58.650 their time. This is the shuttle tracking application as it was written uh before this they had 00:31:58.650-->00:32:01.787 to do dead reckoning which means they had to basically look out the window and see where they 00:32:01.787-->00:32:05.557 were to figure out where they were over Earth, there was no other way to figure it out other 00:32:05.557-->00:32:10.095 than asking ground control and letting them figure it out. So this is the application that 00:32:10.095-->00:32:13.698 most of these laptops were initially set up to run and that's why there was usually one 00:32:13.698-->00:32:19.771 in the cockpit it would d- identify where over Earth they were. This application is 00:32:19.771-->00:32:25.143 available on the URL that I posted you can grab it and if you can get it to run it's 00:32:25.143-->00:32:30.148 basically GRiD OS emulated running in DOS. Um and now that we've visually inspected the 00:32:32.484-->00:32:38.156 laptops, let's get onto the fun stuff. I went a little further into digging into data that's 00:32:38.156-->00:32:41.459 out there, you wanna cross corroborate when you're doing digital archeology, it's not as 00:32:41.459-->00:32:45.764 much fun as the hacking part, but it's going to tell you important things. Supposedly 00:32:45.764-->00:32:50.635 this was for STS-41 so the first thing I did was pull up all of the image data on STS-41, here 00:32:50.635-->00:32:55.640 you can see an astronaut sleeping next to a PGSC system it is about mid riff to their- 00:32:57.742-->00:33:03.849 to their right. Um none of these matched up with the laptops I had, the serial numbers if I 00:33:03.849-->00:33:08.086 could see them didn't match and there was no key caps on them so this was a pretty good indicator 00:33:08.086-->00:33:11.857 these were not the ones I was looking for. But the PGSCs were used for a lot of stuff, some of 00:33:11.857-->00:33:16.394 them were actually used for ground development to develop uh different payloads for 00:33:16.394-->00:33:20.332 scientific missions, some of them were automated check and verify that the payloads 00:33:20.332-->00:33:25.136 running, one of them was used for the original GPS analysis, when they deployed the first GPS 00:33:25.136-->00:33:28.773 satellites they wanted to make sure they had gotten it right and they fired up a PGSC system 00:33:28.773-->00:33:34.646 which was a GRiDcase 1530 to connect to the first GPS receiver and identify they were 00:33:34.646-->00:33:40.318 getting the correct data. The PGSC interestingly did not have an orbiter communications link, 00:33:40.318-->00:33:44.789 it had no internet, it was not linked to anything. There was possible to put a multiplexer in 00:33:44.789-->00:33:48.360 but they didn't do that so that gives you pretty good scope of what these things did and what 00:33:48.360-->00:33:53.198 their purpose was. Now this was a great photo when I saw this, this was about 3am and I'm 00:33:53.198-->00:33:57.335 digging and I'm finding nothing, and then I find this guy and this was a later mission, this 00:33:57.335-->00:34:01.506 is STS-94, the later missions they had better cameras so I could read the day- the serial 00:34:01.506-->00:34:06.511 numbers and the serial number on that one I believe is SN 1073 which is the highest serial 00:34:06.511-->00:34:11.983 number I saw, the ones I have are SN1044 and SN1045 with references to 43 and 46 in the 00:34:11.983-->00:34:16.288 paperwork. I see an SN 1001 in the first PGSC system that I see that's a GRiD case. So they made 00:34:16.288-->00:34:21.293 probably at least 73 GRiD cases. Um what's interesting about this one though is if you look real 00:34:27.232-->00:34:32.270 careful you can tell that a bunch of the keys in the app function level have key cap 00:34:32.270-->00:34:37.275 tops, they have stickers on them. This one, STS-64, no key caps, but you can also see that 00:34:39.711-->00:34:45.850 there's another laptop hidden underneath. You look at one of mine, those are the key caps, 00:34:45.850-->00:34:51.323 pretty important. Here you can see em again, STS-47 has the key caps but you can also see 00:34:51.323-->00:34:56.828 there's no SAIC logo over the app ROMS, a bunch of them had SAIC logos, a bunch didn't it 00:34:56.828-->00:35:02.100 seemed like the earlier units in the PGSCs didn't have SAIC- did have SAIC logos, later ones 00:35:02.100-->00:35:07.138 didn't, didn't contractor did the afterwork and changed the logos out. Here you can see a 00:35:07.138-->00:35:12.143 SAIC logo next to a non SAIC logo, no keycaps, key caps. It's a later laptop. So what's 00:35:15.780-->00:35:19.250 interesting about the key cap ones is they're all related to space lab and microgravity 00:35:19.250-->00:35:25.223 science laboratory. All the uh flights correspondence missions, anything related to those key 00:35:25.223-->00:35:30.095 tabs seemed to be related to space lab. These systems probably didn't fly because all 00:35:30.095-->00:35:36.401 the space lab photos I could find are either S/N 106 units or S/N 1073 units. That's where I 00:35:36.401-->00:35:40.872 am right now, just doing visual inspection. Now let's look at the paperwork that came with one 00:35:40.872-->00:35:45.844 of them one of them came with a folio bunch of paperwork, the other one came with nothing. 00:35:45.844-->00:35:49.047 What's interesting about this particular piece of paperwork is it tells us how much these 00:35:49.047-->00:35:54.619 things cost, 40K, in current dollars that's about 70-->000 dollars a pop. The original 00:35:54.619-->00:36:00.025 retail value on one of those laptops is about 5-->000 so they paid about 35-->000 extra dollars 00:36:00.025-->00:36:04.029 to have them modified for flight and they probably had about 73 of these done between 1988 and 00:36:04.029-->00:36:09.034 1997 to give you an idea of cost of just this system. Also interesting here is you have a 00:36:11.202-->00:36:16.241 rea- a- a life history log which tells you things about dates, when was it first in the NASA 00:36:16.241-->00:36:21.246 receipt? And that's 1992. So it's definitely not a um it's definitely was reduced to a 00:36:25.150-->00:36:29.754 ground system in 92, vanished for 2 years and came back in 94 as part of the space lab. You 00:36:29.754-->00:36:34.359 can see a full life history log that's again corresponding and you can see the modifications, 00:36:34.359-->00:36:39.364 40 megabit hard disc, RS-422 diagnostic P-ROMs, Epoxy everywhere and that RS-422 00:36:42.000-->00:36:46.137 connector thing tells us what one of the boards is. This was a heavy modification, it was the 00:36:46.137-->00:36:50.708 most odd modification inside the laptop, it's an entirely custom board that replaces the modem. 00:36:50.708-->00:36:55.914 This was an R- RS-422 serial interface made by Rockwell International that interfaced 00:36:55.914-->00:37:00.819 with the space shuttle. So we're gonna remove the housing and get in there and actually look at 00:37:00.819-->00:37:04.923 some of the hardware right now. You see the appROMs, you see me trying to replace one of the 00:37:04.923-->00:37:09.427 batteries and turn it on, that failed. But you can also see that they modified the battery, 00:37:09.427-->00:37:12.831 they changed the way it interfaced so that they could swap the battery out, that 00:37:12.831-->00:37:17.802 wasn't a stock modification, you see epoxy in all the chips. You can see our lifelogs that were 00:37:17.802-->00:37:22.874 added to it and you can see that one of them ran for 3,700 hours the other one for about 1,500, 00:37:22.874-->00:37:28.680 that's a long time. This was not space shuttle use. You can also see that they had an odd and 00:37:28.680-->00:37:34.185 even bios and you'll see that in a lot of old computers where they had like a 16 bit bus but 8 00:37:34.185-->00:37:38.823 bit bios chips it would put odds and evens on the memory in there so you- they'd be interleaved 00:37:38.823-->00:37:43.828 when you pulled them out. We tried to pull it out initially with a dip- uh dip 28 cable and 00:37:45.964-->00:37:49.801 it didn't work because their power was still attached and I didn't want to cut the ca- the 00:37:49.801-->00:37:53.505 power cable, so if you ever wanna do this, you have to cut the power and ground so that 00:37:53.505-->00:37:57.909 you're not attempting to power the entire laptop when you're pulling the data off the chip. 00:37:57.909-->00:38:01.646 We lucked out however, initially I thought they were just soldered in because of all the 00:38:01.646-->00:38:04.849 epoxy, but they weren't there was actually a socket board there so we were actually able 00:38:04.849-->00:38:08.620 to pull it out and we were able to get the bios off which was super important cause the disc 00:38:08.620-->00:38:14.959 geometry information for the IDE discs was in the bios. The IDE discs were terrible, they were 00:38:14.959-->00:38:19.130 developed by a company called Conner. Conner is in Scotland and Scotland should feel ashamed 00:38:19.130-->00:38:24.302 for ever having produced these people. [laughter] This is what Tim Carlson who worked at GRiD 00:38:24.302-->00:38:29.073 had to say about the Conners, he was 'oh no Conner Peripherals' apparently they had a problem 00:38:29.073-->00:38:33.878 called 'stiction' in which the read heads would stick on the disc and their line engineers 00:38:33.878-->00:38:38.883 would you know being the 1980s hit it with their knuckles and let it keep going. So I had high 00:38:41.219-->00:38:47.292 hopes for this when it actually spun up, that was not the case however, uh it did spu- spin but 00:38:47.292-->00:38:52.096 they were very corrupted uh I needed to find an ATA card because they did not have an 00:38:52.096-->00:38:56.668 ability to understand LBA and anything USB throws LBA at it it eventually went 'just go oh 00:38:56.668-->00:39:01.773 that's CSH, I know that!' and starts feeding the wrong data. So we found an old ATA card, 00:39:01.773-->00:39:05.610 managed to get GNU ddrescue to run which was the only thing that was able to apparently 00:39:05.610-->00:39:10.515 continually try and pull data, and what we ended up pulling was about 20 megs of a 40 meg hard 00:39:10.515-->00:39:16.421 disc, randomly spread out, but enough to figure out what was on it. And it was basically MS DOS 00:39:16.421-->00:39:22.760 it was running Do- diagnostic ROM software, it was called a DDSE flight mode system. And um 00:39:22.760-->00:39:26.698 inside you can see some of the strings, uh, what the interesting one on the right 00:39:26.698-->00:39:31.870 shows a file listing and I've been unable yet although I've only been into one laptop's 00:39:31.870-->00:39:35.673 disc, the other one I have not been into, has a thing called astro 2 dot bat which could be 00:39:35.673-->00:39:39.944 real interesting because I've never seen that one on any of the paperwork, app wise. But 00:39:39.944-->00:39:45.049 most of its diagnostic data and you can see Tim Carlson again showing up all over the d***n 00:39:45.049-->00:39:49.821 place having written all of the diagnostic data for these machines. The binaries if you 00:39:49.821-->00:39:53.691 want if you want to dig into them with me are actually on PGSC dot space and uh we're 00:39:53.691-->00:39:55.693 working on restoring right now a stock GRiD 1520 to run some of the applications but it's 00:39:55.693-->00:39:57.695 basically dead um one of the things we have to do is actually drummle open a- a CMOS chip and 00:39:57.695-->00:40:02.700 then hot wire it and we're working on that but the next thing is replacing the display. 00:40:10.341-->00:40:15.680 Lessons learned here are that my weak a*s methodology did yield results. We cross corroborated 00:40:15.680-->00:40:19.917 between multiple sources, we identified these laptops were NASA systems, they were flight 00:40:19.917-->00:40:24.289 modified, we know the time spans they operated in, how long they ran, we know what they did, we 00:40:24.289-->00:40:28.726 know what applications were on there, we found the guy who wrote em. So all of that worked 00:40:28.726-->00:40:33.364 really well, we also know that it's pretty unlikely that these ever flew. We went through all 00:40:33.364-->00:40:36.968 of the flight logs, all of the flight data on Youtube and the national archives and could not 00:40:36.968-->00:40:40.905 find the serial number that would have matched from that sed number that was on there, we 00:40:40.905-->00:40:46.110 also identified that the weird a*s module that was in there was likely an RS-42- 422 rockwell 00:40:46.110-->00:40:50.581 interface for the space shuttle. And we figured out that they were used primarily for long 00:40:50.581-->00:40:54.052 life testing initially they would have been the first batch that would've been tested before 00:40:54.052-->00:41:00.158 they went from a 711 sed number to anything above that, the 713 is appeared to have been used 00:41:00.158-->00:41:05.930 initially to do shock testing, in fact one of the logs in there that's not posted shows a screw 00:41:05.930-->00:41:09.634 that came out of one of the displays and that was a send back to GRiD and they responded. 00:41:09.634-->00:41:16.474 Um they also did the EMI test on it. Disks show significant bit rot which tells us the discs 00:41:16.474-->00:41:20.345 don't survive that long even if they're in really good shape, in this case they were. Flash 00:41:20.345-->00:41:25.717 memory was intact. The easiest way to do recovery work on NASA gear is to work, there I'm gonna 00:41:25.717-->00:41:29.887 shout these guys out, I worked there for a little bit, and there was a group called LOIRP 00:41:29.887-->00:41:35.360 which actually did lunar [inaudible] orbiter project they recovered um magnetic media from 00:41:35.360-->00:41:41.265 the first lunar cause orbiters sending back- they were sending back perfect copies of data but 00:41:41.265-->00:41:45.636 we didn't have the da- the capacity to read that data, we recorded all this data but we 00:41:45.636-->00:41:49.307 didn't have the equipment at the time to read it, so these guys took over at McDonald's and 00:41:49.307-->00:41:54.645 started reading all the data and found the first Earthrise photos ever taken, amongst other 00:41:54.645-->00:42:00.284 things, high resolution images of the moon used for plotting landing sites. So LOIRP is a 00:42:00.284-->00:42:05.590 really cool project, I sent a URL, next to it by the way is a ICBM that they're working on 00:42:05.590-->00:42:10.595 restoring [laughter] And by the way that's in the unsecured part um i- if you wanna do this and 00:42:13.331-->00:42:17.301 you don't wanna go get a job at NASA there's a organization called Space Apps Challenge 00:42:17.301-->00:42:20.738 which allows you to go work on their data, they have huge volumes of data that nobody can 00:42:20.738-->00:42:24.208 do anything with because it's not indexed or searchable, nobody knows how to do anything 00:42:24.208-->00:42:28.579 with it. And we're running into this glut of historical, important data just being lost 00:42:28.579-->00:42:32.683 because there's so much of it created, they get paid to do the development, the advanced 00:42:32.683-->00:42:36.687 research, when they're done there's no funding to put it where it needs to be to be saved 00:42:36.687-->00:42:41.993 so if you have the opportunity that's one way you can contribute. So this is gonna be 00:42:41.993-->00:42:46.697 my- my thank you board it's uh that website is going to continue to get more data when I 00:42:46.697-->00:42:50.835 pull the next discs but it has most of the ROMs we've done shaw tests between them so we know 00:42:50.835-->00:42:56.174 the ROMs are not bit rotted uh it has the disc images for the first one as far as we've been 00:42:56.174-->00:43:00.178 able to pull them, they may get better over time and it has a bunch of applications and 00:43:00.178-->00:43:04.482 research papers related to PGSC systems if you wanna read through them including 00:43:04.482-->00:43:07.685 information on how the applications were written at the time, they wrote entire research 00:43:07.685-->00:43:12.123 papers on why they used DL displays, why applications were written the size that they were 00:43:12.123-->00:43:17.228 for tolerances and readability, the irony was the space shuttle at the end of the day was, 'can 00:43:17.228-->00:43:22.500 this astronaut read it'. Um Computer History Museum, much love to them for having given me 00:43:22.500-->00:43:27.972 an hour and a half video of the original creator's talking about it and to Def Con Goons etcetera 00:43:27.972-->00:43:33.377 and all those that I can not remember so does anyone have any questions cause we have like two 00:43:33.377-->00:43:38.382 minutes. [applause]