Looking for a "new" Windows artifact that is currently being under-utilized and contains a wealth of information? Event Tracing for Windows (ETW) and Event Trace Logs (ETL) may be your answer.
There's nothing new about them. They have existed for quite some time. However, their use from a forensics standpoint has been lacking. It's time to change that.
In this blog post we will cover what they are, where you can expect to find them, decoding ETL files, caveats associated with them and some interesting artifacts and forensically relevant data that ETL files can provide. Lastly at the bottom of this post you will find a link to our github repository for our python parser for ETLs.
ETLs or Event Trace Logs are ETW trace sessions that are stored to disk. Event Tracing for Windows was introduced in Windows 2000 and is still going strong up to Windows 10.
ETL files can contain a snapshot of events related to the state information at a particular time or contain events related to state information over time.
Event Tracing is mainly used by Windows and application developers. For example, Windows uses ETW for tracing the shutdown and boot processes and application developers use ETW to debug their applications.
It is enabled by default, but what is enabled and when it is enabled depend on varying factors including OS version and applications installed.
Windows uses ETW, but anyone can tap into the API or enable ETW sessions on demand and utilize event tracing including developers of Windows applications, IR, researchers, and adversaries. Refer to Microsoft's page for additional information about ETW.
Event Trace Logs (ETLs) are trace event sessions stored to disk. These files have the filename extension .ETL and will the main topic of this discussion.
ETL files stored to disk vary in their volatility and the data they contain. When a trace session is first configured, the settings used determine how log files are to be stored and what data is to be stored in them. Some logs are circular with old data being overwritten with new data when the max file size is reached, others have triggers that result in the contents of the log file being obliterated and starting fresh, and others have multiple log files for each instance that the event trace session flushed events to disk.
Windows stores information into ETL files when the system is shutdown, booted, a second user has logged into the system, when performing updates and more.
Microsoft Lync, Office, OneDrive, SkyDrive and Skype can also maintain their own ETL files containing debugging and other information.
The information contained within ETL files can be used in forensics for a variety of scenarios. Determining files that were previously existing but have since been deleted, Microsoft Lync contact status and other Lync information, connected WiFi networks and detailed information about them, services and applications running, system configuration information including physical and logical drive information, FileIO, DiskIO, Runkey information, and much more.
ETL files can be found practically anywhere on a Windows system. Some ETL files worth noting are listed below. These files have been observed as existing on most systems and can contain a great deal of information ripe for analysis. Some of these files will be explained in more detail later.
A link to a list of additional observed file locations can be found below. Note that this list is not all inclusive and there may be more locations not documented here.
Also, the existence of these ETLs on a system depends on many factors. Therefore, some of these files might not exist on the system you are analyzing. In research, some of the files were empty and others contained copious amounts of data.
As previously mentioned, ETL files can be found in numerous locations on a Windows system and there may be hundreds of them, some empty and some containing data.
How event data stored within ETL files depends on the trace logging technology used. More information about Microsoft's tracing technologies.
There are several Microsoft tools available for viewing/parsing ETL log files.
Windows Event Viewer is not only for EVTs and EVTXs, it can also read an ETL file. After opening an ETL in Event Viewer, you can save the ETL in various formats including as a CSV file.
However, depending on the type of ETL file, Event Viewer may not decode the event payload data and may not report event specific fields.
Microsoft Message Analyzer does a better job at decoding event data.
If you wish to write your own tool in C# you can tap into the NuGet TraceEvent library to read events from an ETL file.
For python, a module named PyETW allows you to access Event Tracing for Windows. You can use PyETW to read events from an ETL file .
It is important to note that when decoding an ETL on a system that is not the source system, information needed to properly decode event data might not be available.
When an event provider is registered on a system, it also registers information needed to decode the event data. If the event provider is not registered on the system you are using to decode an ETL file, the tool will not be able to properly parse the events.
Also, some ETL files require a separate PDB (program debugging database) to decode events. Microsoft Message Analyzer has an option that allows PDBs to be downloaded and used to decode ETL files. However, some ETL files require private PDBs that are not available for download.
Event trace sessions that are configured to be circular will overwrite old events with new events when the max file/buffer size is reached. The old events that were overwritten are not recoverable. The WiFi.etl, BootCKCL.etl and ShutdownCKCL.etl files are examples of circular log files in testing.
Other event trace sessions can pre-allocate disk space and write events to disk when triggered. For example, Outlook when debug settings have been configured will write events to a log file when Outlook is closed.
For ETL files that use the new file option, when a maximum file size is reached a new file is created using an incrementing value as the new file's name.
While this discussion focuses on offline forensics, there are numerous uses for ETW live monitoring.
In one example, a security research company published a proof of concept related to Logging Keystrokes with ETW.
Also check out Intrusion Detection with ETW for information related to using ETW for intrusion detection.
The artifacts listed here just barely scratch the surface of what is stored within ETL files. Note that some logs mentioned in this section are not always present.
The ShutdownCKCL and BootCKCL are circular kernel context logs (CKCL) which contain information about the system that the event trace session knows at the time it was either shutdown or booted.
These log files are located in "%SystemRoot% \Windows\System32\WDI\LogFiles".
In this scenario we have a suspicious piece of software and we need to determine what information the trace session captured at the time the system was booted. The source system that the ETL file was collected from was a virtual machine running Windows 10 where a known virus was purposefully executed. Not long after execution of the virus, the system was booted and the BootCKCL file was collected for analysis.
The name of the software is "TuvtEkxir.exe", it is known to be a malicious backdoor virus according to virus scans.
Using ETL Viewer, we can search for references to the executable.
In Figure 1: Search results containing TuvtEkxir, we can see there are multiple types of events related to our executable.
Looking into the FileIO/FileCreate we can see the location of the executable and an associated prefetch file.
Next lets take a look at what DLLs were loaded by the software by looking into the Image/Load event. In Figure 3: Virus Loading DLLs, some of the DLLs are listed. Note "shell32.dll" and "netutils.dll".
Now let's look at what disk reads were taking place. In Figure 4: Disk reads by virus, we can gather what file was being read, the offset, and the size of the read.
Disk reads can be used to find out what section of the DLL or file was being read.
This log when present is located in "%SystemRoot%\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-ntkl.etl".
In this scenario, we will determine information about a WD My Passport drive that was connected to a Windows 2008 server using the energy-ntkl.etl file. In Figure 5: WD drive Physical Disk Information, the WD My Passport drive has been identified. Here we can gather the disk number, sector, track, cylinder and manufacturer information.
Now that we know the disk number which in our scenario is 4, we can look into the event SystemConfig/LogDisk to gather more information. Here we can correlate the disk number, pull size information, drive letter, and free clusters.
Next let's determine the serial number, friendly name of the device, registry key, and other information. This can be found under the event SystemConfig/PNP. In Figure 7: PNP Information, we can correlate the friendly name to the manufacturer listed in Figure 5: WD drive Physical Disk Information.
We now have the registry key for this device, which also contains the serial number, vid, and the pid. The correlation can be tricky in scenarios where there are multiple entries with the same friendly name. In our scenario, there was only one device with the friendly name "WD My Passport 25E1 USB Device".
In Figure 8: Some events in CDesktopFolder_ParseDisplayName/Start lists folders that were accessed on the 'D:\'. Note that the timestamp does not indicated when it was accessed. Instead it indicates the time the trace session recorded the events.
The CortanaTrace1.etl may also contain information of interest. Voice searches using Cortana have been observed in this ETL.
In the example below I had conducted two voice searches.
The timestamp field for event records does not necessarily indicate the time that an event occurred. Further research is needed to understand what the timestamp represents.
For example, for the BootCKCL.etl file, events listed in the FileIO/FileCreated category may or may not have been created at the time the system was booted and the timestamp represented for the event does not necessarily indicate that the file was created at that time. The timestamp instead indicates that this information was captured by the session at the time the trace was created.
ETL files can be volatile. Their volatility depends on how trace logging is configured for each session.
Tools that parse ETL files may not parse all the data including Microsoft specific tools. This is because the information needed to decode events are not always stored within the ETL file. For example, some ETL files use one or more PDBs (Program Debugging Databases) to decode events.
We have developed a command line tool that can parse multiple ETL files within a folder and output to a CSV and SQLite database.


text:
.ui-tabs {
	margin-top:11px;
}

.ui-tabs .ui-tabs-nav {
	list-style: none;
	position: relative;
	margin:-1px -20px;
	overflow:hidden;
	padding-bottom:0;
}

.ui-tabs .ui-tabs-nav li {
	position: relative;
	float: left;
	border-bottom-width: 0 !important;
	padding: 0;
	border:1px solid #EFF0F1;
	background:#EEF0F1 url(../images/headerbg.gif) repeat-x scroll left bottom ;
	margin-right:2px;
}

.ui-tabs .ui-tabs-nav li a {
	float: left;
	text-decoration: none;
	padding: .5em 1em;
	color:#555555;
	font-family:Verdana,'Trebuchet MS',Sans-serif;
	font-size:1.1em;
	font-size-adjust:none;
	font-stretch:normal;
	font-style:normal;
	font-variant:normal;
	font-weight:bold;
	line-height:normal;
}

.ui-tabs .ui-tabs-nav li.ui-tabs-selected {
	border-bottom-width: 0;
	background:#ffffff;
}

.ui-tabs .ui-tabs-nav li.ui-tabs-selected a, .ui-tabs .ui-tabs-nav li.ui-state-disabled a, .ui-tabs .ui-tabs-nav li.ui-state-processing a { cursor: text; }
.ui-tabs .ui-tabs-nav li a, .ui-tabs.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-selected a { cursor: pointer; } /* first selector in group seems obsolete, but required to overcome bug in Opera applying cursor: text overall if defined elsewhere... */
.ui-tabs .ui-tabs-panel { display: block;  background: none; clear:both;border:1px solid #EFF0F1; padding:10px;}
.ui-tabs .ui-tabs-hide { display: none !important; }

redpajama_set_name: RedPajamaGithub


The City Council of Santa Maria del Camí convenes this 1st Glosses Contest, following the legacy of la Associació Cultural Amics de la Glosa . A contest of popular poetry open to all interested people.
Each participant may submit up to three original glosses of free theme and written in Catalan. The term for the presentation of the works ends on February 24, 2019 and the awards ceremony is celebrated on the 28th of this month in Ses Cases des Mestres (21:00 h).
It establishes three cash prizes of 400, 250 and 200 €. Check the bases.


Wish you all a very Happy Rakshabandhan.
After a long time this year am home for Rakhi. So I decided to make and offer Rakhi to Lord Krishna and what could be better than a flower Rakhi for the God. I did Puja this morning to pray for the well beings of my brothers and then tied Rakhis around their wrists.
When we were young we used to decorate some place around the picture of Radha and Krishna for a seven day long festival called Jhulan, which is celebrated following the Radha Krishna swing festival of Vrindavan. It starts on the third day of the bright fortnight of Shravan month (Monsoon) and lasts until the full moon night of the month. During this festival the Radha-Krishna Deities are swung on a swing and decorations are made around that. planning to do the same next year with son and niece.


text:
Q: Since when has Darth Vader had a sense of humor? After Force-choking Director Krennic, Darth Vader makes the comment

Be careful not to choke on your aspirations, Director.

This comment displays a sense of humor that seems entirely out of character for him. Is it ever explained in-universe?

A: It seems pretty fitting actually, considering his attitude in the prequel trilogy, then his rogue one quips, then how much darker, dry, and sadistic his remarks become in the OT. The stress of being a sith Lord will take the piss out of even the cockiest of smartass. If phantom menace Anakin starts the spectrum and return of Jedi Vader ends it, it's pretty clear he's always been a smartass and the stress of a job in government made him a grouchy old curmudgeon.

A: Since his days as annoying, whining, but deadpan-snarking Padawan (and he learned the snark from Obi-Wan, if nothing else).
ROTS

General Grievous, You're Shorter Than I Expected.
Anakin: Under the circumstances, I'd say the ability to pilot this thing is irrelevant.
Obi Wan: Wait a minute, how did this happen? We're smarter than this!
  Anakin: Apparently not.
Obi-Wan: Oh Anakin, where is your lightsaber?
  Anakin: I know exactly where it is. pointing at a battle droid It's right there.
  Obi-Wan: How could you let this happen?
  Anakin: Hey, he's got your lightsaber too, you know.
  Obi-Wan: I really don't think that's the point.
  Anakin: This weapon is your life, Obi-Wan!
  Obi-Wan: Yes, alright, you've made your point.
OBI-WAN: Oh, so all of a sudden it's my fault.
  ANAKIN: You're the Master. I'm just a hero.

AOTC

Dooku: That was brave, boy, but foolish. I would have thought you'd have learned your lesson.
  Anakin: I'm a slow learner.

A: Vader has quite a dry sense of humour and can often be found quipping at mildly inappropriate moments, especially when choking people, which he really seems to enjoy.
One assumes this is a habit he's picked up from his mentor Obi-Wan "so uncivilised" Kenobi.
A New Hope

VADER: I find your lack of faith disturbing [as he's choking Motti]

Empire Strikes Back

VADER: Apology accepted, Captain Needa. [As he's choking Needa]

and

VADER: We would be honored if you would join us. [Inviting Leia, Han and Chewie to dine with him after capturing them]

and

VADER: Perhaps you think you're being treated unfairly. [As Lando complains about the deal he's made being changed]

Return of the Jedi

VADER: Perhaps I can find new ways to motivate them. [When told that the construction crews are working at full capacity]

and

VADER: The Emperor is not as forgiving as I am. [as a not-so veiled threat]

In the Revenge of the Sith novelisation he's even quippier when dealing with the Separatist leadership, indulging in some word play and even a pun or two.

"We were promised a reward," she gasped. "A h-h-handsome reward"
  "I am your reward," the Sith Lord said. "You don't find me handsome?"
...
"You fought a war to destroy the Jedi." Vader stood above the
  shivering Neimoidian, smiling down upon him, then fed him half a meter
  of plasma. "Congratulations on your success."
...
The head of the Techno Union turned at his approach, cringing, arms
  lifted to shield his faceplate from the flames in the dragon's eyes.
  "Please, I'll give you anything. Anything you want!"
The blade flashed twice; Tambor's arms fell to the floor, followed by
  his head. "Thank you."
...
"The war is over-Lord Sidious promised-he promised we would be left in
  peace …"
  "His transmission was garbled." The blade came up. "He
  promised you would be left in pieces."

and again in Tarkin when killing Phoca Soot in front of a group of Coruscanti gangsters and criminals.

His eyes glazed over and his red skin began to pale; then his arms
  flew back from his chest as if in an act of desperate supplication,
  and he tipped backward, the left side of his head slamming hard
  against the blood-slicked floor.
For a long moment, Vader's breathing was the only sound intruding on
  the silence. Without bothering to gaze on his handiwork, the Dark Lord
  finally said: "Perhaps this is a good place to conclude our assembly.
  Unless any of you have questions?"

Marvel: Star Wars #2

redpajama_set_name: RedPajamaStackExchange


text:
Pakistan writes 'UAE 2021' instead of 'India 2021' on their T20 World Cup jersey
The upcoming T20 World Cup is just around the corner and the participating teams have started unveiling their special jerseys for the showpiece event, which is being hosted by India in the UAE.
However, a huge controversy has started to erupt with Pakistan at the centre of it.
Notably, a picture of Pakistan's T20 World Cup jersey is being shared widely on social media. Going against the rules, the Pakistan's jersey has mentioned 'UAE 2021' as the hosts which should have been 'India 2021'.
As per the rules, on the top right of the jersey, all the teams need to mention the name of the ICC event and also the hosts.
Going by it, 'ICC Men's T20 World Cup India 2021' should be written on the jersey of every team as even though the tournament is being played in the UAE, India are the official hosts of the showpiece event.
However, Pakistan have written 'ICC Men's T20 World Cup UAE 2021' on their jersey which might not just upset the Board of Control for Cricket in India (BCCI), the original hosts of the event, but could also spark a controversy.
A picture which has gone viral on social media, Pakistan skipper Babar Azam is seen donning the team's jersey, which has UAE being mentioned as the hosts.
Although, the Pakistan Cricket Board (PCB) is yet to unveil the jersey officially, it remains to be seen if the International Cricket Council (ICC) or BCCI ask them to make any changes to it.
The T20 World Cup is set to start on October 17 in Muscat and will conclude on November 14 in the UAE.
In the showpiece event, Bangladesh, Ireland and 2014 winners Sri Lanka will be competing alongside Namibia, Netherlands, Oman, Papua New Guinea, and Scotland for a place in the Super 12 stage which features Afghanistan, Australia, England, India, New Zealand, Pakistan, South Africa, and West Indies.
Earlier in June, the ICC had officially confirmed that the upcoming T20 World Cup will not be played in India and instead the BCCI only will host the tournament in the United Arab Emirates and Oman.
BCCI president Sourav Ganguly had said that considering the uncertainty due to the COVID-19 situation in the country, it was tough for them to take the decision of not holding it in India.
The BCCI remained the hosts of the event, which will now be held across four venues – Dubai International Stadium, the Sheikh Zayed Stadium in Abu Dhabi, the Sharjah Stadium, and the Oman Cricket Academy Ground.
The first round of the tournament, comprising the eight qualifying teams, was divided between Oman and UAE.
"The BCCI is looking forward to hosting the ICC Men's T20 World Cup 2021 tournament in UAE and Oman," Ganguly had said.
"We would have been happier hosting it in India but considering the uncertainty due to the Covid 19 situation and the importance of a world championship, the BCCI will now continue to host this tournament in UAE and Oman. The BCCI is looking forward to creating a spectacle," he had added.
The upcoming edition will be the first Men's T20 World Cup played since 2016, when West Indies beat England in the final in India.
Tags: BCCI Board of Control for Cricket in India ICC India International Cricket Council Pakistan T20 World Cup UAE
Team India trainer Nick Webb to step down after T20 World Cup
Ian Watmore steps down as ECB chairman with immediate effect

redpajama_set_name: RedPajamaCommonCrawl


text:
/**
 * Кнотроллер корневого элемента описания (webkit).
 *
 * @author dew1983@mail.ru <Suvorov Andrey M.>
 */

Ext.define(
	'FBEditor.editor.element.desc.AbstractRootElementControllerWebkit',
	{
		extend: 'FBEditor.editor.element.root.RootElementControllerWebkit',
		mixins: {
			controller: 'FBEditor.editor.element.desc.AbstractRootElementController'
		},

		onMouseUp: function (e)
		{
			var me = this;

			me.mixins.controller.onMouseUp.call(me, e);
		},

        onMouseDown: function (e)
        {
            var me = this;

            me.mixins.controller.onMouseDown.call(me, e);
        }
	}
);


June 8, 2015 Summerita Rhayne Book spotlightdiscount, preorder, special price, The Eligible Princess.
I came here all super excited to share the news of the new book but…koff…koff…I see that this place needs to be cleaned up a bit. Haven't visited here for a while… *goes red about the ears* oh I'm going to set that right in a minute.
Well now it's about right…oh don't regard that patch…oh ok! *sighs* I'll tackle it… What? I'm supposed to vacuum too? Oh no. Think of my back… my sapping energy…my book!
No mercy? I'll get to it then.
Please keep the coffee ready!
Well, it's not going to get better unless I go for redecoration – what? You want a new look? Hey no, I like it here…it's homely and…and comfortable. Oh the carpet is… oh, I'll get the cleaners to tackle that stain. Really, I would! No, it won't take a year to get to it. See, I'm finished with the WIP and having a book out so I've got…you know…time!
What's that you say? Time flies? New ideas take hold? True, but I promise…no, this time I will keep my word. Anyway, now I have the place looking spotless and bright… *stands on the carpet stain* See? This looks like a new place!
The Eligible Princess is up for pre order at Amazon. It is the second book in the Kamboj Princesses Saga. The first book Hidden Passion followed the story of Rukmani and this is about her sister Lakshaya.
Set in the early middle ages in India, it follows Princess Lakshaya's journey to find passion of her heart and her mind.
Stay tuned for blurb and cover reveal in a few days.
Meanwhile follow #TheEligiblePrincess on Facebook to read snippets from the book.
Good news! It's available at a discount for pre order.
Visit again…I'm going to keep this tidy and ordered.
Have shared the news on my social media and wish you all the best!


Mini CO2 Setup – Ready to go wherever you are !
Various kits available to use with any kind of setup. No need to carry bulky CO2 cylinders and regulators. Use them on the go, in parties, events or even in your home.
All Mini CO2 kits come assembled and ready to use. Regulator is easy to use, easy to carry and pressure can be adjusted by turning the knob. Includes a pack of 2 CO2 cylinders – 74 gm ea.


text:
Q: Run Hadoop Locally on Mac with Java 1.8 Trying to run single node Hadoop on Mac Sierra.
Here is my configuration:
JAVA Version https://wiki.apache.org/hadoop/HadoopJavaVersions
my-MacBook-Pro:hadoop me$ java -version
java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b17)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

HDFS-SITE
<configuration>
<property>
        <name>dfs.replication</name>
        <value>1</value>
</property>
</configuration>

CORE-SITE
<configuration>
<property>
        <name>fs.default.name</name>
        <value>hdfs://localhost:9000</value>
</property>
</configuration>

MAPRED-SITE
<configuration>
<property>
        <name>mapred.job.tracker</name>
        <value>localhost:9010</value>
</property>
</configuration>

HADOOP-ENV
export JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk1.8.0_25.jdk/Contents/Home
$ bin/hadoop  # displays the usage documentation

Here are some extra settings:
I DID NOT MAKE THIS ACTIVE, WHICH SOME INSTRUCTIONS RECOMMENDED
#export HADOOP_OPTS="-Djava.net.preferIPv4Stack=true -Dsun.security.krb5.debug=true -Dsun.security.spnego.debug"

BY DEFAULT TWO OTHER CONFIGS ALREADY ACTIVE IN HADOOP-ENV
# Some parts of the shell code may do special things dependent upon
# the operating system.  We have to set this here. See the next
# section as to why....
export HADOOP_OS_TYPE=${HADOOP_OS_TYPE:-$(uname -s)}

# Under certain conditions, Java on OS X will throw SCDynamicStore errors
# in the system logs.
# See HADOOP-8719 for more information.  If one needs Kerberos
# support on OS X, one will want to change/remove this extra bit.
case ${HADOOP_OS_TYPE} in
  Darwin*)
    export HADOOP_OPTS="${HADOOP_OPTS} -Djava.security.krb5.realm= "
    export HADOOP_OPTS="${HADOOP_OPTS} -Djava.security.krb5.kdc= "
    export HADOOP_OPTS="${HADOOP_OPTS} -Djava.security.krb5.conf= "
  ;;
esac

Here is where I formatted namenode:
NAMENODE FORMATTED
My-MacBook-Pro:3.0.0 me$ bin/hdfs namenode -format
WARNING: /usr/local/Cellar/hadoop/3.0.0/libexec/logs does not exist. Creating.

Starting namenode:
2018-04-09 17:45:15,037 INFO namenode.NameNode: STARTUP_MSG:
/************************************************************
STARTUP_MSG: Starting NameNode
STARTUP_MSG:   host = My-MacBook-Pro.local/10.5.1.16
STARTUP_MSG:   args = [-format]
STARTUP_MSG:   version = 3.0.0
STARTUP_MSG:   classpath = /usr/ …
STARTUP_MSG:   build = https://git-wip-us.apache.org/repos/asf/hadoop.git -r c25427ceca461ee979d30edd7a4b0f50718e6533; compiled by 'andrew' on 2017-12-08T19:16Z
STARTUP_MSG:   java = 1.8.0_25
************************************************************/
2018-04-09 17:45:15,060 INFO namenode.NameNode: registered UNIX signal handlers for [TERM, HUP, INT]
2018-04-09 17:45:15,076 INFO namenode.NameNode: createNameNode [-format]
2018-04-09 17:45:15,518 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
Formatting using clusterid: CID-f925aa84-648a-478b-9134-77d1766a86cb
…

Formatting:
2018-04-09 17:45:17,121 WARN namenode.NameNode: Encountered exception during format:
java.io.IOException: Cannot create directory /usr/local/Cellar/hadoop/hdfs/tmp/dfs/name/current
    at org.apache.hadoop.hdfs.server.common.Storage$StorageDirectory.clearDirectory(Storage.java:416)
    at org.apache.hadoop.hdfs.server.namenode.NNStorage.format(NNStorage.java:579)
    at org.apache.hadoop.hdfs.server.namenode.NNStorage.format(NNStorage.java:601)
    at org.apache.hadoop.hdfs.server.namenode.FSImage.format(FSImage.java:167)
    at org.apache.hadoop.hdfs.server.namenode.NameNode.format(NameNode.java:1169)
    at org.apache.hadoop.hdfs.server.namenode.NameNode.createNameNode(NameNode.java:1610)
    at org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1720)
2018-04-09 17:45:17,128 ERROR namenode.NameNode: Failed to start namenode.

Exception:
java.io.IOException: Cannot create directory /usr/local/Cellar/hadoop/hdfs/tmp/dfs/name/current
    2018-04-09 17:45:17,140 INFO namenode.NameNode: SHUTDOWN_MSG:
    /************************************************************
    SHUTDOWN_MSG: Shutting down NameNode at My-MacBook-Pro.local/10.5.1.16
    ************************************************************/

My-MacBook-Pro:3.0.0 me$ sbin/start-dfs.sh
Starting namenodes on [localhost]

Syntax errors:
localhost: /Users/me/.bashrc: line 2: syntax error near unexpected token `('
localhost: /Users/me/.bashrc: line 2: `==> Searching for a previously deleted formula (in the last month)...'
Starting datanodes
localhost: /Users/me/.bashrc: line 2: syntax error near unexpected token `('
localhost: /Users/me/.bashrc: line 2: `==> Searching for a previously deleted formula (in the last month)...'
Starting secondary namenodes [My-MacBook-Pro.local]
My-MacBook-Pro.local: Warning: Permanently added the ECDSA host key for IP address '10.5.13.173' to the list of known hosts.
My-MacBook-Pro.local: /Users/me/.bashrc: line 2: syntax error near unexpected token `('
My-MacBook-Pro.local: /Users/me/.bashrc: line 2: `==> Searching for a previously deleted formula (in the last month)...'

Warning:
2018-04-10 08:28:44,359 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java classes where applicable

JPS
My-MacBook-Pro:3.0.0 me$ jps
23201
46872 SecondaryNameNode
46730 DataNode
47039 Jps

Primarily wondering where to begin troubleshooting?  That last warning looks problematic.  And I do not get anything at http://localhost:9000/, http://localhost:9010/, http://localhost:9870/