Get the full ebook with Bonus Features for a Better Reading Experience on ebookmeta.

com

PowerShell and Python Together 1st Edition Chet

Hosmer

https://ebookmeta.com/product/powershell-and-python-
together-1st-edition-chet-hosmer/

OR CLICK HERE

DOWLOAD NOW

Download more ebook instantly today at https://ebookmeta.com

 Recommended digital products (PDF, EPUB, MOBI) that
you can download immediately if you are interested.

PowerShell Pocket Reference: Portable Help for PowerShell

Scripters, 3rd Edition Lee Holmes

https://ebookmeta.com/product/powershell-pocket-reference-portable-
help-for-powershell-scripters-3rd-edition-lee-holmes/

ebookmeta.com

PowerShell for Beginners Learn PowerShell 7 Through Hands

On Mini Games 1st Edition Ian Waters

https://ebookmeta.com/product/powershell-for-beginners-learn-
powershell-7-through-hands-on-mini-games-1st-edition-ian-waters/

ebookmeta.com

PowerShell for Beginners: Learn PowerShell 7 Through

Hands-On Mini Games Waters

https://ebookmeta.com/product/powershell-for-beginners-learn-
powershell-7-through-hands-on-mini-games-waters/

ebookmeta.com

Suicidal Realism 1st Edition Brad Phillips

https://ebookmeta.com/product/suicidal-realism-1st-edition-brad-
phillips/

ebookmeta.com
SCHWESERNOTESTM 2023 FRM® PART I BOOK 4: VALUATION AND
RISK MODELS 1st Edition Kaplan Schweser

https://ebookmeta.com/product/schwesernotestm-2023-frm-part-i-
book-4-valuation-and-risk-models-1st-edition-kaplan-schweser/

ebookmeta.com

Innovations in Machine and Deep Learning Case Studies and

Applications Gilberto Rivera

https://ebookmeta.com/product/innovations-in-machine-and-deep-
learning-case-studies-and-applications-gilberto-rivera/

ebookmeta.com

All Kitten Aside 1st Edition Milly Taiden

https://ebookmeta.com/product/all-kitten-aside-1st-edition-milly-
taiden/

ebookmeta.com

The Daughter Of Auschwitz My Story of Resilience Survival

and Hope Tova Friedman Malcolm Brabant Foreword By Sir Ben
Kingsley
https://ebookmeta.com/product/the-daughter-of-auschwitz-my-story-of-
resilience-survival-and-hope-tova-friedman-malcolm-brabant-foreword-
by-sir-ben-kingsley/
ebookmeta.com

Gnotobiotic Mouse Technology An Illustrated Guide 1st

Edition Vowles

https://ebookmeta.com/product/gnotobiotic-mouse-technology-an-
illustrated-guide-1st-edition-vowles/

ebookmeta.com
General, Organic, and Biological Chemistry Structures of
Life by Karen Timberlake 6th Edition General

https://ebookmeta.com/product/general-organic-and-biological-
chemistry-structures-of-life-by-karen-timberlake-6th-edition-general/

ebookmeta.com
Chet Hosmer

PowerShell and Python Together

Targeting Digital Investigations
Chet Hosmer
Longs, SC, USA

Any source code or other supplementary material referenced by the

author in this book is available to readers on GitHub via the book’s
product page, located at www.​apress.​com/​9781484245033 . For more
detailed information, please visit http://​www.​apress.​com/​source-code
.

ISBN 978-1-4842-4503-3 e-ISBN 978-1-4842-4504-0

https://doi.org/10.1007/978-1-4842-4504-0

© Chet Hosmer 2019

This work is subject to copyright. All rights are reserved by the

Publisher, whether the whole or part of the material is concerned,
specifically the rights of translation, reprinting, reuse of illustrations,
recitation, broadcasting, reproduction on microfilms or in any other
physical way, and transmission or information storage and retrieval,
electronic adaptation, computer software, or by similar or dissimilar
methodology now known or hereafter developed.

Trademarked names, logos, and images may appear in this book. Rather
than use a trademark symbol with every occurrence of a trademarked
name, logo, or image we use the names, logos, and images only in an
editorial fashion and to the benefit of the trademark owner, with no
intention of infringement of the trademark. The use in this publication
of trade names, trademarks, service marks, and similar terms, even if
they are not identified as such, is not to be taken as an expression of
opinion as to whether or not they are subject to proprietary rights.

While the advice and information in this book are believed to be true
and accurate at the date of publication, neither the authors nor the
editors nor the publisher can accept any legal responsibility for any
errors or omissions that may be made. The publisher makes no
warranty, express or implied, with respect to the material contained
herein.

Distributed to the book trade worldwide by Springer Science+Business

Media New York, 233 Spring Street, 6th Floor, New York, NY 10013.
Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders-
ny@springer-sbm.com, or visit www.springeronline.com. Apress Media,
LLC is a California LLC and the sole member (owner) is Springer
Science + Business Media Finance Inc (SSBM Finance Inc). SSBM
Finance Inc is a Delaware corporation.
To the latest addition of our family – “Cousin Vinny” – one of the sweetest,
very loving, and curious Yellow Labs ever, who constantly interrupts our
daily lives in the most wonderful ways.
Introduction
The endeavor to integrate PowerShell and Python came about a couple
of years ago. I was providing training for a large utility and began by
teaching the members of the secure operations center, or SOC, on how
to apply Python scripts during investigations and incident response. A
few months later, they asked for similar training – this time using
PowerShell as the scripting engine for the SOC team. Based on this, I
quickly realized that PowerShell was perfect for acquisition of
information across the enterprise, and Python was good at performing
analysis of data that had been acquired by other tools.
Now, of course, PowerShell advocates will say that PowerShell
scripts can be developed to perform detailed analysis. Likewise, Python
advocates will say Python scripts can be developed to perform very
capable evidence acquisition. I agree with both advocates – but only to
a point. The real question is… if we combine the best of both
environments, does 1 + 1 = 2 or does 1 + 1 = 11? I believe that the
answer falls somewhere in the middle.
Thus, the purpose of the book along with the research and
experimentation that went into it was to build a model, in fact two
models, to integrate and leverage the best capabilities of Python and
PowerShell and apply the result to digital investigation . It is important
to note that this is a work in progress. I believe that the continued
development of advanced PowerShell and Python capabilities that
leverage the models provided here has great potential and should be
pursued.
Therefore, I encourage you to experiment with the models that I
have presented here and use them to develop new solutions that are
desperately needed to acquire and analyze evidence collected before,
during, and after a cyber incident, a cyber breach, as well as physical or
cybercrimes . I also encourage you to share your work and innovations
with others in our field to benefit those that fight cybercrime every day.
Acknowledgments
I’m deeply appreciative of Joe Giordano, the driving force behind
cybersecurity research and development, and ultimately education for
the past four decades. Your quiet, humble, and persistent work has and
is making a true impact on the security of our nation.
I want to thank Scott vonFischer, Tony Ombrellaro, and Dave Bang
for providing the catalyst for this book. Your forward thinking, ensuring
that your teams learn and apply the latest scripting environments to
solve challenging problems in forensics and incident response, has been
a true inspiration.
To my students at Utica and Champlain colleges, who constantly
surprise, challenge, and inspire me to find new ways to share my
decades of experience in software and scripting development to tackle
the challenges of cybercrime investigation.
To Dr. Gary Kessler for his tireless validation of my scripts and
writing. He always delivers sound advice on how to make both better.
To the whole team at Apress, especially Rita Fernando and Laura
Berendson, for your constant encouragement, dedication, and patience
throughout this project.
To my wonderful wife Janet, who always provides me with insights
and a point of view about a challenge that I never thought of. These
insights often, if not always, lead to new solutions and approaches that
constantly improve my work.
Table of Contents
Chapter 1:​An Introduction to PowerShell for Investigators
A Little PowerShell History
How Is PowerShell Used Today?​
How Do You Experiment with PowerShell?​
Navigating PowerShell ISE
PowerShell CmdLets
What Is a CmdLet?​
Introduction to Some Key CmdLets
Challenge Problems:​Investigative CmdLets to Explore
Challenge One:​Executing a “Find” Based on File Extension
Challenge Two:​Examining Network Settings
Challenge Three:​Examining Firewall Settings
Challenge Four:​Your Chance to Explore
Summary
Chapter 2:​PowerShell Pipelining
What Is CmdLet Pipelining?​
Example 1:​Get-Service
Example 2:​Get-Process
Adding a Transcript to Track Your Activities
Challenge Problem:​CmdLet Experimentation
Summary
Chapter 3:​PowerShell Scripting Targeting Investigation
Basic Facts About PowerShell Scripts
Example 1:​The EventProcessor PowerShell Script
EventLog CmdLets
 Retrieving More Specific Eventlog Information
Creating the Script
EventProcessor Get-Help Result
EventProcessor Script Execution
Resulting Directory
HTML Output Report
Remote Access
Example 2:​USB Device Usage Discovery
Create the Script
USBAcquire Script Execution
USBAcquire Get-Help Result
Challenge Problem:​Create File Inventory List with Hashes
Summary
Chapter 4:​Python and Live Investigation/​Acquisition
What Is “By Example”?​
Directing PowerShell with Python
Launching PowerShell CmdLets from Python
Creating a System Files Baseline with PowerShell and
Python
Overview of Python Execution with PowerShell
Challenge Problem:​Perform Remote Script Execution
Summary
Chapter 5:​PowerShell/​Python Investigation Example
Enable PowerShell Remoting
Gathering and Analyzing Remote Evidence
Invoking Remote Access
 Building a PowerShell Script for DnsCache Acquisition
Python Script and PowerShell CacheAquire Script
Overview of Client DNS Cache Acquisition and Search
Challenge Problem:​Multiple Target Computer DNSCache
Acquisition
Summary
Chapter 6:​Launching Python from PowerShell
Reversing Roles from PowerShell to Python
Examine the PowerShell Script
Examine the Corresponding Python Script
Executing the Combined PowerShell to Python Scripts
Extracting Possible Proper Names from Text Documents
Examine the PowerShell Script
Examine the Corresponding Python ProperNames Script
Executing the Combined PowerShell to Python
ProperNames Scripts
Extracting EXIF Data from Photographs
PowerShell Script
pyGeo.​py Python Script
Executing the Combined PowerShell to Python exifxtract
Scripts
Summary
Chapter 7:​Loose Ends and Future Considerations
Loose Ends
Future Considerations
Summary
Appendix A:​Challenge Problem Solutions
Chapter 1:​Investigative CmdLets to Explore
Challenge One:​Executing a “Find” Based on File Extension
Challenge Two:​Examining Network Settings
Challenge Three:​Examining Firewall Settings
Chapter 2:​CmdLet Experimentation
Transcript of Commands and Responses
Chapter 3:​Create File Inventory List with Hashes
Sample PowerShell Script Output
HTML Screenshots
Chapter 4:​Perform Remote Script Execution
Example A:​Acquire Remote Processes from PLUTO
Example B:​Acquire Remote Services from PLUTO
Example C:​Acquire Remote IP Configuration from PLUTO
Chapter 5:​Multiple Target Computer DNSCache Acquisition
Index
About the Author and About the Technical
Reviewer

About the Author

Chet Hosmer
is the founder of Python Forensics, Inc., a
nonprofit organization focused on the
collaborative development of open-
source investigative technologies using
Python and other popular scripting
languages. Chet has been researching
and developing technology and training
surrounding forensics, digital
investigation, and steganography for
decades. He has made numerous
appearances to discuss emerging cyber
threats, including National Public Radio’s
Kojo Nnamdi Show , ABC’s Primetime
Thursday , and ABC News (Australia). He has also been a frequent
contributor to technical and news stories relating to cybersecurity and
forensics with IEEE, The New York Times , The Washington Post ,
Government Computer News, Salon.com, and Wired magazine.
Chet is the author of Defending IoT Infrastructures with the
Raspberry Pi (Apress, 2018), Passive Python Network Mapping
(Syngress, 2015), Python Forensics (Syngress, 2014), and Integrating
Python with Leading Computer Forensics Platforms (Syngress, 2016). He
coauthored Data Hiding (Syngress, 2012) with Mike Raggo and
Executing Windows Command Line Investigation (Syngress, 2016) with
Joshua Bartolomie and Rosanne Pelli.
Chet serves as a visiting professor at Utica College in the
Cybersecurity graduate program, where his research and teaching focus
on advanced steganography/data hiding methods and the latest active
cyber defense methods and techniques. Chet is also an adjunct
professor at Champlain College, where his research and teaching focus
on applying Python and other scripting languages to solve challenging
problems in digital investigation and forensics.
Chet resides in the Grand Strand area of South Carolina with his
wife Janet, son Matthew, two Labrador Retrievers (Bailey and Vinny),
and feline tenants Lucy, Rosie, and Evander.

About the Technical Reviewer

Gary C. Kessler
, PhD, CCE, CISSP, is a Professor of
Cybersecurity and Chair of the Security
Studies & International Affairs
Department at Embry-Riddle
Aeronautical University in Daytona
Beach, Florida. His academic background
is in mathematics and computer science,
and his research interests include
network protocols, digital forensics, and
cybersecurity management and policy,
particularly related to maritime and
aviation. Gary is also an adjunct
professor at Edith Cowan University
(Perth, WA) and American Marine
University (Sarasota, FL).
Gary started the undergraduate and
graduate digital forensics programs at Champlain College (Burlington,
VT) and has been affiliated with the National Internet Crimes Against
Children (ICAC) program and Vermont, Northern Florida, and Hawaii
Task Forces since 1999. He is also a frequent speaker at national and
international conferences, notably the annual National Cyber Crime
Conference.
Gary is also a member of the advisory board of the Maritime and
Port Security Information Sharing & Analysis Organization (MPS_ISAO),
holds a USCG master merchant mariner certificate, and is a Master
SCUBA Diver Trainer. More information about Gary can be found at
www.garykessler.net .
© Chet Hosmer 2019
Chet Hosmer, PowerShell and Python Together
https://doi.org/10.1007/978-1-4842-4504-0_1

1. An Introduction to PowerShell for

Investigators
Chet Hosmer1

(1) Longs, SC, USA

PowerShell provides a great acquistion engine for obtaining a vast

array of information from live systems, servers, peripherals, mobile
devices, and data-driven applications like Active Directory.
Because of Microsoft’s decision to open PowerShell and provide the
ability to acquire information from other non-Microsoft platforms such
as Mac and Linux, the breadth of information that can be accessed is
virtually limitless (with the proper credentials). Combine that with a
plethora of built-in and third-party CmdLets (pronounced “command
let”) that can be filtered, sorted, and piped together, and you have the
ultimate acquistion engine.
By adding a bridge from PowerShell to Python, we can now leverage
the rich logical machine learning and deep analysis of the raw
information acquired by PowerShell. Figure 1-1 depicts the core
components that we will integrate in this book. The result will be a
workbench for developing new innovative approaches to live
investigations and incident response applications.
Random documents with unrelated
content Scribd suggests to you:
General Brisbane’s brigade was relieved by Colonel Downie’s
brigade of Spaniards, and proceeded by the valley of Los Alduides to
the pass of Maya.
On the 31st of August the whole of the third division crossed the
frontiers of France, and Major-General Brisbane’s brigade occupied
the pass of Echalar, replacing there the Seventh division, which had
proceeded to reinforce the troops before St. Sebastian; on the 4th,
however, it returned to the pass of Maya, and on the 15th resumed
its old position near the village of Erisoun, and remained in the valley
of Bastan till the 7th of October, when, in consequence of the left of
the army having crossed the Bidassoa and entered France, the
Eighty-Eighth and the rest of the division moved to the village of
Zagarramundi to the right and in front of the pass of Echalar.
During this interval (9th of September, 1813) Lieutenant-Colonel
Taylor joined the regiment, and superseded Lieutenant-Colonel
Macpherson in the command.
The colours of the Eighty-Eighth bear testimony that it had its
share on the 10th of November, in the storming of the formidable
lines which the French had erected on the river Nivelle, and in the
various actions which took place on the banks of the Nive, between
the 9th and 13th of December; but on neither of these occasions had
it the good fortune to come into actual contact with the enemy. On
the 17th of December it went into cantonments in the village of
Urcuray, situated on the high road leading from Bayonne to St. Jean
Pied de Port, and the adjacent hamlets, where it remained till the
army again moved forward in February following.
1814

In the battle of Orthes, 28th of February 1814, the third division

was directed to attack the heights on which the enemy’s centre and
left stood, and the Eighty-Eighth had once more an opportunity of
distinguishing itself, when its loss was more severe than on any
other occasion, except the siege of Badajoz. The Fifty-Second led
the attack; the Eighty-Eighth advanced on the right; the heights
were carried, and the regiment advancing in pursuit, its left flank was
charged by a body of French cavalry, which it entirely overthrew,
killing, wounding, or taking prisoners the whole detachment, which
was hemmed in in a narrow road, and precluded from all retreat. In
this battle, Captain Oates’s conduct was particularly noticed, and
procured for him the Brevet rank of Major in the army. The loss of the
battalion was three officers, Captain M‘Dermott, Lieutenant Moriarty,
and Ensign Reynolds, five Serjeants and thirty-six Rank and File
killed; and eleven Officers, Lieutenant-Colonel Taylor, Captains
Oates and Bunworth, Lieutenants Fitzpatrick, Davern, Faris,
Creswell, Holland, and Stewart, Ensign M‘Intosh, Ensign and
Adjutant Mitchell, thirteen Serjeants, and two hundred and one Rank
and File wounded. Total, two hundred and seventy-seven.
After this severe action the regiment was placed in cantonments
until the 13th of March, when it again took the field, and was present
on the 4th of April, at the battle of Toulouse. Although only three
companies of the regiment were engaged on this occasion, they had
the good fortune to perform a critical and important service, in
supporting the Forty-Fifth and Seventy-Fourth when engaged with
very unequal numbers of the enemy. The Light Infantry Company, in
particular, suffered, and its Captain, R. Nickle, was severely
wounded: the loss of the three companies in killed, was equal to that
of the whole battalion at Vittoria, amounting to one Serjeant and
twenty-nine Men; the wounded were Captain Nickle and Lieutenant
Poole, one Serjeant, and fifty-three Rank and File.
The Serjeant who fell at Toulouse, was much regretted by the
whole corps; his name was Thorpe, and he was Serjeant-Major of
the battalion. He had been originally Drum-Major, in which capacity
he was present at the battle of Busaco: on that occasion, when
ordered with the band and drummers, to the rear, he entreated his
commanding officer to allow him to join his company, and having
obtained permission he fell into the ranks, behaving with the utmost
gallantry throughout that memorable day. This, and other instances
of his courage, induced Lieutenant-Colonel Wallace to consider him
qualified for a higher situation, and to remove him from the band into
the line. He had for some time been recommended for a
commission, to which the Gazette which arrived from England a few
days after his death, contained his appointment.
 The peace of Paris in 1814, having put an end to the war on the
Continent, the Eighty-Eighth Regiment was among the corps
ordered to proceed to America, where hostilities were still raging. It
embarked in the Gironde on the 15th of June, under the command of
Lieutenant-Colonel Macpherson, and, without returning to England,
sailed direct to Quebec, where it arrived on the 3rd of August
following. The unfortunate failure of the combined military and naval
operations on Lake Champlain and at Plattsburgh put a stop to
active hostilities in Canada, and the Eighty-Eighth had only one
opportunity of coming into contact with the enemy, viz., at the
passage of the Savannah, where the light company, under Captain
Nickle, distinguished itself.
If, however, the period of its stay in Canada was barren of laurels
to the Eighty-Eighth, it gave the regiment an opportunity of
displaying qualities which, if not so dazzling and brilliant, are equally
valuable in, and honourable to the soldier, namely, firm discipline and
unshakeable fidelity to his king, his country, and his colours. The
extent to which desertion prevailed amongst the British troops in
America, is unhappily but too well known; but although the Eighty-
Eighth was stationed on the banks of the river Richelieu, within a
few hours’ sail of the province of Vermont; although the men were
considerably in debt to their officers, and under stoppages to pay off
an incumbrance, of which desertion would at once have relieved
them; although tempting rewards awaited such as should reach the
American territory, which could be done without the slightest risk;
although American ships were daily arriving and departing, and the
facilities were such that, if so disposed, the whole battalion might
have deserted in a night, the Eighty-Eighth did not lose one man
by desertion, during the whole eleven months that it remained in
Canada!!
1815

This honourable conduct of the men of the Eighty-Eighth did not

go unnoticed or unrewarded; their reward was exemption from the
painful duty of being present when the extreme sentence of martial
law was executed upon deserters from other regiments. The
following is a copy of the brigade order on one occasion of the kind,
more than nine months after the arrival of the regiment in America.

“St. John’s, May 19, 1815.

“No men having deserted from Major Green’s artillery, or
from the Eighty-Eighth regiment, they will not be required to
attend at Chambly for the purpose of witnessing the execution
of the sentence of a General Court Martial on several
deserters.”

The subject was again honourably adverted to by Major-General

Brisbane, in a letter addressed to the regiment in Brigade Orders,
when, in consequence of the escape of Napoleon from Elba, and the
prospect of renewed and active warfare in Europe, it had been
ordered to return to England.

“B. O.
“Major-General Sir Thomas Brisbane was much pleased this
day with the general appearance and movements of the
Eighty-Eighth Regiment. He cannot refrain from expressing
how much, and how sincerely he regrets losing a regiment with
which he has so long served, and which has conducted itself
so creditably since its arrival in this country; but he confidently
looks forward to have it again in his brigade. The circumstance
of the regiment never having lost a man by desertion is highly
honourable to it, and can never be forgotten by the Major-
General.
(Signed) “J. Campbell,
“Brigade-Major.
“St. John’s, May 26, 1815.”

On the 29th of May the regiment marched from St. John’s,

reached William Henry on the 1st of June, where it embarked in
small craft, and arrived at Trois Rivieres on the 4th. At Trois Rivieres
it was shifted into transports, reached Quebec on the 8th, sailed
again on the 10th, and arrived at Spithead on the 15th of July.
The battle of Waterloo had decided the contest in Europe before
the arrival of the Eighty-Eighth; nevertheless the regiment was
ordered to proceed, without disembarking, to Flanders. After two
days’ stay, therefore, at Spithead, it sailed again on the 17th, and
landed at Ostend on the 21st of July. From thence it proceeded
towards Paris, and on the 12th of August took up its quarters at St.
Denis, and was once more attached to Sir Thomas Brisbane’s
brigade. In December following it was removed to that of Sir John
Keane, on which occasion Major-General Brisbane caused the
following letter to be addressed to Colonel Wallace, who had again
taken command of the regiment.

“Paris, Dec. 17, 1815.

“Sir,
“I am directed by Major-General Sir T. Brisbane to express to
you, and to request that you will communicate to the regiment
under your command, the very sincere regret he feels in losing
the Eighty-Eighth regiment from his brigade: but he begs to
assure them that his best wishes accompany them, and he will
always be happy to have again under his command a regiment
that was surpassed by none, either for gallantry in the field, or
orderly conduct in quarters, during the seven years they have
been with him.
“I have, &c.
“J. Campbell,
“Brigade-Major.
“To Colonel Wallace,
Commanding the Eighty-Eighth Regiment.”

1816
1817
 From January, 1816, to the end of the spring, 1817, the Eighty-
Eighth was in garrison at Valenciennes, when it returned to Great
Britain, and was quartered in Edinburgh about two years. Some time
after its arrival in Scotland, a letter was received from Lieutenant-
General the Honourable Sir Charles Colville, who had frequently had
it under his command, as part of the third division, in the Peninsula,
and more recently during its stay at Valenciennes, “expressing his
hearty wish for the honour and well-being of the regiment in
whatever situation it may be placed, and requesting the Officers,
Non-Commissioned Officers and Privates, to accept his thanks for
the ready attention paid to his orders during the period the regiment
was under his command.”

1818

During the period of repose at Edinburgh, it occurred to Colonel

Wallace to establish an Order of Merit in the regiment, by conferring
some honorary mark of distinction on the non-commissioned officers
and privates, proportioned to their regimental character, length of
service, and the number of general engagements in which they had
been present. This was, however, a design which could not be
carried into execution without the consent and approbation of the
Commander-in-Chief, which Colonel Wallace applied for in the
following letter:—

“Edinburgh Castle, June 4, 1818.

“Sir,
“I have the honour to state, that some of the non-
commissioned officers and soldiers of the Eighty-Eighth
Regiment have served in twelve different general actions, and
have been two, three, and four times wounded, have been a
long time in the regiment, and always conducted themselves
well in the field and in quarters. I am anxious to bestow upon
them some mark of distinction for their good conduct, as an
encouragement to them and others in future.
 “I shall be much obliged to you if you will obtain His Royal
Highness the Commander-in-Chief’s permission for me to give
such men medals as a testimony of their merit.
“I have, &c.,
“J. A. Wallace,
“Colonel Commanding.
“To the Adjutant-General.”

The answer of the Commander-in-Chief, communicated in a letter

from Sir Henry Torrens, dated 28th of the same month, sanctioned
Colonel Wallace’s plan, leaving it to his “discretion to grant such
testimonials in the case alluded to, as he might deem essential to the
good of the regiment.” The proper authority thus obtained, Colonel
Wallace’s intentions were carried into effect without delay. Silver
medals of three distinct classes were struck at the expense of the
officers of the regiment. The first class was bestowed on men who
had been present in twelve general actions, and consisted of a
Maltese cross on which the names of the twelve actions were
stamped. The second class was given to those who had served in
from six to eleven general actions, and the third to such as had
served in any number less than six. The name of the man to whom it
was given was engraved on each medal. The total number
distributed was,—
Serjeants, Corporals, Drummers, Privates.
First Class, 13 6 6 45
Second Class, 7 9 3 126
Third Class, 19 10 3 185
— — — ——
39 25 12 356
1819

On the 11th of March, 1819, Lieutenant-General Sir Gordon

Drummond, G.C.B., was appointed Colonel of the Regiment, in
succession to Lieut.-Gen. Viscount Beresford, who was removed to
the Sixty-Ninth Regiment.
 In the summer of 1819, the Eighty-Eighth moved from Edinburgh
to Hull, sending detachments to Manchester and Stockport. In
August of the same year, Colonel Wallace, after more than fourteen
years’ service with the regiment, was promoted to the rank of Major-
General, and was succeeded in the command by Lieutenant-Colonel
James Ferguson.
During the time the regiment was quartered at Hull, the
manufacturing districts of England were in a high state of discontent,
and attempts were made to circulate inflammatory publications
amongst the military. Private James Tracy, of the Eighty-Eighth,
being tampered with for this purpose, received the papers, but,
instead of distributing them amongst his comrades, instantly gave
them up to his commanding officer, Major Nickle, furnishing, at the
same time, such information as led to the apprehension and
conviction of the man from whom he had received them. For this
conduct Tracy received a liberal reward, as well as the approbation
of Lieutenant-General Sir John Byng, commanding the district, which
was conveyed to him through a letter to Colonel Ferguson.
1821
1822
1823

From Hull the Eighty-Eighth removed to Chester, and from

thence, in the summer of 1821, to Liverpool, where it embarked for
Ireland, landed at Dublin, and proceeded to Enniskillen, where it took
up its head-quarters, furnishing sixteen officers’ detachments. In
July, 1822, it moved from Enniskillen to Castlebar in Connaught,
where it remained, again furnishing fifteen officers’ detachments, till
December, 1823, when it marched to barracks at Naas. On quitting
Castlebar it received a very flattering address from the magistrates
and resident gentlemen of the town and neighbourhood.
1824

On the 16th of January, 1824, Lieutenant-General Sir Gordon

Drummond was removed to the Seventy-First regiment, and the
Colonelcy of the Eighty-Eighth was conferred upon Lieutenant-
General Sir Henry Frederick Campbell, K.C.B., G.C.H.
1825

It was February, 1825, before the last detachment joined from

Connaught, when the regiment, once more united, removed to
Dublin, occupying first the Richmond, and subsequently the Royal
barracks. While the Eighty-Eighth remained in Dublin, orders were
issued for increasing the establishments of regiments from eight to
ten companies. The zealous exertions of Lieutenant-Colonel
Ferguson, aided by the high popularity the corps enjoyed, enabled
the Eighty-Eighth to complete its numbers in little more than six
weeks, and to be the first regiment reported as complete to the
Commander-in-Chief, a circumstance honourably noticed in a letter
from the Adjutant-General of the Forces to Major-General Sir
Colquhoun Grant, then commanding the garrison of Dublin, under
date of 20th of June, 1825. “I have it in command,” says the letter of
the Adjutant-General, “to express His Royal Highness’s approbation
of the zeal manifested by Lieutenant-Colonel Ferguson, the
commanding officer, in thus rapidly raising the augmentation, and
which being the first instance of completion yet reported, is most
creditable to that officer, and the corps under his command.”
In the latter part of the summer of 1825, the regiment removed to
Templemore, furnishing fourteen detachments in the counties of
Tipperary and Limerick. Here Lieutenant-Colonel O’Malley joined on
the 10th of August, and took the command in place of Lieutenant-
Colonel Ferguson, who had been removed to the Fifty-Second
Regiment. In September it received orders for the Mediterranean,
embarked by divisions at Cork on the 7th and 21st of October and
12th of December, 1825, and proceeded to Corfu, where the last
division arrived on the 27th of January, 1826.
1828

During the year 1828 the regiment furnished several detachments

to the neighbouring islands of Ithaca, Cerigo, Calamos, and Santa
Maura; the detachment in the last-named island suffered severely
from a malignant fever which raged during the months of June, July,
and August, and carried off thirty-six men out of seventy-five, of
which it originally consisted. On the 19th of September, the head-
quarters were removed to Cephalonia, on which occasion Major-
General Woodford took leave of it in the following very flattering
terms:—

“Garrison Orders.
“Brigade-Major’s Office, Corfu,
“Sept. 18th, 1828.
“Major-General Woodford will not allow the Eighty-Eighth
regiment to embark without his expressing the satisfaction he
feels at the invariably good conduct the regiment has
maintained in the garrison. Its interior order and general
soldier-like appearance sufficiently evince the assiduous
attention which has been bestowed on the regulation and
discipline of the corps. The Major-General feels this tribute to
be due to Lieutenant-Colonel O’Malley, and he requests he will
communicate his sentiments to the regiment.”

1830

In April, 1830, the Eighty-Eighth again returned to Corfu, where it

remained until September, 1831, when it was removed to Vido, and
continued there until December, 1831, when it again proceeded to
Corfu. The reserve companies remained in Ireland from 1825, to
April, 1830, when they embarked for England.

From the time of its original formation, the Eighty-Eighth

regiment had, as stated at the commencement of the Record, borne
on its colours and appointments a device, consisting of a Harp and
Crown, with the motto “Quis separabit?” No direct authority appears
to have authorised this appropriation of a badge and motto, but use
had sanctioned it, and the recollection of the fields of glory in which it
had waved before the enemy, endeared it to the sympathies of the
officers and men. In an official design for a new stand of colours
preparing for the regiment towards the end of 1830, this device and
motto were omitted. Colonel O’Malley immediately wrote to the
Adjutant-General representing the case, and the strong wishes of the
regiment for its retention, for the consideration of the Commander-in-
Chief. His application was successful, and obtained distinct authority
for the corps to continue the use of the badge to which it was so
strongly and so reasonably attached. The Adjutant-General, in a
letter dated from the Horse-Guards, 30th of December, 1830, says—

“Sir,
“I have had the honour to submit to the General
Commanding-in-Chief your letter of the 22nd instant with its
enclosures, and am directed to acquaint you, that under the
circumstances therein stated, his Lordship has been pleased to
obtain his Majesty’s permission, that the Eighty-Eighth
Regiment, or ‘Connaught Rangers,’ may retain on its colours
and appointments the Harp and Crown, with the motto ‘Quis
separabit?’ in addition to the badges and devices which it has
been authorized to bear in commemoration of its distinguished
services on various occasions.
“I have, &c.,
“John Macdonald, A.G.
“Colonel O’Malley, Eighty-Eighth Regiment.”

The Eighty-Eighth regiment having been omitted among the

regiments authorised to bear, as an honorary distinction, the word
“Pyrenees” on its Colours, the Commanding Officer, Lieutenant-
Colonel O’Malley, in the year 1830, made the most strenuous
exertions to obtain this additional honour for the regiment, in
commemoration of its services in the actions in the Pyrenees, as
narrated at pages 52, &c.; and testimonials of its gallant conduct on
the occasions in question, were furnished by Major-General Sir
Thomas Brisbane, who commanded the brigade of which the
Eighty-Eighth formed a part,—by Lieutenant-Colonel Sir Frederick
Stovin, who acted as Assistant-Adjutant-General to the third division,
—and by Lieutenant-Colonel James Campbell, who was Major of
Brigade.
 This omission occurred in consequence of the officer who
commanded the regiment on the occasion alluded to, not having
received a medal for that service, perhaps owing to an accident, or
clerical error at the time; but, as Lieutenant-General Sir Thomas
Picton, who commanded the third division, fell in the battle of
Waterloo, the requisite form of recommendation for honours of this
description could not be procured, and the General Commanding-in-
Chief did not feel himself justified in departing from the general rule
which had been established, as the ground on which these
distinctions should be submitted for the King’s approval. This
honorary inscription is, consequently, not borne on the colours of the
Eighty-Eighth regiment, for its services in the Pyrenees.
1831

On the 20th October, 1831, Lieutenant-General Sir Henry

Frederick Campbell, K.C.B., was removed to the Twenty-Fifth
regiment, and Major-General Sir John Alexander Wallace, Bart. and
K.C.B., who had commanded the regiment in many of the arduous
campaigns during the Peninsular war, was appointed to the
Colonelcy of the Connaught Rangers.
The Eighty-Eighth regiment continued in Corfu from the year
1830 to 1836, furnishing occasionally working parties for the island
of Vido, and detachments to Santa Maura, and the other islands: the
detachment to Santa Maura in April, 1832, continued there ten
months, and consisted of two Captains, three Subalterns, one
Assistant-Surgeon, six Serjeants, two Drummers, and one hundred
and fifty Rank and File.
To those persons interested in the well-being of the corps, and
who recollect the extent of sickness and mortality experienced by a
former detachment at this station, and of not more than half the
strength, in the year 1828, it will be gratifying to know, that not more
than two deaths took place, neither of which was caused by climate,
one of them was accidental drowning, and the other the
consequence of delirium tremens; indeed, such was the health of
this detachment, that the hospital was, for the greater part of the
time, unoccupied during its stay at Santa Maura.
 From the period of the return of the regiment from the Island of
Cephalonia to Corfu, Major-General Sir Alexander Woodford, in
making his half-yearly inspections, expressed in every instance his
approbation of the corps, more especially in June, 1831, when he
addressed a letter, of which the following is a copy, to Major O’Hara,
then Commanding Officer, upon whom, and the regiment altogether,
the sentiments expressed by the Major-General reflect much credit:
—

“Corfu, 6th June, 1831.

“Sir,
“Having now inspected the Eighty-Eighth regiment, twice
within six months, and having on both occasions found it in
high order, I have a satisfactory duty to perform, in desiring you
will communicate to the regiment my approbation of its soldier-
like appearance, its interior order, and its general steadiness
under arms.
“I beg you will intimate to the Officers, that their attention to
their duties, and to the good order and management of their
companies, is very apparent; and that, from the direction thus
given to the men, in the care and keeping of their arms,
accoutrements, and appointments, and in everything relating to
their equipment and personal appearance, arise, in my opinion,
the good humour and contentment, and consequent regularity
and discipline, which characterise the regiment.
“To the Non-Commissioned Officers and Men, I desire you
will state, that I am perfectly satisfied with them, individually, as
clean, smart, and well-behaved soldiers, and collectively as a
corps, highly creditable to the King’s service.
“In conveying these observations to the Eighty-Eighth
regiment assembled on parade, you will, Sir, receive yourself
the best testimony I can give, to the care and attention with
which you have discharged your own superior duties.
“I have, &c.
(Signed) “A. Woodford,
 “Major-General.
“To Major O’Hara, Commanding
Eighty-Eighth Regiment.”

Nothing of importance connected with the history of the regiment,

occurred from the date of its return to Corfu, with the exception of the
melancholy circumstance of Captain the Honourable Charles
Gustavus Monckton having been assassinated by a villain, private
James Clarke, on the 9th August, 1831, under the impression, as it
is believed, that his being accidentally met out of barracks at a late
hour of the night, by Captain Monckton, when in the act of
committing felony, might tend to his conviction thereof.
The constitution of a regiment is such that the acts of individuals,
more or less, reflect honour or disgrace on the whole corps, and
much of the fame and high character to which the Eighty-Eighth
regiment has claim, would perhaps be tarnished, if grounds existed
for imagining that any other individual belonging to it was concerned
in this diabolical act; the feelings evinced by the soldiers of the
regiment, particularly those of the company to which the assassin
belonged, when forgetful of the forbearance due to religion and to
the laws, they were with difficulty restrained from taking vengeance,
as well as their subsequent conduct in requesting to be permitted to
subscribe one dollar (4s. 4d.) per man, to erect a monument to the
memory of their much-lamented officer, and thereby make known to
posterity, their horror and indignation at the disgraceful occurrence,
are convincing proofs that no other soldier was implicated in this
disgraceful transaction.
The request of the regiment was acquiesced in; at the same time it
was deemed prudent to limit the subscription of the Non-
Commissioned Officers and Privates, to one day’s pay each, with
which a monument has been erected in the military burial-ground of
Corfu.
The following notification was made to the regiment on this
occasion:—
 “Corfu, 15th March, 1833.
“The Colonel commanding has much pleasure in announcing
to the regiment, that the Monument to the memory of the late
Honourable Captain Monckton has been completed, and now
stands over the grave of that much-lamented officer, in the
military burial-ground of this garrison. This mark of esteem and
regard for the deceased reflects much credit and honour upon
the regiment, more especially, as the expense attending it has
been paid by the voluntary subscriptions of the Non-
Commissioned Officers and Soldiers who generously offered
one dollar per man towards it, which Colonel O’Malley feels
quite assured they would as cheerfully have paid, if necessary,
and if permitted to do so, as they have readily contributed one
day’s pay, to which it was deemed prudent to limit their
contribution.”

The monument bears the following inscription in English, and in

Greek, viz.:—
SACRED
To the Memory of
THE HONOURABLE CHARLES GUSTAVUS MONCKTON,
Late Captain in
His Majesty’s Eighty-Eighth Regiment (or Connaught Rangers),
Who died by the hand of an Assassin, on the 9th August, 1831,
Aged Twenty-Six years.
This Monument is erected by the Non-Commissioned Officers and Private
Soldiers of the Regiment, in testimony of their respect and regard
for this most lamented young Officer, and to record their
abhorrence of the atrocious act by which he was
deprived of life.
The feeling of grief and indignation, strongly and universally expressed
by the Regiment, was only moderated on witnessing the prompt
punishment of the murderer, Private James Clarke, who
was executed on the 11th August, 1831.
1833

It may be here told, in further justice to the feelings of the men of

the company to which this assassin Clarke belonged, that such was
the horror of the wretch’s memory amongst them, that not one of
those soldiers could be prevailed with, unless positively ordered, to
receive, and do duty with the arms and accoutrements which had
been in his charge, and this having come to the knowledge of the
Commanding Officer, in March, 1833, when a draft of men was
received from the reserve companies, which made it necessary to
bring in use some spare arms and accoutrements, Colonel O’Malley
(in proof of his acquiescence in the feeling) caused the
accoutrements and appointments in question to be cut in pieces on
the parade of the regiment, and the objectionable firelock was
delivered into the Ordnance stores in exchange for another.
1834

The ceremony of presenting new colours to the regiment, took

place at Corfu on the 27th of February, 1834, the anniversary of the
battle of Orthes, in which the Eighty-Eighth regiment bore a
distinguished part, and suffered a severe loss in officers and men.
The presentation of colours, which is under any circumstances
interesting, caused on the present occasion an unusual excitement,
it being known that they were to be given by Lady Woodford, the wife
of Major-General Sir Alexander Woodford, commanding the troops in
the Ionian Islands. A vast concourse of people, with all the beauty
and fashion of the place, assembled at an early hour on the
esplanade of the citadel, which is finely situated, commanding a view
of the rugged and snow-topped mountains of Albania, of the sea,
and of the fertile hills of the island covered with olives, and green
with the opening vegetation of an early spring. The fineness of the
day was in unison with the beauty of the scenery, and nature herself
seemed to smile on the expected ceremony. The Lord High
Commissioner, Lord Nugent, the President of the Senate, and the
Senators with their families, and the nobility and gentry of the island,
honoured the corps with their presence.
The regiment being assembled and drawn up in line, at about
eleven o’clock Lady Woodford arrived in her carriage, attended by
the Major-General and his Staff on horseback; and on her Ladyship’s
descending in front of the line, the regiment presented arms, the
band playing “God save the King.” The grenadier company then
moved from the right, and drew up facing the centre of the battalion:
having opened its ranks, it presented arms to the old colours, of
which it took charge, and escorted them to the citadel, the regiment
presenting arms to them. Shortly afterwards the grenadiers returned
with the new colours, which had been consecrated on the previous
Sunday, and had remained in the garrison chapel. These were
delivered by the Rev. Charles Küper to the Major and senior Captain,
by whom they were borne to the parade, where those officers placed
themselves on either side of Lady Woodford, continuing to hold the
colours unfurled. The grenadiers having resumed their place on the
right of the line, the regiment formed three sides of a square, leaving
the fourth open to the public. During this formation, in order that a
suitable impression might be made on their young minds, the school
children of the regiment (boys and girls), neatly and uniformly
dressed in green, moved into the square.
Ensigns Herbert and Honeywood, upon whom the honour of
receiving the colours devolved, were then ordered to advance
towards Lady Woodford, when her Ladyship delivered the colours to
those officers, with the following exhortation:—

“Gentlemen,
“Receive and guard with fidelity, in every danger, these
Colours which I have the honour of presenting to you! May the
Almighty protect and prosper you in this sacred duty, and may
you live to be distinguished in your country’s service!”

At this moment a light breeze expanded the Colours, emblazoned

with the names of the many battles in which the corps had borne a
distinguished part, and a simultaneous burst of admiration and
applause issued forth from the numerous spectators.
The Ensigns then moved to their places in the line of Officers; as
they advanced, the regiment presented arms, the band playing “God
save the King.”
 The Major-General then stepped forward and addressed the
regiment in the following terms:—

“Colonel O’Malley, Officers, Non-Commissioned Officers, and

Privates of the Eighty-Eighth regiment, I have witnessed the
presentation of your Colours with peculiar interest and
satisfaction.
“To a regiment whose bravery in the field has ever been
conspicuous, few words can be necessary on this occasion;
but as your Colours are a sacred pledge which binds you to
your duty and your country, I cannot pass over in silence a
ceremony which calls forth every warm and honourable feeling
that ought to animate a soldier’s breast.
“This day, the anniversary of the battle of Orthes, reminds us
of a period when the valour and discipline of the British arms
rendered it everywhere triumphant, under that great
commander who led it from victory to victory.
“In those active and arduous campaigns, the Eighty-Eighth
regiment, from first to last, bore a most distinguished part,
under the command of that gallant officer who is now your
Colonel[8].
“The records of its meritorious services in those hard fought
battles, emblazoned on these colours which are now confided
to your trust, will be to you a proud memorial of the past, and a
stimulus for days to come.
“There are other corps, too, in this command, who equally
shared in those glorious successes, and in reverting to their
own gallant conduct, they will attest, and they can well
appreciate the ardour and gallantry of the Eighty-Eighth.
“Nor can I pass over a fact not less honourable to the corps
than even brilliant achievements in the field, I allude to the
campaign in Canada, where the inducement to desertion was
great, but where your men, without one single exception,
spurned every attempt to seduce them from their colours and
 their duty; a memorable instance of their love of country, and of
their fidelity to the service, which rendered them worthy of their
native land, and an honour to the British army.

“Colonel, Officers, and Soldiers,

“The good spirit and discipline which pervade your ranks are
the best presages of your future conduct, wherever you may be
called.
“In your hands, Sir, warmly supported as you are by the
officers around you, with your vigilance, your perseverance,
and your zeal for the welfare of the regiment, I feel persuaded
that its reputation and high name will ever be nobly maintained.
“With respect to you, Soldiers, there never was a period
when the country had stronger claims on your attachment;
when the regulations of the service so carefully provide for your
maintenance, your comfort, and your protection, while serving;
your support and honourable retirement, when age and
infirmity render you incapable of active duty; and I may say,
with confidence, there never was a time when the British
soldiers were more sensible of the advantages they enjoy—
more firm in their allegiance—more faithfully devoted to their
King and country.
“And whenever your services shall again be required to
encounter the enemies of our country in the field, need I say to
the Connaught Rangers, by these Colours you must stand or
fall—with these Colours you must conquer or perish?”

The Commanding Officer, Colonel O’Malley, replied to the Major-

General as follows:—
 “It becomes my duty for the Officers, Non-Commissioned
Officers, and Soldiers of the Eighty-Eighth, to return thanks to
you, Lady Woodford, and to you, Sir Alexander, for the honour
done to us this day; in performing which duty, I feel, with much
regret, how very incapable I am to do justice to the occasion, or
to the grateful feelings towards you, which animate me and
every individual of the regiment.
“Rangers! the Colours you have just received have been in
my possession above two years, in which I have watched over
them with a constant and anxious desire to witness their
delivery to you. Unavoidable circumstances have hitherto
prevented this, more especially, which we all have viewed with
deep sympathy and regret, the long and severe indisposition of
Lady Woodford. We have now, however, thanks to the
Almighty, the great satisfaction to see her Ladyship on this
parade in renewed health and strength; under any
circumstances you would receive with pleasure and honour
throughout your lives, those Colours, borne as they are on the
old and wounded poles which accompanied the regiment
through many successful and triumphant battles, and with the
only remaining fragments of the old Colours attached to them;
but tenfold will be your satisfaction in having received them
through the hands of Lady Woodford, a circumstance in itself
which could not fail to insure them your respect and devotion;
of this I was fully aware, when in your name I solicited her
Ladyship to present those Colours.
“In reference to them, identified as they are with the history
and gallant achievements of the regiment, I might, and would
say much, and that without a fear of the charge being made
against me, of sounding my own praises, (for, unhappily, I had
no share in the deeds of glory to which I allude); but my
feelings, excited by the very impressive address that the Major-
General has had the goodness to make to us, and by the
interesting presentation of the Colours by Lady Woodford,
altogether unfit me for the task.