Dr. Stephan

After a very challenging summer, I've finally turned in my written thesis, so it's official: I have my Ph.D. I'm publishing the abstract below. These findings should all be published in peer-reviewed journals in the next 6 months.


Ataxin-7 Conserved Motifs Determine the Severity of the Neurodegenerative Disorder Spinocerebellar Ataxia Type 7 in Transgenic Mice and Influence Lifespan in Yeast

Spinocerebellar ataxia type 7 (SCA7) is an autosomal dominant, progressive neurodegenerative disorder whose characteristic features are cerebellar ataxia, dysarthria, and retinal cone-rod dystrophy culminating in blindness. SCA7 is caused by an abnormally long glutamine-coding CAG repeat in the SCA7 gene, which encodes the protein Ataxin-7.

Ataxin-7 contains several conserved motifs that may influence the toxicity of the glutamine tract. Among these are three conserved regions (conserved block I – III), two caspase-7 cleavage sites, a nuclear export signal and two monopartite nuclear localization signals (NLS). Previous investigations have shown that the caspase-7 cleavage site D266 is required for the full toxicity of the Ataxin-7 protein in cell culture. We generated SCA7 transgenic mice expressing a 92 CAG version of the human SCA7 cDNA, with and without a D266N mutation. Mice carrying the D266N mutation were protected from SCA7-like neurodegeneration, behavioral signs and shortened lifespan.

To further characterize the role of conserved motifs in SCA7 pathology, we generated SCA7 transgenic mice carrying point mutations in both C-terminal NLSs (KKRK -> KAAK). Previous work has shown that nuclear localization is an important step in the pathology of CAG repeat disorders. We observed that mice lacking C-terminal NLS activity were substantially protected from degeneration of the retina and cerebellum, SCA7-like behavioral signs and shortened lifespan.

Age is the primary risk factor for neurodegenerative disease. Even in the absence of overt disease, the aging brain shows histopathological and molecular changes reminiscent of neurodegeneration. To explore the link between neurodegenerative disease and aging, we have examined the replicative lifespan of Saccharomyces cerevisiae missing the SCA7 ortholog, SGF73. This strain exhibits an unusually long lifespan, which is dependent on the function of the NAD+-dependent deacetylase SIR2. We present evidence that the extended lifespan of the SGF73 null strain is due to the influence of Sgf73 on the activity of Sir2 and the histone deubiquitinase Ubp8. Furthermore, we show that the level of ubiquitinated H2B is elevated in an SCA7 transgenic mouse line, indicating that an alteration in Ubp8 activity may play a role in SCA7 pathology and that aging and neurodegeneration may share a common mechanism.

Sejarah Kereta Api ( lokomotif )

Sejarah perkeretaapian sama seperti sejarah alat transportasi umumnya yang diawali dengan penemuan roda. Mulanya dikenal kereta kuda yang hanya terdiri dari satu kereta (rangkaian), kemudian dibuatlah kereta kuda yang menarik lebih dari satu rangkaian serta berjalan di jalur tertentu yang terbuat dari besi (rel) dan dinamakan sepur. Ini digunakan khususnya di daerah pertambangan tempat terdapat lori yang dirangkaikan dan ditarik dengan tenaga kuda.

Setelah James Watt menemukan mesin uap, Nicolas Cugnot membuat kendaraan beroda tiga berbahan bakar uap. Orang-orang menyebut kendaraan itu sebagai kuda besi. Kemudian Richard Trevithick membuat mesin lokomotif yang dirangkaikan dengan kereta dan memanfaatkannya pada pertunjukan di depan masyarakat umum. George Stephenson menyempurnakan lokomotif yang memenangi perlombaan balap lokomotif dan digunakan di jalur Liverpool-Manchester. Waktu itu lokomotif uap yang digunakan berkonstruksi belalang. Penyempurnaan demi penyempurnaan dilakukan untuk mendapatkan lokomotif uap yang lebih efektif, berdaya besar, dan mampu menarik kereta lebih banyak.

Penemuan listrik oleh Michael Faraday membuat beberapa penemuan peralatan listrik yang diikuti penemuan motor listrik. Motor listrik kemudian digunakan untuk membuat trem listrik yang merupakan cikal bakal kereta api listrik. Kemudian Rudolf Diesel memunculkan kereta api bermesin diesel yang lebih bertenaga dan lebih efisien dibandingkan dengan lokomotif uap. Seiring dengan berkembangnya teknologi kelistrikan dan magnet yang lebih maju, dibuatlah kereta api magnet yang memiliki kecepatan di atas kecepatan kereta api biasa. Jepang dalam waktu dekade 1960-an mengoperasikan KA Super Ekspress Shinkanzen dengan rute Tokyo-Osaka yang akhirnya dikembangkan lagi sehingga menjangkau hampir seluruh Jepang. Kemudian Perancis mengoperasikan kereta api serupa dengan nama TGV.

Deteksi Dini Kanker Usus



Resiko terserang kanker Usus Besar (Kanker Kolon) menjadi semakin tinggi dengan bertambahnya usia seseorang . Pada umumnya dunia kedokteran, berdasarkan data-data statistik, berpendapat ancaman terserang Kanker Usus Besar mulai terjadi pada usia 40 tahun keatas terutama bagi yang hidup dengan pola makan kehidupan modern.

Dengan meningkatnya usia seseorang' ancaman terserang kanker tersebut menjadi bertambah pula.Sebagai saluran terakhir pencernaan makanan, usus berpotensi terkena kanker dari makanan yang kita konsumsi. Ada lima stadium dengan sifat masing-masing dan besaran kemungkinan bertahan hidup yang semakin kecil bagi pasien.


Resiko terserang kanker Usus Besar (Kanker Colon) menjadi semakin tinggi dengan bertambahnya usia seseorang . Pada umumnya dunia kedokteran, berdasarkan data-data statistik, berpendapat ancaman terserang Kanker Usus Besar mulai terjadi pada usia 40 tahun keatas terutama bagi yang hidup dengan pola makan kehidupan modern.

Dengan meningkatnya usia seseorang' ancaman terserang kanker tersebut menjadi bertambah pula.Sebagai saluran terakhir pencernaan makanan, usus berpotensi terkena kanker dari makanan yang kita konsumsi. Ada lima stadium dengan sifat masing-masing dan besaran kemungkinan bertahan hidup yang semakin kecil bagi pasien.


Sebagai saluran terakhir pencernaan makanan, usus berpotensi terkena kanker dari makanan yang kita konsumsi. Ada lima stadium dengan sifat masing-masing dan besaran kemungkinan bertahan hidup yang semakin kecil bagi pasien.

Gejala

1.Lelah, sesak napas waktu bekerja, dan kepala terasa pening.
2.Pendarahan pada rektum, rasa kenyang bersifat sementara, atau kram lambung serta adanya tekanan pada rektum.
3.Adanya darah dalam tinja, seperti terjadi pada penderita pendarahan lambung, polip usus, atau wasir.
4.Pucat, sakit pada umumnya, malnutrisi, lemah, kurus, terjadi cairan di dalam rongga perut, pembesaran hati, serta pelebaran saluran limpa.

Penyebab

1.Kontak dengan zat-zat kimia tertentu seperti logam berat, toksin, dan ototoksin serta gelombang elektromagnetik.
2.Pola makan yang buruk, antara lain terlalu banyak daging dan lemak yang tidak diimbangi buah dan sayuran segar yang banyak mengandung serat.
3.Zat besi yang berlebihan diantaranya terdapat pada pigmen empedu, daging sapi dan kambing serta tranfusi darah.
4.Lemak jenuh dan asam lemak omega-6 (asam linol).
5.Minuman beralkohol, khususnya bir. Usus mengubah alkohol menjadi asetilaldehida yang meningkatkan risiko menderita kanker kolon.
6.Obesitas.
7.Bekerja sambil duduk seharian, seperti para eksekutif, pegawai administrasi, atau pengemudi kendaraan umum.

Pemeriksaan medis

Fiberoptik kolonoskopi: Memasukkan sejenis pipa terbuat dari serat optik ke dalam usus melalui anus (dubur). Kamera yang terdapat pada alat itu bisa digunakan untuk melakukan pemeriksaan apakah dalam usus terdapat polip atau tidak.
CT Scan.

Pemeriksaan darah: Menentukan tumor marker CEA (carcino-embryonis antigen) dalam darah.

Perawatan
1.Kemoterapi
2.Radiasi
3.Operasi: Pemotongan usus besar yang sakit, dan menyambungkan kembali dua ujung bagian usus besar yang sehat.
4.Teknik laparoskopi: Melalui beberapa lubang kecil yang dibuat dibeberapa titik di perut. Operasi dilakukan dengan alat-alat kecil yang dioperasikan lewat lubang-lubang itu dan dipantau lewat layar monitor.

Pencegahan

1.Konsumsi banyak makanan berserat. Untuk memperlancar buang air besar dan menurunkan derajat keasaman, kosentrasi asam lemak, asam empedu, dan besi dalam usus besar.
2.Asam lemak omega-3, yang banyak terdapat dalam ikan tertentu
3.Kosentrasi kalsium, vitamin A, C, D, dan E dan betakarotin
4.Susu yang mengandung Lactobacillus acidophilus
5.Berolahraga dan banyak bergerak sehingga semakin mudah dan teratur untuk buang air besar.
6. Hidup rileks dan kurangi stres.

Deteksi Dini

Seperti halnya deteksi dini kanker mulut rahim menggunakan papsmear atau untuk kanker payudara memakai mamografi, terhadap kanker kolon pun bisa dilakukan deteksi dini.

Deteksi dini kanker kolon dianjurkan kepada mereka yang telah menginjak usia 50 tahun. Tetapi bagi mereka yang memiliki riwayat keluarga pernah terkena kanker ovarium, kolon dan kanker paru, disarankan melakukan deteksi dini sebelum usia 50 tahun.

Kanker kolon dianggap sebagai penyakit yang perjalanannya lambat. Karena itu masyarakat dianjurkan melakukan deteksi dini melalui pemeriksaan darah yang ada dalam tinja dan kolonoskopi.

"Sebaiknya deteksi dini dilakukan sejak usia 40 tahun bagi yang memang memiliki riwayat ketiga jenis kanker tersebut dalam keluarganya," kata dr Aru W Sudoyo, konsultan hematologi dan onkologi medik dari FKUI/RSUPN Cipto Mangunkusumo kepada Media Indonesia, pekan lalu di ruang kerjanya.

Apalagi bagi mereka yang telah mengalami gejala, seperti perdarahan pada saat buang air besar dan tertutupnya jalan usus atau penyumbatan," lanjut Aru, deteksi dini sangat disarankan.


Menurut Aru, beberapa prosedur deteksi dini kanker kolon antara lain:

Pemeriksaan colok dubur oleh dokter bila seseorang mencapai usia 50 tahun. Pemeriksaan tersebut sekaligus untuk mengetahui adanya kelainan pada prostat.

Setelah itu, dilakukan pemeriksaan laboratorium yaitu pemeriksaan darah samar (occult blood) secara berkala, apakah terdapat darah pada tinja atau tidak. Kemudian pemeriksaan secara visual dengan endoskopi di kolon atau disebut kolonoskopi. Pemeriksaan kolonoskopi atau teropong usus ini dianjurkan segera dilakukan bagi mereka yang sudah mencapai usia 50 tahun.


Pemeriksaan kolonoskopi relatif aman, tidak berbahaya, namun pemeriksaan ini tidak menyenangkan. Kolonoskopi dilakukan untuk menemukan kanker kolorektal sekaligus mendapatkan jaringan untuk diperiksa di laboratorium patologi. Pada pemeriksaan ini diperlukan alat endoskopi fiberoptik yang digunakan untuk pemeriksaan kolonoskopi. Alat tersebut dapat melihat sepanjang usus besar, memotretnya, sekaligus biopsi tumor bila ditemukan.

Cara lain untuk menunjang diagnosis kanker kolon adalah dengan enema barium. Pada pemeriksaan enema barium, bahan cair barium dimasukkan ke usus besar melalui dubur dan siluet (bayangan)-nya dipotret dengan alat rontgen. Pada pemeriksaan ini hanya dapat dilihat bahwa ada kelainan, mungkin tumor, dan bila ada perlu diikuti dengan pemeriksaan kolonoskopi.

Pemeriksaan ini juga dapat mendeteksi kanker dan polip yang besarnya melebihi satu sentimeter. Kelemahannya, pada pemeriksaan ini tidak dapat dilakukan biopsi.

Dengan kolonoskopi dapat dilihat kelainan berdasarkan gambaran makroskopik. Bila tidak ada penonjolan atau ulkus, pengamatan kolonoskopi ditujukan pada kelainan warna, bentuk permukaan, dan gambaran pembuluh darahnya. Aru mengatakan dengan deteksi dini diharapkan kanker kolon dapat segera ditangani atau diterapi. Beberapa terapi, seperti kemoterapi dan radiasi dapat dilakukan untuk mengatasi kanker kolon



Sumber : Koran Media Indonesia


Alternatif Herbal untuk atasi Kanker Usus :

Untuk mencegah kanker usus dan akibat kanker yang lebih parah, konsumsilah Lhiforcan . Produk baru dari Liza Herbal yang menggunakan bahan-bahan alami berkualitas. Terbuat dari daun keladi tikus, temu putih, dan daun sambiloto. Lhiforcan baik untuk membuang toksin-toksin dari dalam tubuh. Membantu mengatasi kanker, tumor dan kista.

Info pemesanan : budiprakoso98@gmail.com atau 081310343598

FiveFingers in the Alpine Lakes Wilderness

I recently bought a pair of Vibram FiveFingers Sprint (pictured). They're minimal, lightweight shoes with "toes". They're designed to mimic barefoot walking as closely as possible, while protecting the feet from punctures and abrasion. The soles are thin, flexible and offer no padding whatsoever.

I've always been a barefoot walker, because I enjoy it and our feet evolved to be nude (or close to it). Besides feeling amazing, walking barefoot may allow the body to express better biomechanics. My feet have become tougher over time, but I still can't handle a rough trail barefoot.

When I first put the FiveFingers on, my initial thought was "these don't feel as much like being barefoot as I wish they did". Simply having something between your skin and the ground makes your feet much less sensitive. But I got used to them quickly, eventually using them for my parkour training.

I had a few converstions with my parkour instructor Rafe Kelley, during which I realized I had to re-teach myself how to walk and run correctly. Rafe is well-versed in natural human movement due to his background in MovNat, gymnastics, martial arts, strength training, parkour and anthropology. Modern shoes allow us to walk and run in a way that our bodies did not evolve to tolerate. The padding in shoes allows us to take large steps, in which we overshoot our center of gravity and contact the ground in a jarring manner. It also allows us to strike with our heels when we run, which is not comfortable when you're barefoot.

I took the FiveFingers on a 13-mile hike in the Alpine Lakes wilderness with a few friends last weekend. The Pacific Northwest has to be one of the most beautiful places in the world. I was expecting to use the shoes for a few miles and then swap them for my lightweight hiking shoes (Inov8 Flyroc trail runners). The beginning of the trail was really rocky and I thought I was going to have to take them off in the first few hundred yards. Surprisingly, my feet adapted, and although the trail stayed rocky, it became fairly comfortable by the time we had walked a mile.

I found myself thinking about Rafe's advice, and taking smaller steps that strike closer to my center of gravity. Although my strides were shorter, I had no trouble keeping up, and in fact going up the hills was remarkably easy. We gained 3,000 feet of elevation but I never got winded. I had to pay close attention to foot placement, which kept me from looking around much but was actually kind of fun.

After a few miles, I switched to my hiking shoes, with the idea that I should switch before my feet really started to hurt, rather than after. I immediately noticed that going up hills was harder, especially on my calves. My feet felt more cumbersome as well.

Here's me foraging for mushrooms on the trail. This is Laetiporus sulphureus, also known as "chicken of the woods". It's widely eaten in this area. However, my mushroom guide All That the Rain Primises, and More, had this to say about it:

"If you eat and enjoy this moushroom, always cook it thoroughly and do not serve it to lawyers, landlords, employers, policemen, pit bull owners, or others whose good will you cherish!"

I didn't take my chances. If you're going to pick wild mushrooms, make sure you know what you're doing and carry a regional identification guide. "I recognize them from China/Russia/Europe" kills several people a year in the Pacific Northwest. If you're experienced, this area is a mushroom bonanza. I can't set foot outside without stepping on a king bolete (porcini, cep) in the fall.

I ended up switching back to the FiveFingers for the majority of the hike, about 9 miles of it. The soles of my feet were a bit sore by the end (due to stepping on sharp rocks for miles), but my joints and muscles felt remarkably good! I had no joint pain or muscle tightness. I also felt pretty energetic. This was a big surprise, since I haven't done much hiking this year. The next day, my calves were sore, but that was it.

All in all, I really like the FiveFingers. I can wear them in places that require shoes, yet remain nearly barefoot. One potential drawback is the price-to-durability ratio. They cost me $80 and I don't expect them to last a year [Update 2013-- they are surprisingly durable]. That being said, I'm putting a beating on them. Parkour training destroys shoes. The rubber seems to be excellent quality (which you'd expect from Vibram), but it's thin and it has cuts in it for flexibility and grip, which will lower its lifespan. The upper is simply a piece of stretchy fabric that tears easily. I'm willing to deal with the durability issues because the advantages outweigh them [update- several FiveFingers wearers have commented that they actually last a surprisingly long time. See comments].

You crack me up!

So there I was pondering life's mystery's, when it dawned on me.... you lazy bastards have not signed up for the Vulture Bait yet!!

We are looking for volunteers for the races as well.

So, your uncle may just be getting out of prison for a weekend and you have no room in your double wide at the trailer park.... or maybe you would like to get grandma some fresh air while you do the 50K race, we can use them.

http://www.vulturebaitrace.com/ and you will be whisked away to the fantastic world of Vulture Bait.

Note to American entries: NO PASSPORT REQUIRED to enter Canada.
(but you will need one to get back in to your own country. Hey they are your governments rules not ours)


Each month leading up to the race, one lucky entry will win a Vulture Bait running jacket.
(I don't understand why Jennifer Anne wants to measure the male winners inseam though)

Last but not least, Trail Runner Magazine, August issue, page 12 says it all.

Ischemic Heart Attacks: Disease of Civilization

Or, more precisely, disease of industrial civilization.

The scientific literature contains examples of cultures that don't suffer from the chronic non-communicable diseases that are so common in modern societies. Much of what I've read indicates that heart attacks are practically unique to cultures that have adopted industrial foodways and a modern lifestyle, being infrequent or entirely absent in those that have not.

I recently came across an incredible paper from 1964 in the American Journal of Cardiology, titled "Geographic Pathology of Myocardial Infarction", by lead author Dr. Kyu Taik Lee (Am. J. Cardiol. 13:30. 1964). This was published during a period of intense research into the cardiovascular health of non-industrial cultures, including Dr. George V. Mann's famous study of the Masai.

The first thing Lee and his colleagues did was collect autopsy statistics from San Francisco and Los Angeles hospitals. They analyzed the data by race, including categories for Caucasian-Americans (white), Japanese-Americans, Chinese-Americans, and Filipino-Americans. All races had a similar incidence of autopsy-proven myocardial infarction (MI = heart attack), including both silent (healed) and fatal MI. For comparison, they included a table with autopsy data from hospitals in Tokyo, South Japan and North Japan. I'm including the data from Tokyo in the graph because it's also an urban environment, but the finding was the same in all three regions. Here's what they found, by age group: The Japanese had a very low rate of MI compared to both Caucasian-Americans and Japanese-Americans. The rate of MI in Caucasian-Americans and Japanese-Americans did not differ significantly. Thus, location but not race determined the susceptibility to MI.

Next, the investigators collected autopsy data from hospitals in New Orleans, again divided by race. This time they exained Caucasian-Americans and African-Americans. Both groups had a very high rate of MI, as expected, although the African-Americans had a lower rate than Caucasian-Americans. They also collected data from autopsies in Nigeria and Uganda for comparison. Here are the data for men: And for women: Again, location but not race largely determined the incidence of MI. MI was extremely rare in the African autopsies. Here's what they had to say:

There was only 1 case of healed myocardial infarction among over 4,000 adult autopsies in the Uganda series, and only 2 cases of healed myocardial infarction among over 500 adult autopsies in the Nigerian series. In the New Orleans Negro series the occurrence rate was far greater in every sex and age group than in either one of the Negro series in East and West Africa.

Over 4,500 autopsies and not a single fatal MI. If this isn't worth studying, what is? These data should be part of first-year training in medicine and health programs.

To satisfy the skeptics, Lee and colleagues imported hundreds of hearts from consecutive autopsies in Albany (USA), Africa, Korea and Japan. They had an American pathologist analyze them side-by side to eliminate any diagnostic bias. Here's what they found:

In the African Negro series no infarct was found in any age group [out of 244 hearts, 39 over 60 years old]. In the Korean series there were only 2 cases of myocardial infarction [out of 106 hearts] and they were both women... In the Japanese series there were 8 cases of myocardial infarction in 259 hearts. All were men...

In the American sample, nearly 40% of the hearts of men and women over 60 showed signs of MI. The findings of the American pathologist confirmed the international autopsy data, showing that diagnostic bias did not contribute to the results significantly. They also took measurements of the thickness of the coronary artery wall, an index of atherosclerosis. They found that the Americans had the most atherosclerosis, but all cultures had some degree of it and there was overlap in the amount of atherosclerosis between samples. This led the investigators to state:

Myocardial infarction and coronary thrombosis are almost nonexistent in Uganda and Nigeria, and the amount of coronary arteriosclerosis is significantly less in Africans than in whites. However, in the two groups there was some overlapping in the degree of arteriosclerosis. No Africans had infarcts, but some had the same or a greater degree of coronary arteriosclerosis as a few whites who had myocardial infarctions. One explanation for this may be that some difference in clotting or clot-lysis mechanisms is present in the two groups. In a previous study, we showed that the incidence of thromboembolic phenomena in the pulmonary circulation [blood clots in the lungs] was low in East Africans as compared with Americans.

Now, the authors' conclusions:

These data strongly suggest that among the Orientals the environmental factor is playing a major role in the etiology of myocardial infarction and coronary thrombosis. If the genetic factor is an important one, those Orientals who moved to this country many years ago or who were born in this country should still maintain their low occurrence rate of myocardial infarction at least to some extent, and one would not expect to see similar occurrence rates of myocardial infarction in Orientals and whites as old as 50 to 59 years... As with the Orientals, this suggests that for Negroes in the United States environmental factors are more important than genetic factors in the etiology of myocardial infarction.

Africans in Africa and Japanese in Japan = low incidence of MI. Africans, Japanese and Caucasians in the US = high and similar incidence of MI. Genes only influence a person's susceptibility to MI when they live in an environment that promotes MI. Otherwise, genes are basically irrelevant.

What do the traditional diets and lifestyles of Japan and Africa have in common? Not much. Even within Nigeria, the diet varies from heavily starch-based (root vegetables, soaked/fermented non-gluten grains, beans, plantains) to mostly reliant on high-fat dairy and meat, though the former is much more common and I'm not sure how much the latter is represented in the data. In fact, I believe it's the wrong question to ask. A better question is "what do we eat/do in the US that traditional Japanese, Koreans, Chinese, Polynesians, Melanesians and Africans don't"? For starters, none of them rely on industrially processed foods. Their food is generally prepared at home using wholesome ingredients and traditional methods.

There are a number of lifestyle factors that probably play a role here.  They probably get more exercise than Americans, even if it's only walking in Tokyo or domestic tasks for women in parts of Africa. Traditional Africans surely get more sunlight and thus more vitamin D. I can't imagine life is less stressful in Tokyo than in San Francisco or Los Angeles.  Cigarettes are probably much less prevalent in parts of Africa than in the modern US.

I really like this study, and I think these graphs should be disseminated as much as possible. I've prepared high-resolution versions in JPEG, Powerpoint and PDF formats. E-mail me (click on my profile for the link) if you would like a copy. Let me know which format(s) you want.

I love ftk 2.2.1

I am going to interrupt the series to just write a small love note to accessdata.

Dear FTK,
I know we've had some tough times together in the past. Me cussing at a crashed indexed, you not responding to my mouse clicks. There were times I thought we wouldn't last and that I would find someone else who would fulfill my needs. Then I saw the new you (FTK 2.2.1) and when I actually exported the emails from a indexed search into a recreated recursive directory path from the PST folder structure that it came from I held my breath. When I then saw that actual MSG files were contained in the right folders my heart skipped a beat. Then when I saw that the attachment was actually in place in the MSG ... I knew everything would work out.

Love,
G-C Partners, LLC

Seriously though, for those who didn't immediately get this joke alot of the forensic tools available to the market for the last 10 years have had some real gaps of functionality that made our lives torture. One of these most basic features missing was the ability to export an email found when reviewing an image in a forensic tool back to a msg or pst instead of just a text export or html export that wasn't even compliant to the rfc specifications needed for most tools to convert it. If we didn't have it in msg or pst most lawfirms and ediscovery firms could not process it.

FTK 2.2.1 has fixed that issue and for this my office will gain many, many hours of producivity back instead of running my very long process to reassemble the data from other tool outputs.

Back to the series in the next post, thanks for reading.

What did they take when they left? Part 4 (External Devices) - Where did it go and what did they take?

Howdy Reader,

It's been quite some time since my last blog post, I apologize. Things have been pretty busy, apparently the recession/depression has really spurred civil crimes and I had a very nice vacation. In our last time together we discussed more detectable methods of how suspects remove data from their systems. I've left off the most common and lengthy portion of the post so I could give it the detail and supporting documentation it deserves. In this post we will finish the concept exploring method 3 in this post and 4-5 in the next. This series does focus on Microsoft windows systems as they are the most popular business system in use, I will write another linux or mac specific series at another time.

Method 3 – Copying data to an external drive

1. How did they take data from the system
   

   
   

   The first step you should take in a windows system is examining the contents of the registry keys that track storage devices plugged into the system. Inside these registry keys located under the system registry file under the system control sets are at least three keys keeping track of three types of external storage devices:
   

   
   

   1. USB Devices
      

   USB storage devices have their information store under the USBSTOR key found under:
   

   system\currentcontrolset\enum\usbstor
   

   
   

   1. Firewire Devices
      

      
      

   Firewire devices that are also storage devices can be found in the system registry under the system control set as well at:
   

   
   

   System\currentcontrolset\enum\sbp2
   

   
   

   1. eSATA Devices
      

      
      

   eSATA devices that are plugged into the system can be found in the system registry under the system control as well at:
   

   
   

   system\currentcontrolset\enum\ide
   

   
   

   It's important to know that the type of eSATA enclosure (for instance I was testing with a Simpletech Prodive) will not appear in the IDE registry key. The type and serial number of the drive will appear in the registry but you will have no way to identify what enclosure the drive was in from the registry. Of course you can compare the drives in enclosure to find the right drive but if drafting a subpoena you will not be able to specify what enclosure the drive is in.
   

   
   

   1. Responsive to all types of devices:
      

   
   

   There are additional versions under the system key some of which are duplicates of currentcontrolset so make sure to check each one. Each controlset that is numbered such as controlset001 is a configuration state of the system that booted successfully at one time. The currentcontrolset points to the numbered controlset that was last booted from successfully.
   

   
   

   An easy way to parse out these registry entries is with RegRipper which creates a nice text file with all the most useful parts of the registry for the forensic examiner but in its latest version does not include the sbp2 key but I'm sure it will be added soon.
   

   
   

   There is one registry entry under these keys for each storage device that has been attached to the computer since it was first installed if these keys do not exist or are empty then someone has run a system cleaner as the key will only get created on the first attachment of a storage device except for IDE which will exist if their is an IDE drive in the system. Remember these entries are in the system registry so it applies to every user who has used the system. This means that if you have a multi user system you still will have to verify who plugged it in during the times and dates we find. These entries will contain digital cameras, thumb drives, external hard drives, ipods, cell phones, anything that provides some type of storage and will be accessed as a drive letter. Each entry will contain the parent id, the vendor id and what is marked as the serial number of the device. The serial number reported to windows is not always the serial number printed on the physical device and this varies by manufacturer so when requesting these devices in a subpoena or other form make sure to specify it 'as reported to Microsoft Windows'.
   

   
   

   The last written date of the registry key for each device entry tells you the last time the device was plugged into the system. We can determine the first time the device was plugged into the system by searching for the device name we found in the USBSTOR/SBP2/IDE keys and searching for it in the setupapi.log file found in the 'windows' directory in windows xp and in the setupapi.dev.log located under 'windows\inf' in Vista.
   

   
   

   To find out each additional time the device was plugged into the system we can look at the backed up copies of the system registry located in the restore points. For Windows XP this is located under the 'system volume information folder\rp'. There is a new version of regripper for restore point registry examination called ripxp that will run the ripper not only against the current registry file but also all the previous copies of it in the restore points.
   

   
   

   Windows Vista restore points are renamed to "system restore" points and utilize the shadow copy service to make a separate volume where previous versions of files and system files are kept depending on the configuration and version of windows vista. You can use programs such as Shadow Explorer to access these volumes on a live system (or an image running in a vm) where you can browse the point in time back up of each partition on the system for the same registries. I have not found a forensic tool to date that can mount these shadow volumes in the way that shadow explorer can.
   

   
   

2. What did they take
   

   
   

   If our suspect did not wipe the system clean of the information we now know all of the external devices they could have copied information to. Determining the extent of what they have copied on to these devices is not as well recorded by the system. There are several ways that a suspect may attempt to copy data to the external drive.
   

   
   

   1. Backup programs
      

      There are a variety of backup programs a suspect can use. Some of them will come bundled with the external media and others are built into the operating system. We can determine what backup program the suspect ran from the techniques discussed in part 2. Once you've identified the software used a quick google should reveal what if any logging the software left behind. For instance in Carreker Corporation v. Cannon et al (4:06-cv-00175-RAS-DDB) we found the use of Dantz Retrospect which creates a log file for each of the backups performed logging the configuration, directories backed up, files backed up and total data copied for each backup done with the software.
      

      
      

   2. Copy programs
      

      Some suspects will choose to use utilities such as robocopy or xxcopy to copy the data to external media. In those cases the techniques discussed in part 2 will help you identify what program they used and when they copied the data.
      

      
      

   3. Standard copy and paste
      

      If our suspect copied the data to some external media with just a copy and paste or drag and drop there will be no record that I have found to date to reflect it.
      

      The next thing we have to determine is what they copied on to the external drive. There are two reliable methods generated by Windows automatically that can tell us what files and/or directories they accessed from the external media.
      

      
      

      1. LNK Files
         

      Windows shortcut or 'LNK' (pronounced link) files have been a standard feature of windows since windows 95. LNK files as most forensic examiners refer to them are created for a variety of reasons. What is most important to us for this method is that for files and directories opened in windows explorer a LNK file will be created in the users recent directory ('\documents and settings\user name\recent' in windows xp, '\users\user name\recent' in windows vista) and if a program such as Microsoft office is associated with the file then a second lnk file will be located in the program's own recent directory located in the application data directory. The LNK file in its normal usage allows a user to quickly access the file that it points to. We can examine the LNK files and see which of them show that the file or directory it points to existed on an external disk. For more information on LNK files read this or this. For a free utility that will parse these files and other try Windows File Analyzer (most forensic tools have this capability already either built in or through some provided script).
      

      
      

      The LNK file tells us many important facts about a file that it points to.
      

      1. The time the file was first accessed on this computer
         

         The created date of the LNK file will tell you the first time the file was accessed through windows explorer, this captures the first access to the file. If the modification date varies from the creation date then you have the last time the file was opened as well.
         

      2. The time the file was first created on the media it resides on
         

         The LNK file captures the creation, modification, access dates as well as the size of the file that it points to within the LNK file structure. This allows us to know the creation time of the file which reflects the first time the file was copied onto the media. We can then determine when the data our suspect has taken was first copied on to the media. We will only know this if the suspect accesses the files or directories after copying them to the disk.
         

      3. The name, type and volume serial number of the media the file resided on.
         

         Using this we can determine which files accessed came from external media and match it up to those devices we identified in this section.
         

         
         

      1. MRU
         

         Most Recently Used entries in the registry exist for multiple types of applications and windows components. They keep track of the last files opened by the user for that application but they only track the file opened and the date on which the file was opened. The only way to determine if the path where the file was opened was on external media is to check if the drive letter shown was not local to the system. You can easily pull out most MRUs with regripper.
         

At this point we can now determine what external devices were in use and what files we can determine were placed there. The last two methods to discuss are copying data to network locations and uploading data to file hosting websites.

The Diet-Heart Hypothesis: Oxidized LDL, Part I

In my reading about lipoprotein particles (LDL, HDL, etc.) and how they associate with cardiac risk, I've come across three LDL-related markers that associate with risk: LDL cholesterol, LDL particle number, and LDL size/density. Is this a coincidence, or is there a reason for it?

The first marker, LDL cholesterol, is probably nothing more than a crude approximation of particle number. But LDL particle number and size/density are related to something else, that probably actually causes atherosclerosis rather than simply being associated with it: oxidized LDL (oxLDL).

oxLDL is formed when the lipids in LDL particles react with oxygen and break down. This happens specifically to the unsaturated fats in LDL, because saturated fats, by their chemical nature, are very resistant to oxidative damage. Polyunsaturated fats are much more susceptible to oxidative damage than saturated or monounsaturated fats. Linoleic acid (the omega-6 fatty acid found abundantly in industrial seed oils) is the main polyunsaturated fatty acid in LDL.

LDL is packaged with antioxidants in the liver, primarily vitamin E and coenzyme Q10 (CoQ10), to prevent its oxidation. However, the more time it spends in the blood, the more likely it is to exhaust its antioxidant store and become oxidized. Also, the smaller the LDL particle, the more likely it is to become trapped in the vessel wall and become oxidized there.

Oxidized LDL Correlates Tightly with Cardiac Risk

oxLDL has turned out to be a very sensitive marker of cardiac risk, surpassing traditional markers like LDL, HDL, and triglycerides in most studies to date. Since the discovery of sensitive assays that detect oxidized LDL drawn directly from patient blood, a number of studies have been published supporting its ability to detect atherosclerosis (plaque buildup in the arteries), heart attack risk and even the metabolic syndrome.

Holovet and colleagues published a study comparing the ability of oxLDL and a traditional risk factor assessment to detect coronary artery disease. The traditional method is called the Global Risk Factor Assessment Score (GRAS), and includes age, total cholesterol, HDL, blood pressure, diabetes and smoking status. It's similar to the commonly used Framingham risk score (which, interestingly enough, doesn't include LDL).

GRAS was able to correctly differentiate a healthy person from a person with coronary artery disease 49% of the time, while oxLDL was correct 82% of the time. Thus, oxLDL by itself was far more accurate than a whole battery of traditional cholesterol and cardiac markers. Coronary patients had more than twice the level of circulating oxLDL than the healthy comparison group.

In a large prospective study by Meisinger and colleagues, participants with high oxLDL had a 4.25 higher risk of heart attack than patients with lower oxLDL. oxLDL blew away all other blood lipid markers by nearly a factor of two. From the abstract:

Plasma oxLDL was the strongest predictor of CHD events compared with a conventional lipoprotein profile and other traditional risk factors for CHD.

Oxidized LDL Makes Sense

 Regular, non-oxidized LDL has few properties that would make it a suspect in atherosclerosis. It's just a little particle carrying cholesterol and fats from the liver to other organs. As soon as it oxidizes, however, it becomes pro-inflammatory, immunogenic, damaging to the vessel wall, and most importantly, capable of transforming immune cells called macrophages into foam cells, a major constituent of arterial plaque.

Researchers have been interested in the plaque-generating properties of oxLDL for over three decades, and quite a bit of data have accumulated. They've identified cellular receptors that allow macrophages to ingest oxLDL (CD36 and SR-A). These receptors are specific for oxLDL and do not recognize normal LDL to a significant degree. Mice whose macrophages lack either of these two receptors have the same amount of circulating LDL as normal mice, yet have 60 to 70 percent less atherosclerosis when fed a plaque-forming diet (1, 2). Shorter-term studies have not always been consistent however, suggesting that there are alternative mechanisms. I'll expand on this more later.

Another line of evidence comes from the ability of LDL-borne antioxidants to prevent atherosclerosis in animal models. The powerful synthetic antioxidant probucol greatly reduces atherosclerosis in a number of animal models. It also reduces the extremely high cholesterol rodents and herbivorous animals get when they eat a high-cholesterol "atherogenic diet", but several studies have concluded that the majority of probucol's effect is due to its antioxidant ability rather than its ability to reduce cholesterol (ref).

Vitamin E and CoQ10 are two other LDL-borne antioxidants that can reduce atherosclerosis in animal models, particularly in combination with one another. Vitamin E alone is not as effective, and in some studies totally ineffective, which is one possible explanation for the equivocal results of vitamin E cardiovascular trials in humans. The most effective combination of antioxidants is probably the one provided by a nutrient-dense diet.

In Summary

Multiple lines of evidence suggest that oxidized LDL plays a dominant role in atherosclerosis. Not only is it associated with cardiovascular risk, there's also a large body of evidence suggesting it actually directly contributes to it.