Mastering Python Forensics Master The Art Of

Digital Forensics And Analysis With Python 1st

Edition Michael Spreitzenbarth download

https://ebookbell.com/product/mastering-python-forensics-master-
the-art-of-digital-forensics-and-analysis-with-python-1st-
edition-michael-spreitzenbarth-50195232

Explore and download more ebooks at ebookbell.com

Here are some recommended products that we believe you will be
interested in. You can click the link to download.

Mastering Python Forensics Master The Art Of Digital Forensics And

Analysis With Python Dr Michael Spreitzenbarth

https://ebookbell.com/product/mastering-python-forensics-master-the-
art-of-digital-forensics-and-analysis-with-python-dr-michael-
spreitzenbarth-5470872

Mastering Python Scripting For System Administrators Ganesh Sanjiv

Naik

https://ebookbell.com/product/mastering-python-scripting-for-system-
administrators-ganesh-sanjiv-naik-46242670

Mastering Python Networking Utilize Python Packages And Frameworks For

Network Automation Monitoring Cloud 4th Edition 4th Eric Chou

https://ebookbell.com/product/mastering-python-networking-utilize-
python-packages-and-frameworks-for-network-automation-monitoring-
cloud-4th-edition-4th-eric-chou-47552224

Mastering Python Rick Van Hattem Igor Milovanovi

https://ebookbell.com/product/mastering-python-rick-van-hattem-igor-
milovanovi-49052754
Mastering Python Design Patterns 1st Edition Sakis Kasampalis

https://ebookbell.com/product/mastering-python-design-patterns-1st-
edition-sakis-kasampalis-50950844

Mastering Python 50 Specific Tips For Writing Better Code Practical

Strategies For Writing Highquality Python Code Dane Olsen

https://ebookbell.com/product/mastering-python-50-specific-tips-for-
writing-better-code-practical-strategies-for-writing-highquality-
python-code-dane-olsen-53193304

Mastering Python 3 Programming Ultimate Guide To Learn Python Coding

Fundamentals And Realworld Applications Subburaj Ramasamy

https://ebookbell.com/product/mastering-python-3-programming-ultimate-
guide-to-learn-python-coding-fundamentals-and-realworld-applications-
subburaj-ramasamy-58472654

Mastering Python Design Patterns Craft Essential Python Patterns By

Following Core Design Principles 3rd Edition 3rd Edition Kamon Ayeva

https://ebookbell.com/product/mastering-python-design-patterns-craft-
essential-python-patterns-by-following-core-design-principles-3rd-
edition-3rd-edition-kamon-ayeva-58477706

Mastering Python Networking Advanced Networking With Python Chou

https://ebookbell.com/product/mastering-python-networking-advanced-
networking-with-python-chou-20640390
Table of Contents
Mastering Python Forensics
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers, and more
Why subscribe?
Free access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the example code
Errata
Piracy
Questions
1. Setting Up the Lab and Introduction to Python ctypes
Setting up the Lab
Ubuntu
Python virtual environment (virtualenv)
Introduction to Python ctypes
Working with Dynamic Link Libraries
C data types
Defining Unions and Structures
Summary
2. Forensic Algorithms
Algorithms
MD5
SHA256
SSDEEP
 Supporting the chain of custody
Creating hash sums of full disk images
Creating hash sums of directory trees
Real-world scenarios
Mobile Malware
NSRLquery
Downloading and installing nsrlsvr
Writing a client for nsrlsvr in Python
Summary
3. Using Python for Windows and Linux Forensics
Analyzing the Windows Event Log
The Windows Event Log
Interesting Events
Parsing the Event Log for IOC
The python-evtx parser
The plaso and log2timeline tools
Analyzing the Windows Registry
Windows Registry Structure
Parsing the Registry for IOC
Connected USB Devices
User histories
Startup programs
System Information
Shim Cache Parser
Implementing Linux specific checks
Checking the integrity of local user credentials
Analyzing file meta information
Understanding inode
Reading basic file metadata with Python
Evaluating POSIX ACLs with Python
Reading file capabilities with Python
Clustering file information
Creating histograms
Advanced histogram techniques
Summary
4. Using Python for Network Forensics
Using Dshell during an investigation
 Using Scapy during an investigation
Summary
5. Using Python for Virtualization Forensics
Considering virtualization as a new attack surface
Virtualization as an additional layer of abstraction
Creation of rogue machines
Cloning of systems
Searching for misuse of virtual resources
Detecting rogue network interfaces
Detecting direct hardware access
Using virtualization as a source of evidence
Creating forensic copies of RAM content
Using snapshots as disk images
Capturing network traffic
Summary
6. Using Python for Mobile Forensics
The investigative model for smartphones
Android
Manual Examination
Automated Examination with the help of ADEL
Idea behind the system
Implementation and system workflow
Working with ADEL
Movement profiles
Apple iOS
Getting the Keychain from a jailbroken iDevice
Manual Examination with libimobiledevice
Summary
7. Using Python for Memory Forensics
Understanding Volatility basics
Using Volatility on Android
LiME and the recovery image
Volatility for Android
Reconstructing data for Android
Call history
Keyboard cache
Using Volatility on Linux
 Memory acquisition
Volatility for Linux
Reconstructing data for Linux
Analyzing processes and modules
Analyzing networking information
Malware hunting with the help of YARA
Summary
Where to go from here
Index
Mastering Python Forensics
Mastering Python Forensics
Copyright © 2015 Packt Publishing All rights reserved. No part of this
book may be reproduced, stored in a retrieval system, or transmitted in
any form or by any means, without the prior written permission of the
publisher, except in the case of brief quotations embedded in critical
articles or reviews.

Every effort has been made in the preparation of this book to ensure the
accuracy of the information presented. However, the information
contained in this book is sold without warranty, either express or implied.
Neither the authors, nor Packt Publishing, and its dealers and distributors
will be held liable for any damages caused or alleged to be caused
directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about

all of the companies and products mentioned in this book by the
appropriate use of capitals. However, Packt Publishing cannot guarantee
the accuracy of this information.

First published: October 2015

Production reference: 1261015

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street Birmingham B3 2PB, UK.

ISBN 978-1-78398-804-4

www.packtpub.com
Credits
Authors

Dr. Michael Spreitzenbarth

Dr. Johann Uhrmann

Reviewers

Richard Marsden

Puneet Narula

Yves Vandermeer

Commissioning Editor

Kartikey Pandey

Acquisition Editor

Sonali Vernekar

Content Development Editor

Shweta Pant

Technical Editor

Pranil Pathare

Copy Editor

Vibha Shukla

Project Coordinator

Shipra Chawhan
Proofreader

Safis Editing

Indexer

Mariammal Chettiyar

Production Coordinator

Arvindkumar Gupta

Cover Work

Arvindkumar Gupta
About the Authors
Dr. Michael Spreitzenbarth holds a degree of doctor of engineering in IT
security from the University of Erlangen-Nuremberg and is a CISSP as
well as a GMOB. He has been an IT security consultant at a worldwide
operating CERT for more than three years and has worked as a
freelancer in the field of mobile phone forensics, malware analysis, and
IT security consultancy for more than six years. Since the last four years,
he has been giving talks and lectures in the fields of forensics and mobile
security at various universities and in the private sector.

I would like to thank everyone who has encouraged me while writing

this book, especially my wife for her great support. I would also like to
thank all the authors of the used open source tools— without your
help, this book wouldn't have been possible.

Dr. Johann Uhrmann holds a degree in computer science from the

University of Applied Sciences Landshut and a doctor of engineering
from the University of the German Federal Armed Forces. He has more
than ten years of experience in software development, which includes
working for start-ups, institutional research, and corporate environment.
Johann has several years of experience in incident handling and IT
governance, focusing on Linux and Cloud environments.

First of all, I would like to thank my wife, Daniela, for her moral
support and willingness to give up on some family time while I was
writing. I also would like to thank my coauthor and colleague, Dr.
Michael Spreitzenbarth, for talking me into writing this book and
handling a great deal of the organizational overhead of such a
project. Furthermore, the great people working on all the open source
software projects that we used and mentioned in this book deserve
credit. You are the guys who keep the IT world spinning.
About the Reviewers
Richard Marsden has over twenty years of professional experience in
software development. After starting in the fields of geophysics and oil
exploration, he has spent the last twelve years running the Winwaed
Software Technology LLC, an independent software vendor. Winwaed
specializes in geospatial tools and applications, which include web
applications, and operates the http://www.mapping-tools.com website for
tools and add-ins for geospatial products, such as Caliper's Maptitude
and Microsoft's MapPoint.

Richard was also a technical reviewer for Python Geospatial

Development, and Python Geospatial Analysis Essentials, both written by
Erik Westra, Packt Publishing.

Puneet Narula is currently working as PPC Data Analyst with

Hostelworld.com Ltd (http://www.hostelworld.com/), Dublin, Ireland,
where he analyzes massive clickstream data from direct and affiliate
sources and provides insight to the digital marketing team. He uses
RapidMiner, R, and Python for the exploratory and predictive analysis.
His areas of expertise are programming in Python and R, machine
learning, data analysis and Tableau.

He started his career in banking and finance and then moved to the ever
growing domain of data and analytics.

He earned MSc in computing (data analytics) from Dublin Institute of

Technology, Dublin, Ireland. He has reviewed the books: Python Data
Analysis, by Ivan Idris, Packt Publishing and Python Geospatial Analysis
Essentials, by Erik Westra, Packt Publishing.

Yves Vandermeer is a police officer working for the Belgian Federal

Police. He has been involved in major investigations since 1997, where
he contributed to recovering digital evidence. Owning a MSc in computer
forensics, Yves is also a trainer on several topics such as filesystems and
network forensics for several law enforcement agencies.

Chairing the European Cybercrime Training and Education Group,

Chairing the European Cybercrime Training and Education Group,
E.C.T.E.G., since 2013, Yves supports the creation of training materials
that are focused on the understanding of the concepts applied in practical
exercises.

Using his experience, he developed forensic software tools for law

enforcement and contributed to several advisory groups related to IT
crime and IT forensics.
www.PacktPub.com
Support files, eBooks, discount offers, and more
For support files and downloads related to your book, please visit
www.PacktPub.com.

Did you know that Packt offers eBook versions of every book published,
with PDF and ePub files available? You can upgrade to the eBook
version at www.PacktPub.com and as a print book customer, you are
entitled to a discount on the eBook copy. Get in touch with us at
<[email protected]> for more details.

At www.PacktPub.com, you can also read a collection of free technical

articles, sign up for a range of free newsletters and receive exclusive
discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's

online digital book library. Here, you can search, access, and read
Packt's entire library of books.

Why subscribe?
Fully searchable across every book published by Packt
Copy and paste, print, and bookmark content
On demand and accessible via a web browser

Free access for Packt account holders

If you have an account with Packt at www.PacktPub.com, you can use
this to access PacktLib today and view 9 entirely free books. Simply use
your login credentials for immediate access.
Preface
Today, information technology is a part of almost everything that
surrounds us. These are the systems that we wear and that support us in
building and running cities, companies, our personal online shopping
tours, and our friendships. These systems are attractive to use—and
abuse. Consequently, all criminal fields such as theft, fraud, blackmailing,
and so on expanded to the IT. Nowadays, this is a multi-billion, criminal,
global shadow industry.

Can a single person spot traces of criminal or suspicious activity

conducted by a multi-billion, criminal, global shadow industry? Well,
sometimes you can. To analyze the modern crime, you do not need
magnifying glasses and lifting fingerprints off wine bottles. Instead, we
will see how to apply your Python skills to get a close look at the most
promising spots on a file system and take digital fingerprints from the
traces left behind by hackers.

As authors, we believe in the strength of examples over dusty theory.

This is why we provide samples for forensic tooling and scripts, which are
short enough to be understood by the average Python programmer, yet
usable tools and building blocks for real-world IT forensics.

Are you ready to turn suspicion into hard facts?

What this book covers
Chapter 1, Setting Up the Lab and Introduction to Python ctypes, covers
how to set up your environment to follow the examples that are provided
in this book. We will take a look at the various Python modules that
support our forensic analyses. With ctypes, we provide the means to go
beyond Python modules and leverage the capabilities of native system
libraries.

Chapter 2, Forensic Algorithms, provides you with the digital equivalent

of taking fingerprints. Just like in the case of classic fingerprints, we will
show you how to compare the digital fingerprints with a huge registry of
the known good and bad samples. This will support you in focusing your
analysis and providing a proof of forensical soundness.

Chapter 3, Using Python for Windows and Linux Forensics, is the first
step on your journey to understanding digital evidence. We will provide
examples to detect signs of compromise on Windows and Linux systems.
We will conclude the chapter with an example on how to use machine
learning algorithms in the forensic analysis.

Chapter 4, Using Python for Network Forensics, is all about capturing

and analyzing network traffic. With the provided tools, you can search
and analyze the network traffic for signs of exfiltration or signature of
malware communication.

Chapter 5, Using Python for Virtualization Forensics, explains how

modern virtualization concepts can be used by the attacker and forensic
analyst. Consequently, we will show how to find traces of malicious
behavior on the hypervisor level and utilize the virtualization layer as a
reliable source of forensic data.

Chapter 6, Using Python for Mobile Forensics, will give you an insight on
how to retrieve and analyze forensic data from mobile devices. The
examples will include analyzing Android devices as well as Apple iOS
devices.
Chapter 7, Using Python for Memory Forensics, demonstrates how to
retrieve memory snapshots and analyze these RAM images forensically
with Linux and Android. With the help of tools such as LiME and Volatility,
we will demonstrate how to extract information from the system memory.
What you need for this book
All you need for this book is a Linux workstation with a Python 2.7
environment and a working Internet connection. Chapter 1, Setting Up
the Lab and Introduction to Python ctypes, will guide you through the
installation of the additional Python modules and tools. All of our used
tools are freely available from the Internet. The source code of our
samples is available from Packt Publishing.

To follow the examples of Chapter 5, Using Python for Virtualization

Forensics, you may want to set up a virtualization environment with
VMware vSphere. The required software is available from VMware as
time-limited trial version without any functional constraints.

While not strictly required, we recommend trying some of the examples of

Chapter 6, Using Python for Mobile Forensics, on discarded mobile
devices. For your first experiments, please refrain from using personal or
business phones that are actually in use.
Who this book is for
This book is for IT administrators, IT operations, and analysts who want
to gain profound skills in the collection and analysis of digital evidence. If
you are already a forensic expert, this book will help you to expand your
knowledge in new areas such as virtualization or mobile devices.

To get the most out of this book, you should have decent skills in Python
and understand at least some inner workings of your forensic targets. For
example, some file system details.
Conventions
In this book, you will find a number of text styles that distinguish between
different kinds of information. Here are some examples of these styles
and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file
extensions, pathnames, dummy URLs, user input, and Twitter handles
are shown as follows: "Note that in the case of Windows, msvcrt is the
MS standard C library containing most of the standard C functions and
uses the cdecl calling convention (on Linux systems, the similar library
would be libc.so.6)."

A block of code is set as follows:

def multi_hash(filename):
"""Calculates the md5 and sha256 hashes
of the specified file and returns a list
containing the hash sums as hex strings."""

When we wish to draw your attention to a particular part of a code block,

the relevant lines or items are set in bold:

<Event
xmlns="http://schemas.microsoft.com/win/2004/08/events
/event"><System><Provider Name="Microsoft-Windows-
Security-Auditing" Guid="54849625-5478-4994-a5ba-
3e3b0328c30d"></Provider>
<EventID Qualifiers="">4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>

Any command-line input or output is written as follows:

user@lab:~$ virtualenv labenv

New python executable in labenv/bin/python
Installing setuptools, pip...done.
New terms and important words are shown in bold. Words that you see
on the screen, for example, in menus or dialog boxes, appear in the text
like this: "When asked to Select System Logs, ensure that all log types
are selected."

Note
Warnings or important notes appear in a box like this.

Tip
Tips and tricks appear like this.
Reader feedback
Feedback from our readers is always welcome. Let us know what you
think about this book—what you liked or disliked. Reader feedback is
important for us as it helps us develop titles that you will really get the
most out of.

To send us general feedback, simply e-mail <[email protected]>,

and mention the book's title in the subject of your message.

If there is a topic that you have expertise in and you are interested in
either writing or contributing to a book, see our author guide at
www.packtpub.com/authors.
Customer support
Now that you are the proud owner of a Packt book, we have a number of
things to help you to get the most from your purchase.

Downloading the example code

You can download the example code files from your account at
http://www.packtpub.com for all the Packt Publishing books you have
purchased. If you purchased this book elsewhere, you can visit
http://www.packtpub.com/support and register to have the files emailed
directly to you.

Errata
Although we have taken every care to ensure the accuracy of our
content, mistakes do happen. If you find a mistake in one of our books—
maybe a mistake in the text or the code—we would be grateful if you
could report this to us. By doing so, you can save other readers from
frustration and help us improve subsequent versions of this book. If you
find any errata, please report them by visiting
http://www.packtpub.com/submit-errata, selecting your book, clicking on
the Errata Submission Form link, and entering the details of your errata.
Once your errata are verified, your submission will be accepted and the
errata will be uploaded to our website or added to any list of existing
errata under the Errata section of that title.

To view the previously submitted errata, go to

https://www.packtpub.com/books/content/support and enter the name of
the book in the search field. The required information will appear under
the Errata section.

Piracy
Piracy of copyrighted material on the Internet is an ongoing problem
across all media. At Packt, we take the protection of our copyright and
across all media. At Packt, we take the protection of our copyright and
licenses very seriously. If you come across any illegal copies of our
works in any form on the Internet, please provide us with the location
address or website name immediately so that we can pursue a remedy.

Please contact us at <[email protected]> with a link to the

suspected pirated material.

We appreciate your help in protecting our authors and our ability to bring
you valuable content.

Questions
If you have a problem with any aspect of this book, you can contact us at
<[email protected]>, and we will do our best to address the
problem.
Chapter 1. Setting Up the Lab and
Introduction to Python ctypes
Cyber Security and Digital Forensics are two topics of increasing
importance. Digital forensics especially, is getting more and more
important, not only during law enforcement investigations, but also in the
field of incident response. During all of the previously mentioned
investigations, it's fundamental to get to know the root cause of a security
breach, malfunction of a system, or a crime. Digital forensics plays a
major role in overcoming these challenges.

In this book, we will teach you how to build your own lab and perform
profound digital forensic investigations, which originate from a large
range of platforms and systems, with the help of Python. We will start
with common Windows and Linux desktop machines, then move forward
to cloud and virtualization platforms, and end up with mobile phones. We
will not only show you how to examine the data at rest or in transit, but
also take a deeper look at the volatile memory.

Python provides an excellent development platform to build your own

investigative tools because of its decreased complexity, increased
efficiency, large number of third-party libraries, and it's also easy to read
and write. During the journey of reading this book, you will not only learn
how to use the most common Python libraries and extensions to analyze
the evidence, but also how to write your own scripts and helper tools to
work faster on the cases or incidents with a huge amount of evidence
that has to be analyzed.

Let's begin our journey of mastering Python forensics by setting up our

lab environment, followed by a brief introduction of the Python ctypes.

If you have already worked with Python ctypes and have a working lab
environment, feel free to skip the first chapter and start directly with one
of the other chapters. After the first chapter, the other chapters are fairly
independent of each other and can be read in any order.
Setting up the Lab
As a base for our scripts and investigations, we need a comprehensive
and powerful lab environment that is able to handle a large number of
different file types and structures as well as connections to mobile
devices. To achieve this goal, we will use the latest Ubuntu LTS version
14.04.2 and install it in a virtual machine (VM). Within the following
sections, we will explain the setup of the VM and introduce Python
virtualenv, which we will use to establish our working environment.

Ubuntu
To work in a similar lab environment, we suggest you to download a copy
of the latest Ubuntu LTS Desktop Distribution from
http://www.ubuntu.com/download/desktop/, preferably the 32-bit version.
The distribution provides a simple-to-use UI and already has the Python
2.7.6 environment installed and preconfigured. Throughout the book, we
will use Python 2.7.x and not the newer 3.x versions. Several examples
and case studies in this book will rely on the tools or libraries that are
already a part of the Ubuntu distribution. When a chapter or section of the
book requires a third-party package or library, we will provide the
additional information on how to install it in the virtualenv (the setup of
this environment will be explained in the next section) or on Ubuntu in
general.

For better performance of the system, we recommend that the virtual

machine that is used for the lab has at least 4 GB of volatile memory and
about 40 GB of storage.
 Figure 1: The Atom editor

To write your first Python script, you can use a simple editor such as vi or
a powerful but cluttered IDE such as eclipse. As a really powerful
alternative, we would suggest you to use atom, a very clean but highly
customizable editor that can be freely downloaded from https://atom.io/.

Python virtual environment (virtualenv)

According to the official Python documentation, Virtual Environment is a
tool to keep the dependencies required by different projects in separate
places by creating virtual Python environments for them. It solves the
"Project X depends on version 1.x, but Project Y needs 4.x" dilemma and
keeps your global site-packages directory clean and manageable.

This is also what we will use in the following chapters to keep a common
environment for all the readers of the book and not run into any
compatibility issues. First of all, we have to install the virtualenv
package. This is done by the following command:

user@lab:~$ pip install virtualenv

We will now create a folder in the users' home directory for our virtual
Python environment. This directory will contain the executable Python
files and a copy of the pip library, which can be used to install other
packages in the environment. The name of the virtual environment (in our
case, it is called labenv) can be of your choice. Our virtual lab
environment can be created by executing the following command:

user@lab:~$ virtualenv labenv

New python executable in labenv/bin/python
Installing setuptools, pip...done.

To start working with the new lab environment, it first needs to be

activated. This can be done through:

user@lab:~$ source labenv/bin/activate

(labenv)user@lab:~$

Now, you can see that the command prompt starts with the name of the
virtual environment that we activated. From now on, any package that
you install using pip will be placed in the labenv folder, isolated from the
global Python installation in the underlying Ubuntu.

Throughout the book, we will use this virtual python environment and
install new packages and libraries in it from time to time. So, every time
you try to recap a shown example remember or challenge to change into
the labenv environment before running your scripts.

If you are done working in the virtual environment for the moment and
you want to return to your "normal" Python environment, you can
deactivate the virtual environment by executing the following command:

(labenv)user@lab:~$ deactivate
user@lab:~$

This puts you back in the system's default Python interpreter with all its
installed libraries and dependencies.

If you are using more than one virtual or physical machine for the
investigations, the virtual environments can help you to keep your
libraries and packages synced with all these workplaces. In order to
ensure that your environments are consistent, it's a good idea to "freeze"
the current state of environment packages. To do this, just run:

(labenv)user@lab:~$ pip freeze > requirenments.txt

This will create a requirements.txt file, which contains a simple list of all
the packages in the current environment and their respective versions. If
you want to now install the same packages using the same version on a
different machine, just copy the requirements.txt file to the desired
machine, create the labenv environment as described earlier and
execute the following command:

(labenv)user@lab:~$ pip install -r requirements.txt

Now, you will have consistent Python environments on all the machines
and don't need to worry about different library versions or other
dependencies.

After we have created the Ubuntu virtual machine with our dedicated lab
environment, we are nearly ready to start our first forensic analysis. But
before that, we need more knowledge of the helpful Python libraries and
backgrounds. Therefore, we will start with an introduction to the Python
ctypes in the following section.
Introduction to Python ctypes
According to the official Python documentation, ctypes is a foreign
function library that provides C compatible data types and allows calling
functions in DLLs or shared libraries. A foreign function library means that
the Python code can call C functions using only Python, without requiring
special or custom-made extensions.

This module is one of the most powerful libraries available to the Python
developer. The ctypes library enables you to not only call functions in
dynamically linked libraries (as described earlier), but can also be used
for low-level memory manipulation. It is important that you understand the
basics of how to use the ctypes library as it will be used for many
examples and real-world cases throughout the book.

In the following sections, we will introduce some basic features of Python

ctypes and how to use them.

Working with Dynamic Link Libraries

Python ctypes export the cdll and on Windows windll or respectively
oledll objects, to load the requested dynamic link libraries. A
dynamically linked library is a compiled binary that is linked at runtime to
the executable main process. On Windows platforms, these binaries are
called Dynamic Link Libraries (DLL) and on Linux, they are called
shared objects (SO). You can load these linked libraries by accessing
them as the attributes of the cdll, windll or oledll objects. Now, we will
demonstrate a very brief example for Windows and Linux to get the
current time directly out of the time function in libc (this library defines
the system calls and other basic facilities such as open, printf, or exit).

Note that in the case of Windows, msvcrt is the MS standard C library

containing most of the standard C functions and uses the cdecl calling
convention (on Linux systems, the similar library would be libc.so.6):

C:\Users\Admin>python
 >>> from ctypes import *
>>> libc = cdll.msvcrt
>>> print libc.time(None)
1428180920

Windows appends the usual .dll file suffix automatically. On Linux, it is

required to specify the filename, including the extension, to load the
chosen library. Either the LoadLibrary() method of the DLL loaders
should be used or you should load the library by creating an instance of
CDLL by calling the constructor, as shown in the following code:

(labenv)user@lab:~$ python

>>> from ctypes import *

>>> libc = CDLL("libc.so.6")
>>> print libc.time(None)
1428180920

As shown in these two examples, it is very easy to be able to call to a

dynamic library and use a function that is exported. You will be using this
technique many times throughout the book, so it is important that you
understand how it works.

C data types
When looking at the two examples from the earlier section in detail, you
can see that we use None as one of the parameters for a dynamically
linked C library. This is possible because None, integers, longs, byte
strings, and unicode strings are the native Python objects that can be
directly used as the parameters in these function calls. None is passed as
a C, NULL pointer, byte strings, and unicode strings are passed as
pointers to the memory block that contains their data (char * or wchar_t
*). Python integers and Python longs are passed as the platform's
default C int type, their value is masked to fit into the C type. A complete
overview of the Python types and their corresponding ctype types can be
seen in Table 1:
ctypes type C type

c_bool _Bool
(https://docs.python.org/2/library/ctypes.html#ctypes.c_bool)

c_char char
(https://docs.python.org/2/library/ctypes.html#ctypes.c_char)

c_wchar wchar_t
(https://docs.python.org/2/library/ctypes.html#ctypes.c_wchar)

c_byte char
(https://docs.python.org/2/library/ctypes.html#ctypes.c_byte)

c_ubyte unsigned
(https://docs.python.org/2/library/ctypes.html#ctypes.c_ubyte) char

c_short short
(https://docs.python.org/2/library/ctypes.html#ctypes.c_short)

c_ushort unsigned
(https://docs.python.org/2/library/ctypes.html#ctypes.c_ushort) short

c_int (https://docs.python.org/2/library/ctypes.html#ctypes.c_int) int

c_uint (https://docs.python.org/2/library/ctypes.html#ctypes.c_uint) unsigned
int

c_long long
(https://docs.python.org/2/library/ctypes.html#ctypes.c_long)

c_ulong unsigned
(https://docs.python.org/2/library/ctypes.html#ctypes.c_ulong) long

c_longlong __int64 or
(https://docs.python.org/2/library/ctypes.html#ctypes.c_longlong) long long

c_ulonglong unsigned
(https://docs.python.org/2/library/ctypes.html#ctypes.c_ulonglong) __int64 or
unsigned
long long

c_float float
(https://docs.python.org/2/library/ctypes.html#ctypes.c_float)

c_double double
(https://docs.python.org/2/library/ctypes.html#ctypes.c_double)

c_longdouble long
(https://docs.python.org/2/library/ctypes.html#ctypes.c_longdouble) double

c_char_p char *
(https://docs.python.org/2/library/ctypes.html#ctypes.c_char_p) (NUL
terminated)
 terminated)

c_wchar_p wchar_t *
(NUL
(https://docs.python.org/2/library/ctypes.html#ctypes.c_wchar_p) terminated)

c_void_p void *
(https://docs.python.org/2/library/ctypes.html#ctypes.c_void_p)

Table 1: Fundamental Data Types

This table is very helpful because all the Python types except integers,
strings, and unicode strings have to be wrapped in their corresponding
ctypes type so that they can be converted to the required C data type in
the linked library and not throw the TypeError exceptions, as shown in the
following code:

(labenv)user@lab:~$ python

>>> from ctypes import *

>>> libc = CDLL("libc.so.6")
>>> printf = libc.printf

>>> printf("An int %d, a double %f\n", 4711, 47.11)

Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ctypes.ArgumentError: argument 3: <type
'exceptions.TypeError'>: Don't know how to convert
parameter 3

>>> printf("An int %d, a double %f\n", 4711,

c_double(47.11))
An int 4711, a double 47.110000

Defining Unions and Structures

Unions and Structures are important data types because they are
frequently used throughout the libc on Linux and also in the Microsoft
Win32 API.

Unions are simply a group of variables, which can be of the same or

different data types, where all of its members share the same memory
location. By storing variables in this way, unions allow you to specify the
same value in different types. For the upcoming example, we will change
from the interactive Python shell to the atom editor on our Ubuntu lab
environment. You just need to open atom editor, type in the following
code, and save it under the name new_evidence.py:

from ctypes import

class case(Union):
fields = [
("evidence_int", c_int),
("evidence_long", c_long),
("evidence_char", c_char 4)
]

value = raw_input("Enter new evidence number:")

new_evidence = case(int(value))
print "Evidence number as a int: %i" %
new_evidence.evidence_int
print "Evidence number as a long: %ld" %
new_evidence.evidence_long
print "Evidence number as a char: %s" %
new_evidence.evidence_char

If you assign the evidence union's member variable evidence_int a value

of 42, you can then use the evidence_char member to display the
character representation of that number, as shown in the following
example:

(labenv)user@lab:~$ python new_evidence.py

Enter new evidence number:42

Evidence number as a long: 42

Evidence number as a int: 42
Evidence number as a char: *
As you can see in the preceding example, by assigning the union a single
value, you get three different representations of that value. For int and
long, the displayed output is obvious but for the evidence_char variable, it
could be a bit confusing. In this case, '*' is the ASCII character with the
value of the equivalent of decimal 42. The evidence_char member
variable is a good example of how to define an array in ctypes. In ctypes,
an array is defined by multiplying a type by the number of elements that
you want to allocate in the array. In this example, a four-element
character array was defined for the member variable evidence_char.

A structure is very similar to unions, but the members do not share the
same memory location. You can access any of the member variables in
the structure using dot notation, such as case.name. This would access
the name variable contained in the case structure. The following is a very
brief example of how to create a structure (or struct, as they are often
called) with three members: name, number, and investigator_name so that
all can be accessed by the dot notation:

from ctypes import

class case(Structure):
fields = [
("name", c_char 16),
("number", c_int),
("investigator_name", c_char * 8)
]

Tip
Downloading the example code

You can download the example code files from your account at
http://www.packtpub.com for all the Packt Publishing books you have
purchased. If you purchased this book elsewhere, you can visit
http://www.packtpub.com/support and register to have the files e-
mailed directly to you.
Summary
In the first chapter, we created our lab environment: a virtual machine
running Ubuntu 14.04.2 LTS. This step is really important as you can
now create snapshots before working on real evidence and are able to
roll back to a clean machine state after finishing the investigation. This
can be helpful, especially, when working with compromised system
backups, where you want to be sure that your system is clean when
working on a different case afterwards.

In the second part of this chapter, we demonstrated how to work with

Python's virtual environments (virtualenv) that will be used and
extended throughout the book.

In the last section of this chapter, we introduced the Python ctypes to

you, which is a very powerful library available to the Python developer.
With those ctypes, you are not only able to call functions in the
dynamically linked libraries (available Microsoft Win32 APIs or common
Linux shared objects), but they can also be used for low-level memory
manipulation.

After completing this chapter, you will have a basic environment created
to be used for the rest of the book, and you will also understand the
fundamentals of Python ctypes that will be helpful in some of the
following chapters.
Chapter 2. Forensic Algorithms
Forensic algorithms are the building blocks for a forensic investigator.
Independent from any specific implementation, these algorithms describe
the details of the forensic procedures. In the first section of this chapter,
we will introduce the different algorithms that are used in forensic
investigations, including their advantages and disadvantages.

Algorithms
In this section, we describe the main differences between MD5, SHA256,
and SSDEEP—the most common algorithms used in the forensic
investigations. We will explain the use cases as well as the limitations
and threats behind these three algorithms. This should help you
understand why using SHA256 is better than using MD5 and in which
cases SSDEEP can help you in the investigation.

Before we dive into the different hash functions, we will give a short
summary of what a cryptographic hash function is.

A hash function is a function that maps an arbitrarily large amount of

data to a value of a fixed length. The hash function ensures that the
same input always results in the same output, called the hash sum.
Consequently, a hash sum is a characteristic of a specific piece of data.

A cryptographic hash function is a hash function that is considered

practically impossible to invert. This means that it is not possible to create
the input data while having a pre-defined hash sum value by any other
means than trying all the possible input values, that is brute force.
Therefore, this class of algorithms is known as one-way cryptographic
algorithm.

The ideal cryptographic hash function has four main properties, as

follows:

1. It must be easy to compute the hash value for any given input.
 2. It must be infeasible to generate the original input from its hash.
3. It must be infeasible to modify the input without changing the hash.
4. It must be infeasible to find two different inputs with the same hash
(collision-resistant).

In the ideal case, if you create a hash of the given input and change only
one bit of this input, the newly calculated hash will look totally different,
as follows:

user@lab:~$ echo -n This is a test message | md5sum

fafb00f5732ab283681e124bf8747ed1

user@lab:~$ echo -n This is A test message | md5sum

aafb38820e0a3788eb41e9f5805e088e

If all of the previously mentioned properties are fulfilled, the algorithm is a

cryptographically correct hash function and can be used to compare, for
example, files with each other to prove that they haven't been tampered
with during analysis or by an attacker.

MD5
The MD5 message-digest algorithm was the most commonly used (and
is still a widely used) cryptographic hash function that produces a 128-bit
(16-byte) hash value, typically expressed in the text format as a 32-digit
hexadecimal number (as shown in the previous example). This message
digest has been utilized in a wide variety of cryptographic applications
and is commonly used to verify data integrity in forensic investigations.
This algorithm was designed by Ronald Rivest in 1991 and has been
heavily used since then.

A big advantage of MD5 is that it calculates faster and produces small

hashes. The small hashes are a major point of interest when you need to
store thousands of these hashes in a forensic investigation. Just imagine
how many files a common PC will have on its hard drive. If you need to
calculate a hash of each of these files and store them in a database, it
would make a huge difference if each of the calculated hash has 16 byte
or 32 byte of size.
Nowadays, the major disadvantage of MD5 is the fact that it is no longer
considered to be collision-resistant. This means that it is possible to
calculate the same hash from two different inputs. Keeping this in mind, it
is not possible anymore to guarantee that a file hasn't been modified just
by comparing its MD5 hash at two different stages of an investigation. At
the moment it is possible to create a collision very fast, (refer to
http://www.win.tue.nl/hashclash/On%20Collisions%20for%20MD5%20-
%20M.M.J.%20Stevens.pdf) but it is still difficult to modify a file in a way,
which is now a malicious version of that benign file, and keep the MD5
hash of the original file.

The very famous cryptographer, Bruce Schneier, once wrote that

(https://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html):

"We already knew that MD5 is a broken hash function" and that "no
one should be using MD5 anymore".

We would not go that far (especially because a lot of tools and services
still use MD5), but you should try switching to SHA256 or at least double-
check your results with the help of different hash functions in cases
where it is critical. Whenever the chain of custody is crucial, we
recommend using multiple hash algorithms to prove the integrity of your
data.

SHA256
SHA-2 is a set of cryptographic hash functions designed by the NSA
(U.S. National Security Agency) and stands for Secure Hash Algorithm
2nd Generation. It has been published in 2001 by the NIST as a U.S.
federal standard (FIPS). The SHA-2 family consists of several hash
functions with digests (hash values) that are between 224 bits and 512
bits. The cryptographic functions SHA256 and SHA512 are the most
common versions of SHA-2 hash functions computed with 32-bit and 64-
bit words.

Despite the fact that these algorithms calculate slower and that the
calculated hashes are larger in size (compared to MD5), they should be
the preferred algorithms that are used for integrity checks during the
the preferred algorithms that are used for integrity checks during the
forensic investigations. Nowadays, SHA256 is a widely used
cryptographic hash function that is still collision-resistant and entirely
trustworthy.

SSDEEP
The biggest difference between MD5, SHA256, and SSDEEP is the fact
that SSDEEP is not considered to be a cryptographic hash function as
it only changes slightly when the input is changed by one bit. For
example:

user@lab:~$ echo -n This is a test message | ssdeep

ssdeep,1.1--blocksize:hash:hash,filename
3:hMCEpFzA:hurs,"stdin"

user@lab:~$ echo -n This is A test message | ssdeep

ssdeep,1.1--blocksize:hash:hash,filename
3:hMCkrzA:hOrs,"stdin"

The SSDEEP packages can be downloaded and installed as described in

the following URL: http://ssdeep.sourceforge.net/usage.html#install

This behavior is not a weakness of SSDEEP, it is a major advantage of

this function. In reality, SSDEEP is a program to compute and match the
Context Triggered Piecewise Hashing (CTPH) values. CTPH is a
technique that is also known as Fuzzy Hashing and is able to match
inputs that have homologies. Inputs with homologies have sequences of
identical bytes in a given order with totally different bytes in between.
These bytes in between can differ in content and length. CTPH, originally
based on the work of Dr. Andrew Tridgell, was adapted by Jesse
Kornblum and published at the DFRWS conference in 2006 in a paper
called Identifying Almost Identical Files Using Context Triggered
Piecewise Hashing; refer to http://dfrws.org/2006/proceedings/12-
Kornblum.pdf.

SSDEEP can be used to check how similar the two files are and in which
part of the file the difference is located. This feature is often used to
check if two different applications on the mobile devices have a common
code base, as shown in the following:

user@lab:~$ ssdeep -b malware-sample01.apk >

signature.txt

user@lab:~$ cat signature.txt

Ssdeep,1.1--blocksize:hash:hash,filename
49152:FTqSf4xGvFowvJxThCwSoVpzPb03++4zlpBFrnInZWk:JqSU
4ldVVpDIcz3BFr8Z7,"malware-sample01.apk"

user@lab:~$ ssdeep –mb signature.txt malware-

sample02.apk
malware-sample02.apk matches malware-sample01.apk (75)

In the previous example, you can see that the second sample matches
the first one with a very high likelihood. These matches indicate the
potential source code reuse or at least a large number of files inside the
apk file are identical. A manual examination of the files in question is
required to tell exactly which parts of the code or files are identical;
however, we now know that both the files are similar to each other.
Supporting the chain of custody
The outcomes of forensic investigations can have a severe impact on
organizations and individuals. Depending on your field of work, your
investigation can become evidence in the court.

Consequently, the integrity of forensic evidence has to be ensured not

just when collecting the evidence, but also throughout the entire handling
and analysis. Usually, the very first step in a forensic investigation is
gathering the evidence. Normally, this is done using a bitwise copy of the
original media. All the subsequent analysis is performed on this forensic
copy.

Creating hash sums of full disk images

To ensure that a forensic copy is actually identical to the original media,
hash sums of the media and from the forensic copy are made. These
hash sums must match to prove that the copy is exactly like the original
data. Nowadays, it has become common to use at least two different
cryptographic hash algorithms to minimize the risk of hash collisions and
harden the overall process against hash collision attacks.

With Linux, one can easily create MD5 and SHA256 hashes from a drive
or multiple files. In the following example, we will calculate MD5 sums
and SHA256 sums for two files to provide a proof of identical content:

user@lab:~$ md5sum pathto/originalfile

pathto/forensic_copy_of_sdb.img

user@lab:~$ sha256sum pathto/originalfile

pathto/forensic_copy_of_sdb.img

This proof of identical content is required to support the chain of custody,

that is, to show that the analyzed data is identical to the raw data on the
disk. The term sdb refers to a drive attached to the forensic workstation
(in Linux, the second hard drive is called sdb). To further support the
chain of custody, it is highly recommended to use a write-block device
between the evidence and forensic workstation to avoid any accidental
change of the evidence. The second argument represents the location of
a bitwise copy of the evidence. The commands output the hash sums for
the original drive and the copy. The copy can be considered forensically
sound if both the MD5 sums match and both the SHA256 sums match.

While the method shown in the previous example works, it has a big
disadvantage, the evidence and its copy have to be read twice to
calculate the hash sums. If the disk is a 1 TB hard drive, it can slow down
the overall process by several hours.

The following Python code reads the data only once and feeds it into two
hash calculations. Therefore, this Python script is almost twice as fast as
running md5sum followed by sha256sum and produces exactly the same
hash sums as these tools:

#!/usrbinenv python

import hashlib
import sys

def multi_hash(filename):
"""Calculates the md5 and sha256 hashes
of the specified file and returns a list
containing the hash sums as hex strings."""

md5 = hashlib.md5()
sha256 = hashlib.sha256()

with open(filename, 'rb') as f:

while True:
buf = f.read(2**20)
if not buf:
break
md5.update(buf)
sha256.update(buf)

return [md5.hexdigest(), sha256.hexdigest()]

if __name__ == '__main__':
hashes = []
print '---------- MD5 sums ----------'
 for filename in sys.argv[1:]:
h = multi_hash(filename)
hashes.append(h)
print '%s %s' % (h[0], filename)

print '---------- SHA256 sums ----------'

for i in range(len(hashes)):
print '%s %s' % (hashes[i][1], sys.argv[i+1])

In the following call of the script, we calculate the hash sums of some of
the common Linux tools:

user@lab:~$ python multihash.py bin{bash,ls,sh}

---------- MD5 sums ----------
d79a947d06958e7826d15a5c78bfaa05 binbash
fa97c59cc414e42d4e0e853ddf5b4745 binls
c01bc66da867d3e840814ec96a137aef binsh
---------- SHA256 sums ----------
cdbcb2ef76ae464ed0b22be346977355c650c5ccf61fef638308b8
da60780bdd binbash
846ac0d6c40d942300de825dbb5d517130d8a0803d22115561dcd8
5efee9c26b binls
e9a7e1fd86f5aadc23c459cb05067f49cd43038f06da0c1d9f67fb
cd627d622c binsh

It is crucial to document the hash sums of the original data and the
forensic copy in the forensic report. An independent party can then read
the same piece of evidence and confirm that the data that you analyzed
is exactly the data of the evidence.

Creating hash sums of directory trees

Once the full image is copied, its contents should be indexed and the
hash sums should be created for every file. With the support of the
previously defined multi_hash function and Python standard libraries, a
report template containing a list of all file names, sizes, and hash values
can be created, as shown in the following:

#!/usrbinenv python

from datetime import datetime

import os
from os.path import join, getsize
import sys
from multihash import multi_hash

def dir_report(base_path, reportfilename):

"""Creates a report containing file integrity
information.

base_path -- The directory with the files to index

reportfilename -- The file to write the output
to"""

with open(reportfilename, 'w') as out:

out.write("File integrity information\n\n")
out.write("Base path: %s\n" % base_path)
out.write("Report created: %s\n\n" %
datetime.now().isoformat())
out.write('"SHA-
256","MD5","FileName","FileSize"')
out.write("\n")

for root, dirs, files in os.walk(base_path):

write_dir_stats(out, root, files)

out.write("\n\n--- END OF REPORT ---\n")

def write_dir_stats(out, directory, files):

"""Writes status information on all specified
files to the report.

out -- open file handle of the report file

directory -- the currently analyzed directory
files -- list of files in that directory"""

for name in files:

fullname = join(directory, name)
hashes = multi_hash(fullname)
size = getsize(fullname)
out.write('"%s","%s","%s",%d' % (hashes[1],
hashes[0], fullname, size))
out.write("\n")

if __name__ == '__main__':
if len(sys.argv) < 3:
print "Usage: %s reportfile basepath\n" %
 sys.argv[0]
sys.exit(1)

dir_report(sys.argv[2], sys.argv[1])

This Python script is all it takes to generate the integrity information of a

directory tree that includes file sizes, file names, and hash sums
(SHA256, MD5). The following is an example call on our scripting
directory:

user@lab:/home/user/dirhash $ python dirhash.py

report.txt .
user@lab:/home/user/dirhash $ cat report.txt
File integrity information

Base path: .
Report created: 2015-08-23T21:50:45.460940

"SHA-256","MD5","FileName","FileSize"
"a14f7e644d76e2e232e94fd720d35e59707a2543f01af4123abc4
6e8c10330cd","9c0d1f70fffe5c59a7700b2b9bfd50cc","./mul
tihash.py",879
"a4168e4cc7f8db611b339f4f8a949fbb57ad893f02b9a65759c79
3d2c8b9b4aa","bcf5a41a403bb45974dd0ee331b1a0aa","./dir
hash.py",1494
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca4959
91b7852b855","d41d8cd98f00b204e9800998ecf8427e","./rep
ort.txt",0
"03047d8a202b03dfc5a310a81fd8358f37c8ba97e2fff8a0e7822
cf7f36b5c83","416699861031e0b0d7b6d24b3de946ef","./mul
tihash.pyc",1131

--- END OF REPORT ---

However, the resulting report file itself does not have any integrity
protection. It is recommended to sign the resulting report, for example,
using GnuPG, as shown in the following:

user@lab:~$ gpg --clearsign report.txt

If you have never used gpg before, you need to generate a private key
before you can sign the documents. This can be done with the gpg --
gen-key command. Consult https://www.gnupg.org/documentation for
more details about GnuPG and its use. This creates an additional
report.txt.asc file containing the original report and a digital signature.
Any subsequent modification of that file invalidates the digital signature.

Note
The techniques described here are merely the examples of how to
support the chain of custody. If the forensic analysis is to be used in
the court, it is highly recommended to seek legal advice about the
chain-of-custody requirements in your legislation.
Real-world scenarios
This section will demonstrate some use cases where the preceding
algorithms and techniques are used to support the investigator. For this
chapter, we use two very common and interesting examples, Mobile
Malware and the National Software Reference Library (NSRL).

Mobile Malware
In this example, we will check the installed applications on an Android
smartphone against an online analysis system, MobileSandbox.
MobileSandbox is a website that provides free Android files checking for
viruses or suspicious behavior, http://www.mobilesandbox.org. It is
connected to VirusTotal, which uses up to 56 different antivirus products
and scan engines to check for viruses that the user's antivirus solution
may have missed or verify against any false positives. Additionally,
MobileSandbox uses custom techniques to detect applications that act
potentially malicious. Antivirus software vendors, developers, and
researchers behind MobileSandbox can receive copies of the files to help
in improving their software and techniques.

In the example, we will use two steps to successfully compare the

installed applications with the already tested apps on the MobileSandbox
web service.

The first step is to get the hash sums of the installed applications on the
device. This is very important as these values can help to identify the
apps and check them against the online services. For this example, we
will use an application from Google Play, AppExtract
(https://play.google.com/store/apps/details?id=de.mspreitz.appextract).
The forensically more correct way of getting these values can be found in
Chapter 6, Using Python for Mobile Forensics.
AppExtract for Android generates a list of installed and running apps with
a large amount of metadata that can help in identifying unwanted or even
malicious applications. This metadata contains the SHA256 hash sum of
the application packages, an indicator whether the app has been installed
by the user or the system itself, and a lot of additional data that can help
in identifying if the app is benign or not. These lists can be transferred via
your favorite email app for further analysis. Once you receive the plain-
Random documents with unrelated
content Scribd suggests to you:
of common sense, and every principle of common honesty, every
restraint of shame, and every impulse of selfishness, is a
phenomenon not less irreconcilable to the moral state of things than
miracles are to the natural constitution of the world. Falsehood
naturally entangles men in contradiction, and confounds them with
dismay: but the love of truth invigorates the mind; the
consciousness of integrity anticipates the approbation of God; and
conscience creates a fortitude, to which mere unsupported nature is
often a stranger.
3. How long miracles were continued in the church, has been a
matter of keen dispute, and has been investigated with as much
anxiety as if the truth of the Gospel depended upon the manner in
which it was decided. Assuming, as we are here warranted to do,
that real miraculous power was conveyed in the way detailed by the
inspired writers, it is plain, that it may have been exercised in
different countries, and may have remained, without any new
communication of it, throughout the first, and a considerable part of
the second century. The Apostles, wherever they went to execute
their commission, would avail themselves of the stupendous gift
which had been imparted to them; and it is clear, not only that they
were permitted and enabled to convey it to others, but that spiritual
gifts, including the power of working miracles, were actually
conferred on many of the primitive disciples. Allusions to this we find
in the epistles of St. Paul; such allusions, too, as it is utterly
inconceivable that any man of a sound judgment could have made,
had he not known that he was referring to an obvious fact, about
which there could be no hesitation. Of the time at which several of
the Apostles died, we have no certain knowledge. St. Peter and St.
Paul suffered at Rome about A. D. 66, or 67; and it is fully
established, that the life of John was much longer protracted, he
having died a natural death, A. D. 100, or 101. Supposing that the
two former of these Apostles imparted spiritual gifts till the time of
their suffering martyrdom, the persons to whom they were imparted
might, in the course of nature, have lived through the earlier part of
the second century; and if John did the same till the end of his life,
such gifts as were derived from him might have remained till more
than the half of that century had elapsed. That such was the fact, is
asserted by ancient ecclesiastical writers. Whether, after the
generation immediately succeeding the Apostles had passed away,
the power of working miracles was anew communicated, is a
question, the solution of which cannot be nearly so satisfactory. The
probability is, that there was no such renewal; and this opinion rests
upon the ground that natural causes were now sufficient to
accomplish the end for which miracles were originally designed; and
it does not appear to have been any part of the scheme of the
blessed Author of our religion, that, solely for the purpose of
hastening that conversion of the nations which might gradually be
accomplished, miracles should be wrought, when these could be of
no use in establishing after ages in the faith.
MIRACULOUS CONCEPTION. By this is meant, that the human
nature of Jesus Christ was formed, not in the ordinary method of
generation, but out of the substance of the Virgin Mary, by the
immediate operation of the Holy Ghost. The evidence upon which
this article of the Christian faith rests is found in Matt. i, 18–23, and
in the more particular narration which St. Luke has given in the first
chapter of his Gospel. If we admit this evidence of the fact, we can
discern the emphatical meaning of the appellation given to our
Saviour when he is called the seed of the woman,” Gen. iii, 15; we
can perceive the meaning of a phrase which St. Luke has introduced
into the genealogy of Jesus, Luke iii, 23, and of which, otherwise, it
is not possible to give a good account, ων, ὡς ενομιζετο, ὑιος
Ιωσηφ; [being, as was supposed, the son of Joseph;] and we can
discover a peculiar significancy in an expression of the Apostle Paul,
Gal. iv, 4, God sent forth his Son, made of a woman.” The
conception of Jesus is the point from which we date the union
between his divine and human nature; and, this conception being
miraculous, the existence of the person in whom they are united,
was not physically derived from Adam. But, as Dr. Horsley speaks in
his sermon on the incarnation, the union with the uncreated Word is
the very principle of personality and individual existence in the son
of Mary. According to this view of the matter, the miraculous
conception gives a completeness and consistency to the revelation
concerning Jesus Christ. Not only is he the Son of God, but, as the
Son of man, he is exalted above his brethren, while he is made like
them. He is preserved from the contamination adhering to the race
whose nature he assumed; and when the only begotten Son, who is
in the bosom of the Father, was made flesh, the intercourse which,
as man, he had with God, is distinguished, not in degree only, but in
kind, from that which any prophet ever enjoyed, and it is infinitely
more intimate, because it did not consist in communications
occasionally made to him, but arose from the manner in which his
human nature had its existence.
MIRIAM, sister of Moses and Aaron, and daughter of Amram and
Jochebed, was born about A. M. 2424. She might be ten or twelve
years old when her brother Moses was exposed on the banks of the
Nile, since Miriam was watching there, and offered herself to
Pharaoh’s daughter to fetch her a nurse. The princess accepting the
offer, Miriam fetched her own mother, to whom the young Moses
was given to nurse, Exod. ii, 4, 5, &c. It is thought that Miriam
married Hur, of the tribe of Judah; but it does not appear that she
had any children by him, Exod. xvii, 10, 11. Miriam had the gift of
prophecy, as she intimates, Num. xii, 2: Hath the Lord indeed
spoken only by Moses? hath he not spoken also by us?” After the
passage of the Red Sea, Miriam led the choirs and dances of the
women, and sung with them the canticle, Sing ye to the Lord, for he
hath triumphed gloriously; the horse and his rider hath he thrown
into the sea:” while Moses led the choir of men, Exod. xv, 21. When
Zipporah, the wife of Moses, arrived in the camp of Israel, Miriam
and Aaron disputed with her, speaking against Moses on her
account, Num. xii. This conduct the Lord punished by visiting Miriam
with a leprosy. Aaron interceded with Moses for her recovery, and
besought the Lord, who ordered her to be shut out of the camp
seven days. We are acquainted with no subsequent particulars of the
life of Miriam. Her death happened in the first month of the fortieth
year after the exodus, at the encampment of Kadesh in the
wilderness of Zin, Num. xx, 1. The people mourned for her, and she
was there buried.
 MIRRORS, usually, but improperly, rendered looking glasses. The
eastern mirrors were made of polished metal, and for the most part
convex. So Callimachus describes Venus as taking the shining brass,”
that is, to adjust her hair. If they were thus made in the country of
Elihu, the image made use of by him will appear very lively: Hast
thou with him spread out the sky, which is strong, and as a molten
looking glass?” Job xxxvii, 18. Shaw informs us that “in the Levant,
looking glasses are a part of female dress. The Moorish women in
Barbary are so fond of their ornaments, and particularly of their
looking glasses, which they bang upon their breasts, that they will
not lay them aside, even when, after the drudgery of the day, they
are obliged to go two or three miles with a pitcher or a goat’s skin,
to fetch water.” The Israelitish women used to carry their mirrors
with them, even to their most solemn place of worship. The word
mirror should be used in the passages here referred to. To speak of
looking glasses made of steel,” and glasses molten,” is palpably
absurd; whereas the term mirror obviates every difficulty, and
expresses the true meaning of the original.
MISHNA, or MISNA, ‫משנה‬, signifies repetition, and is properly the
code of the Jewish civil law. The Mishna contains the text; and the
Gemara, which is the second part of the Talmud, contains the
commentaries: so that the Gemara is, as it were, a glossary on the
Mishna. The Mishna consists of various traditions of the Jews, and of
explanations of several passages of Scripture. These traditions,
serving as an explication of the written law, and supplementary to it,
are said to have been delivered to Moses during the time of his
abode upon the mount; which he afterward communicated to Aaron,
Eleazar, and his servant Joshua. By these they were transmitted to
the seventy elders; by them to the prophets, who communicated
them to the men of the great sanhedrim, from whom the wise men
of Jerusalem and Babylon received them. According to Dr. Prideaux,
they passed from Jeremiah to Baruch, from him to Ezra, and from
Ezra to the men of the great synagogue, the last of whom was
Simon the Just, who delivered them to Antigonus of Socho. From
him they came down in regular succession to Simeon, who took our
Saviour in his arms; to Gamaliel, at whose feet St. Paul was brought
up; and last of all to rabbi Judah the holy, who committed them to
writing in the Mishna. Dr. Prideaux, rejecting this Jewish fiction,
observes, that after the death of Simon the Just, about B. C. 299,
arose the Tannaim or Mishnical doctors, who by their comments and
conclusions, added to the number of those traditions which had
been received and allowed by Ezra and the men of the great
synagogue. Hence toward the middle of the second century after
Christ, under the reign of the Roman Emperor Antoninus Pius, it was
found necessary to commit these traditions to writing. This was
requisite, because the traditions had been so much increased that
they could no longer be preserved by the memory of man; and also
because their country had suffered considerably in the reign of the
Emperor Adrian, and many of their schools being dissolved, and their
learned men cut off, the usual method of preserving their traditions
had failed. Lest, therefore, the traditions should be forgotten and
lost, it was resolved that they should be collected and committed to
writing. Rabbi Judah, who was at that time rector of the school at
Tiberias in Galilee, and president of the sanhedrim at that place,
undertook the work. He compiled it in six books, each consisting of
several tracts, which altogether form the number of sixty-three. Dr.
Prideaux computes, that the Mishna was composed about A. D. 150.
Dr. Lightfoot, however, says, that rabbi Judah compiled the Mishna
about A. D. 190, in the latter end of the reign of Commodus; or, as
some compute, A. D. 220. Dr. Lardner is of opinion, that this work
could not have been finished before A. D. 190, or later. Thus the
book called the Mishna was formed; a book which was received by
the Jews with great veneration, and which has been always held in
high esteem among them. Their opinion of it is, that all the
particulars which it contains were dictated by God himself to Moses
upon Mount Sinai, as well as the written word itself; and,
consequently, that it must be of the same divine authority, and
ought to be as religiously observed. See Cabbala, Gemara, Jews.
MITE. See Money.
MITYLENE, the capital of the island of Lesbos, through which St.
Paul passed as he went from Corinth to Jerusalem, Acts xx, 14.
 MIZPAH, or MIZPEH, a city of the tribe of Benjamin, situated in a
plain, about eighteen miles west of Jerusalem. Here Samuel dwelt;
and here he called Israel together, to observe a solemn fast for their
sins, and to supplicate God for his assistance against the Philistines;
after which they sallied out on their enemies, already discomfited by
the thunders of heaven, and gave them a total defeat, 1 Sam. vii.
Here, also, Saul was anointed king, 1 Sam. x, 17–25. It appears that
between this and the time of Asa, king of Judah, Mizpah had
suffered probably in some of the intervening wars, as we are told
that Asa built it with the stones and timber of Ramah, 1 Kings xv, 22.
There was another Mizpeh in Gilead; on the spot where Jacob set up
the pillar or heap of stones, to commemorate the covenant there
made between him and Laban, Gen. xxxi, 49. (See Gilead.) There
was also a third Mizpeh, in the land of Moab, where David placed his
father and mother, while he remained in his retreat at Adullam, 1
Sam. xxii, 3. It is to be observed, that Mizpeh implies a beacon or
watch tower, a pillar or heap of commemoration; and at all the
places bearing this name, it is probable that a single pillar, or a rude
pile, was erected as the witness and the record of some particular
event. These, subsequently, became altars and places of convocation
on public occasions, religious and civil.
MIZRAIM, or MESRAIM, son of Ham, and father of Ludim,
Anamim, Lehabim, Naphtuhim, Pathrusim, and Casluhim, Gen. x, 6.
Meser or Misor was father of the Mizraim, the Egyptians; and he
himself is commonly called Mizraim, although there is very strong
probability that Mizraim, being of the plural number, signifies rather
the Egyptians themselves, than the father of that people. Mizraim is
also put for the country of Egypt: thus it has three significations,
which are perpetually confounded and used promiscuously,
sometimes denoting the land of Egypt, sometimes him who first
peopled Egypt, and sometimes the inhabitants themselves. Cairo,
the capital of Egypt, and even Egypt itself, are to this day called
Mezer by the Arabians. But the natives call Egypt Chemi, that is, the
land of Cham, or Ham, as it is also sometimes called in Scripture,
Psalm lxxviii, 12; cv, 23; cvi, 22. The Prophet Micah, vii, 15, gives to
Egypt the name of Mezor, or Matzor; and rabbi Kimchi, followed in
this by several learned commentators, explains by Egypt what is said
of the rivers of Mezor, 2 Kings xix, 24; Isaiah xix, 6; xxxvii, 25.
MOAB was the son of Lot, and of his eldest daughter, Gen. xix, 31,
&c. He was born about the same time as Isaac, A. M. 2108, and was
father of the Moabites, whose habitation lay beyond Jordan and the
Dead Sea, on both sides of the river Arnon. Their capital city was
situated on that river, and was called Ar or Areopolis, or Ariol of
Moab, or Rabbah Moab, that is, the capital of Moab, or Kir-haresh,
that is, a city with brick walls. This country was originally possessed
by a race of giants called Emim, Deut. ii, 11, 12. The Moabites
conquered them, and afterward the Amorites took a part from the
Moabites, Judges xi, 13. Moses conquered that part which belonged
to the Amorites, and gave it to the tribe of Reuben. The Moabites
were spared by Moses, for God had restricted him, Deut. ii, 9. But
there always was a great antipathy between the Moabites and the
Israelites, which occasioned many wars between them. Balaam
seduced the Hebrews to idolatry and uncleanness, by means of the
daughters of Moab, Num. xxv, 1, 2; and Balak, king of this people,
endeavoured to prevail on Balaam to curse Israel. God ordained that
the Moabites should not enter into the congregation of his people,
because they had the inhumanity to refuse the Israelites a passage
through their country, nor would they supply them with bread and
water in their necessity. Eglon, king of the Moabites, was one of the
first that oppressed Israel after the death of Joshua. Ehud killed
Eglon, and Israel expelled the Moabites, Judges iii, 12, &c. Hanun
king of the Ammonites having insulted David’s ambassadors, David
made war against him, and subdued Moab and Ammon; under which
subjection they continued till the separation of the ten tribes. The
Ammonites and the Moabites continued in subjection to the kings of
Israel to the death of Ahab. Presently after the death of Ahab the
Moabites began to revolt, 2 Kings iii, 4, 5. Mesha, king of Moab,
refused the tribute of a hundred thousand lambs, and as many rams,
which till then had been customarily paid, either yearly, or at the
beginning of every reign; which of these two is not clearly expressed
in Scripture. The reign of Ahaziah was too short to make war with
them; but Jehoram, son of Ahab, and brother to Ahaziah, having
ascended the throne, thought of reducing them to obedience. He
invited Jehoshaphat, king of Judah, who, with the king of Edom,
then his vassal, entered Moab, where they were near perishing with
thirst, but were miraculously relieved, 2 Kings iii, 16, &c.
It is not easy to ascertain what were the circumstances of the
Moabites from this time; but Isaiah, at the beginning of the reign of
King Hezekiah, threatens them with a calamity, which was to happen
three years after his prediction, and which probably referred to the
war that Shalmaneser, king of Assyria, made with the ten tribes and
the other people beyond Jordan. Amos, i, 13, &c, also foretold great
miseries to them, which, probably, they suffered under Uzziah and
Jothan, kings of Judah, or under Shalmaneser, 2 Chron. xxvi, 7, 8;
xxvii, 5; or, lastly, in the war of Nebuchadnezzar, five years after the
destruction of Jerusalem. This prince carried them captive beyond
the Euphrates, as the prophets had threatened, Jer. ix, 26; xii, 14,
15; xxv, 11, 12; xlviii, 47, &c; xlix, 3, 6, 39; l, 16; and Cyrus sent
them home again, as he did the rest of the captives. After their
return from captivity they multiplied, and fortified themselves, as the
Jews did, and other neighbouring people, still in subjection to the
kings of Persia. They were afterward conquered by Alexander the
Great, and were in obedience to the kings of Syria and Egypt
successively, and finally to the Romans. There is a probability, also,
that in the later times of the Jewish republic they obeyed the
Asmonean kings, and afterward Herod the Great. The principal
deities of the Moabites were Chemosh and Baal-peor.
The prophecies concerning Moab are numerous and remarkable.
There are, says Keith, abundant predictions which refer so clearly to
its modern state, that there is scarcely a single feature peculiar to
the land of Moab, as it now exists, which was not marked by the
prophets in their delineation of the low condition to which, from the
height of its wickedness and haughtiness, it was finally to be
brought down.
The land of Moab lay to the east and south-east of Judea, and
bordered on the east, north-east, and partly on the south of the
Dead Sea. Its early history is nearly analogous to that of Ammon;
and the soil, though perhaps more diversified, is, in many places
where the desert and plains of salt have not encroached on its
borders, of equal fertility. There are manifest and abundant vestiges
of its ancient greatness: the whole of the plains are covered with the
sites of towns, on every eminence or spot convenient for the
construction of one; and as the land is capable of rich cultivation,
there can be no doubt that the country now so deserted once
presented a continued picture of plenty and fertility. The form of
fields is still visible; and there are the remains of Roman highways,
which in some places are completely paved, and on which there are
mile stones of the times of Trajan, Marcus Aurelius, and Severus,
with the number of the miles legible upon them. Wherever any spot
is cultivated the corn is luxuriant; and the riches of the soil cannot
perhaps be more clearly illustrated than by the fact, that one grain
of Heshbon wheat exceeds in dimensions two of the ordinary sort,
and more than double the number of grains grow on the stalk. The
frequency, and almost, in many instances, the close vicinity of the
sites of the ancient towns, prove that the population of the country
was formerly proportioned to its natural fertility. Such evidence may
surely suffice to prove that the country was well cultivated and
peopled at a period so long posterior to the date of the predictions,
that no cause less than supernatural could have existed at the time
when they were delivered, which could have authorized the
assertion with the least probability or apparent possibility of its truth,
that Moab would ever have been reduced to that state of great and
permanent desolation in which it has continued for so many ages,
and which vindicates and ratifies to this hour the truth of the
Scriptural prophecies. The cities of Moab were to be desolate
without any to dwell therein;” no city was to escape: Moab was to
flee away.” And the cities of Moab have all disappeared. Their place,
together with the adjoining part of Idumea, is characterized, in the
map of Volney’s Travels, by the ruins of towns. His information
respecting these ruins was derived from some of the wandering
Arabs; and its accuracy has been fully corroborated by the testimony
of different European travellers of high respectability and undoubted
veracity, who have since visited this devastated region. The whole
country abounds with ruins; and Burckhardt, who encountered many
difficulties in so desolate and dangerous a land, thus records the
brief history of a few of them: The ruins of Eleale, Heshbon, Meon,
Medaba, Dibon, Aroer, still subsist to illustrate the history of the Beni
Israel.” And it might with equal truth have been added, that they still
subsist to confirm the inspiration of the Jewish Scriptures, or to
prove that the seers of Israel were the prophets of God; for the
desolation of each of these very cities was a theme of a prediction.
Every thing worthy of observation respecting them has been
detailed, not only in Burckhardt’s Travels in Syria,” but also by
Seetzen, and, more recently, by Captains Irby and Mangles, who,
along with Mr. Bankes and Mr. Leigh, visited this deserted district.
The predicted judgment has fallen with such truth upon these cities,
and upon all the cities of the land of Moab far and near, and they are
so utterly broken down,” that even the prying curiosity of such
indefatigable travellers could discover among a multiplicity of ruins
only a few remains so entire as to be worthy of particular notice.
The subjoined description is drawn from their united testimony:
Among the ruins of El Aal (Eleale) are a number of large cisterns,
fragments of buildings, and foundations of houses. At Heshban,
(Heshbon,) are the ruins of a large ancient town, together with the
remains of a temple, and some edifices. A few broken shafts of
columns are still standing; and there are a number of deep wells cut
in the rock. The ruins of Medeba are about two miles in
circumference. There are many remains of the walls of private
houses constructed with blocks of silex, but not a single edifice is
standing. The chief object of interest is an immense tank or cistern
of hewn stones, which, as there is no stream at Medeba,” Burckhardt
remarks, might still be of use to the Bedouins, were the surrounding
ground cleared of the rubbish to allow the water to flow into it; but
such an undertaking is far beyond the views of the wandering
Arabs.” There is also the foundation of a temple built with large
stones, and apparently of great antiquity, with two columns near it.
The ruins of Diban, (Dibon,) situated in the midst of a fine plain, are
of considerable extent, but present nothing of interest. The
neighbouring hot wells, and the similarity of the name, identify the
ruins of Myoun with Meon, or Beth Meon of Scripture. Of this ancient
city, as well as of Araayr, (Areor,) nothing is now remarkable but
what is common to them with all the cities of Moab, their entire
desolation. The extent of the ruins of Rabba, (Rabbath Moab,)
formerly the residence of the kings of Moab, sufficiently proves its
ancient importance; though no other object can be particularized
among the ruins, than the remains of a palace or temple, some of
the walls of which are still standing, a gate belonging to another
building, and an insulated altar. There are many remains of private
buildings, but none of them is entire. There being no springs on the
spot, the town had two birkets, the largest of which is cut entirely
out of the rocky ground, together with many cisterns. Mount Nebo
was completely barren when Burckhardt passed over it, and the site
of the ancient city had not been ascertained. Nebo is spoiled.”
While the ruins of all these cities still retain their ancient names,
and are the most conspicuous amidst the wide scene of general
desolation, and while each of them was in like manner particularized
in the visions of the prophet, they yet formed but a small number of
the cities of Moab; and the rest are also, in similar verification of the
prophecies, desolate, without any to dwell therein.” None of the
ancient cities of Moab now remain as tenanted by men. Kerek, which
neither bears any resemblance in name to any of the cities of Moab
which are mentioned as existing in the time of the Israelites, nor
possesses any monuments which denote a very remote antiquity, is
the only nominal town in the whole country, and, in the words of
Seetzen, who visited it, in its present ruined state it can only be
called a hamlet; and the houses have only one floor.” But the most
populous and fertile province in Europe, especially any situated in
the interior of a country like Moab, is not covered so thickly with
towns as Moab is plentiful in ruins, deserted and desolate though
now it be. Burckhardt enumerates about fifty ruined sites within its
boundaries, many of them extensive. In general they are a broken
down and undistinguishable mass of ruins; and many of them have
not been closely inspected. But, in some instances, there are the
remains of temples, sepulchral monuments; the ruins of edifices
constructed of very large stones, in one of which buildings some of
the stones are twenty feet in length, and so broad that one
constitutes the thickness of the wall; traces of hanging gardens;
entire columns lying on the ground, three feet in diameter, and
fragments of smaller columns; and many cisterns out of the rock.
When the towns of Moab existed in their prime, and were at ease;
when arrogance, and haughtiness, and pride prevailed among them;
the desolation, and total desertion and abandonment of them all,
must have utterly surpassed all human conception. And that such
numerous cities which subsisted for many ages, some of them being
built on eminences, and naturally strong; others on plains, and
surrounded by the richest soil; some situated in valleys by the side
of a plentiful stream; and others where art supplied the deficiencies
of nature, and where immense cisterns were excavated out of the
rock, and which exhibit in their ruins many monuments of ancient
prosperity, and many remains easily convertible into present utility;
should have all fled away, all met the same indiscriminate fate, and
be all desolate, without any to dwell therein,” notwithstanding all
these ancient indications of permanent durability, and their existing
facilities and inducements for becoming the habitations of men, is a
matter of just wonder in the present day. They shall cry of Moab,
How is it broken down!”
The strong contrast between the ancient and the actual state of
Moab is exemplified in the condition of the inhabitants as well as of
the land; and the coincidence between the prediction and the fact is
as striking in the one case as in the other. The days come, saith the
Lord, that I will send unto him (Moab) wanderers that shall cause
him to wander, and shall empty his vessels.” The Bedouin
(wandering) Arabs are now the chief and almost the only inhabitants
of a country once studded with cities. Traversing the country, and
fixing their tents for a short time in one place, and then decamping
to another, depasturing every part successively, and despoiling the
whole land of its natural produce, they are wanderers who have
come up against it, and who keep it in a state of perpetual
desolation. They lead a wandering life; and the only regularity they
know or practise, is to act upon a systematic scheme of spoliation.
They prevent any from forming a fixed settlement who are inclined
to attempt it; for although the fruitfulness of the soil would
abundantly repay the labour of settlers, and render migration wholly
unnecessary, even if the population were increased more than
tenfold; yet the Bedouins forcibly deprive them of the means of
subsistence, compel them to search for it elsewhere, and, in the
words of the prediction, literally cause them to wander.” It may be
remarked generally of the Bedouins,” says Burckhardt, in describing
their extortions in this very country, that wherever they are the
masters of the cultivators, the latter are soon reduced to beggary by
their unceasing demands.” “O ye that dwell in Moab, leave the cities
and dwell in the rock, and be like the dove that maketh her nest in
the sides of the hole’s mouth.” In a general description of the
condition of the inhabitants of that extensive desert which now
occupies the place of these ancient flourishing states, Volney in plain
but unmeant illustration of this prediction, remarks, that the
wretched peasants live in perpetual dread of losing the fruit of their
labours; and no sooner have they gathered in their harvest, than
they hasten to secrete it in private places, and retire among the
rocks which border on the Dead Sea.” Toward the opposite extremity
of the land of Moab, and at a little distance from its borders, Seetzen
relates, that there are many families living in caverns;” and he
actually designates them the inhabitants of the rocks.” And at the
distance of a few miles from the ruined site of Heshbon, according
to Captains Irby and Mangles, there are many artificial caves in a
large range of perpendicular cliffs, in some of which are chambers
and small sleeping apartments.” While the cities are desolate,
without any to dwell therein, the rocks are tenanted. But whether
flocks lie down in the city without any to make them afraid, or
whether men are to be found dwelling in the rocks, and are “like the
dove that maketh her nest in the sides of the hole’s mouth,” the
wonderful transition, in either case, and the close accordance, in
both, of the fact to the prediction, assuredly mark it in characters
that may be visible to the purblind mind, as the word of that God
before whom the darkness of futurity is as light, and without whom
a sparrow cannot fall unto the ground.
MOLE. This word, in our version of Lev. xi, 30, answers to the
word ‫תנשמת‬, which Bochart has shown to be the cameleon; but he
conjectures, with great propriety, that ‫חלד‬, translated weasel,” in
the preceding verse, is the true word for the mole. The present
name of the mole in the east is khuld, which is undeniably the same
word as the Hebrew choled. The import of the Hebrew word is, to
creep into,” and the same Syriac word implies, to creep underneath,”
to creep into by burrowing; which are well known characteristics of
the mole.
MOLOCH, ‫מלך‬, signifies king. Moloch, Molech, Milcom, or
Melchom, was a god of the Ammonites. The word Moloch signifies
king,” and Melchom signifies their king.” Moses in several places
forbids the Israelites, under the penalty of death, to dedicate their
children to Moloch, by making them pass through the fire in honour
of that god, Lev. xviii, 21; xx, 2–5. God himself threatens to pour out
his wrath against such offenders. There is great probability that the
Hebrews were addicted to the worship of this deity, even before
their coming out of Egypt; since the Prophet Amos, v, 26, and after
him St. Stephen, reproach them with having carried in the
wilderness the tabernacle of their god Moloch, Acts vii, 43. Solomon
built a temple to Moloch upon the Mount of Olives, 1 Kings xi, 7; and
Manasseh a long time after imitated his impiety, making his son pass
through the fire in honour of Moloch, 2 Kings xxi, 3–6. It was chiefly
in the valley of Tophet and Hinnom, east of Jerusalem, that this
idolatrous worship was paid, Jer. xix, 5, 6, &c. Some are of opinion
that they contented themselves with making their children leap over
a fire sacred to Moloch, by which they consecrated them to some
false deity: and by this lustration purified them; this being a usual
ceremony among the Heathens on other occasions. Some believe
that they made them pass through two fires opposite to each other,
for the same purpose. But the word ‫העביר‬, to cause to pass
through,” and the phrase to cause to pass through the fire,” are used
in respect to human sacrifices in Deut. xii, 31; xviii, 10; 2 Kings xvi,
3; xxi, 6; 2 Chron. xxviii, 3; xxxiii, 6. These words are not to be
considered as meaning in these instances literally to pass through,
and that alone. They are rather synonymous with ‫שרף‬, to burn, and
‫זבח‬, to immolate, with which they are interchanged, as may be seen
by an examination of Jer. vii, 31; xix, 5; Ezek. xvi, 20, 21; Psalm cvi,
38. In the later periods of the Jewish kingdom, this idol was erected
in the valley south of Jerusalem, namely, in the valley of Hinnom,
and in the part of that valley called Tophet, ‫תפת‬, so named from the
drums, ‫תפים תף‬, which were beaten to prevent the groans and cries
of children sacrificed from being heard, Jer. vii, 31, 32; xix, 6–14;
Isaiah xxx, 33; 2 Kings xxiii, 10. The place was so abhorrent to the
minds of the more recent Jews, that they applied the name ge
hinnom or gehenna to the place of torments in a future life. The
word gehenna is used in this way, namely, for the place of
punishment beyond the grave, very frequently in oriental writers, as
far as India. There are various sentiments about the relation that
Moloch had to the other Pagan divinities. Some believe that Moloch
was the same as Saturn, to whom it is well known that human
sacrifices were offered; others think it was the same with Mercury;
others, Venus; others, Mars, or Mithra. Calmet has endeavoured to
prove that Moloch signified the sun, or the king of heaven.
MONEY. Scripture often speaks of gold, silver, brass, of certain
sums of money, of purchases made with money, of current money,
of money of a certain weight; but we do not observe coined or
stamped money till a late period; which makes it probable that the
ancient Hebrews took gold and silver only by weight; that they only
considered the purity of the metal, and not the stamp. The most
ancient commerce was conducted by barter, or exchanging one sort
of merchandise for another. One man gave what he could spare to
another, who gave him in return part of his superabundance.
Afterward, the more precious metals were used in traffic, as a value
more generally known and fixed. Lastly, they gave this metal, by
public authority, a certain mark, a certain weight, and a certain
degree of alloy, to fix its value, and to save buyers and sellers the
trouble of weighing and examining the coins. At the siege of Troy in
Homer, no reference is made to gold or silver coined; but the value
of things is estimated by the number of oxen they were worth. For
instance: they bought wine, by exchanging oxen, slaves, skins, iron,
&c, for it. When the Greeks first used money, it was only little pieces
of iron or copper, called oboli or spits, of which a handful was a
drachma, says Plutarch. Herodotus thinks that the Lydians were the
first that stamped money of gold or silver, and introduced it into
commerce. Others say it was Ishon, king of Thessaly, a son of
Deucalion. Others ascribe this honour to Erichthonius; who had been
educated by the daughters of Cecrops, king of Athens: others, again,
to Phidon, king of Argos. Among the Persians it is said Darius, son of
Hystaspes, first coined golden money. Lycurgus banished gold and
silver from his commonwealth of Lacedæmon, and only allowed a
rude sort of money, made of iron. Janus, or rather the kings of
Rome, made a kind of gross money of copper, having on one side
the double face of Janus, on the other the prow of a ship. We find
nothing concerning the money of the Egyptians, Phenicians,
Arabians, or Syrians, before Alexander the Great. In China, to this
day, they stamp no money of gold or silver, but only of copper. Gold
and silver pass as merchandise. If gold or silver be offered, they
take it and pay it by weight, as other goods: so that they are obliged
to cut it into pieces with shears for that purpose, and they carry a
steel yard at their girdles to weigh it.
But to return to the Hebrews. Abraham weighed out four hundred
shekels of silver, to purchase Sarah’s tomb, Genesis xxiii, 15, 16; and
Scripture observes that he paid this in current money with the
merchant.” Joseph was sold by his brethren to the Midianites for
twenty pieces (in Hebrew twenty shekels) of silver, Gen. xxxvii, 28.
The brethren of Joseph bring back with them into Egypt the money
they found in their sacks, in the same weight as before, Gen. xliii,
21. The bracelets that Eliezer gave Rebekah weighed ten shekels,
and the ear rings two shekels, Gen. xxiv, 22. Moses ordered that the
weight of five hundred shekels of myrrh, and two hundred and fifty
shekels of cinnamon, of the weight of the sanctuary, should be
taken, to make the perfume which was to be burnt to the Lord on
the golden altar, Exod. xxx, 24. He acquaints us that the Israelites
offered for the works of the tabernacle seventy-two thousand talents
of brass, Exod. xxxviii, 29. We read, in the books of Samuel, that the
weight of Absalom’s hair was two hundred shekels of the ordinary
weight, or of the king’s weight, 2 Sam. xiv, 26. Isaiah, xlvi, 6,
describes the wicked as weighing silver in a balance, to make an idol
of it; and Jeremiah, xxxii, 10, weighs seventeen pieces of silver in a
pair of scales, to pay for a field he had bought. Isaiah says, Come,
buy wine and milk without money and without price. Wherefore do
ye weigh money for that which is not bread?” Amos, viii, 5,
represents the merchants as encouraging one another to make the
ephah small, wherewith to sell, and the shekel great, wherewith to
buy, and to falsify the balances by deceit.
In all these passages three things only are mentioned: 1. The
metal, that is, gold or silver, and never copper, that not being used in
traffic as money. 2. The weight, a talent, a shekel, a gerah or
obolus, the weight of the sanctuary, and the king’s weight. 3. The
alloy (standard) of pure or fine gold and silver, and of good quality,
as received by the merchant. The impression of the coinage is not
referred to; but it is said they weighed the silver, or other
commodities, by the shekel and by the talent. This shekel, therefore,
and this talent, were not fixed and determined pieces of money, but
weights applied to things used in commerce. Hence those deceitful
balances of the merchants, who would increase the shekel, that is,
would augment the weight by which they weighed the gold and
silver they were to receive, that they might have a greater quantity
than was their due; hence the weight of the sanctuary, the standard
of which was preserved in the temple to prevent fraud; hence those
prohibitions in the law, Thou shalt not have in thy bag divers
weights,” in Hebrew, stones, a great and a small,” Deut. xxv, 13;
hence those scales that the Hebrews wore at their girdles, Hosea xii,
7, and the Canaanites carried in their hands, to weigh the gold and
silver which they received in payment. It is true that in the Hebrew
we find Jacob bought a field for a hundred kesitahs, Gen. xxxiii, 19;
and that the friends of Job, after his recovery, gave to that model of
patience each a kesitah, and a golden pendant for the ears, Job xlii,
11. We also find there darics, (in Hebrew, darcmonim or
adarcmonim,) and minæ, stateræ, oboli; but this last kind of money
was foreign, and is put for other terms, which in the Hebrew only
signifies the weight of the metal. The kesitah is not well known to
us: some take it for a sheep or a lamb; others, for a kind of money,
having the impression of a lamb or a sheep: but it was more
probably a purse of money. The darcmonim or darics are money of
the kings of Persia; and it is agreed that Darius, son of Hystaspes,
first coined golden money. Ezekiel, xlv, 12, tells us that the mina
makes fifty shekels: he reduces this foreign money to the weight of
the Hebrews. The mina might probably be a Persian money
originally, and adopted by the Greeks and by the Hebrews. But
under the dominion of the Persians, the Hebrews were hardly at
liberty to coin money of their own, being in subjection to those
princes, and very low in their own country. They were still less able
under the Chaldeans, during the Babylonish captivity; or afterward
under the Grecians, to whom they were subject till the time of
Simon Maccabæus, to whom Antiochus Sidetes, king of Syria,
granted the privilege of coining money in Judea, 1 Mac. xv, 6. And
this is the first Hebrew money, properly so called, that we know of.
There were shekels and demi-shekels, also the third part of a shekel,
and a quarter of a shekel, of silver.
The shekel of silver, or the silverling, Isa. vii, 23, originally
weighed three hundred and twenty barleycorns; but it was afterward
increased to three hundred and eighty-four barleycorns, its value,
being considered equal to four Roman denarii, was two shillings and
seven pence, or, according to Bishop Cumberland, two shillings and
four pence farthing. It is said to have had Aaron’s rod on the one
side, and the pot of manna on the other. The bekah was equal to
half a shekel, Exod. xxxviii, 26. The denarius was one-fourth of a
shekel, seven pence three farthings of our money. The gerah, or
meah, Exod. xxx, 13, was the sixth part of the denarius, or diner,
and the twenty-fourth part of the shekel. The assar, or assarion,
Matt. x, 29, was the ninety-sixth part of a shekel: its value was
rather more than a farthing. The farthing, Matt. v, 26, was in value
the thirteenth part of a penny sterling. The mite was the half of a
farthing, or the twenty-sixth part of a penny sterling. The mina, or
maneh, Ezek. xlv, 12, was equal to sixty shekels, which, taken at two
shillings and seven pence, was seven pounds fifteen shillings. The
talent was fifty minas; and its value, therefore, three hundred and
eighty-seven pounds ten shillings. The gold coins were as follows: a
shekel of gold was about fourteen and a half times the value of
silver, that is, one pound seventeen shillings and five pence
halfpenny. A talent of gold consisted of three thousand shekels. The
drachma was equal to a Roman denarius, or seven pence three
farthings of our money. The didrachma, or tribute money, Matt. xvii,
24, was equal to fifteen pence halfpenny. It is said to have been
stamped with a harp on one side, and a vine on the other. The
stater, or piece of money which Peter found in the fish’s mouth,
Matt. xvii, 27, was two half shekels. A daric, dram, 1 Chron. xxix, 7;
Ezra viii, 27, was a gold coin struck by Darius the Mede. According to
Parkhurst its value was one pound five shillings. A gold penny is
stated by Lightfoot to have been equal to twenty-five silver pence.
Hug derives a satisfactory argument for the veracity of the
Gospels from the different kinds of money mentioned in them:--The
admixture of foreign manners and constitutions proceeded through
numberless circumstances of life. Take, for example, the circulation
of coin; at one time it is Greek coin; at another, Roman; at another
time ancient Jewish. But how accurately is even this stated
according to history, and the arrangement of things! The ancient
imposts which were introduced before the Roman dominion were
valued according to the Greek coinage; for example, the taxes of the
temple, the διδραχμον, Matt. xvii, 24. The offerings were paid in
these, Mark xii, 42; Luke xxi, 2. A payment which proceeded from
the temple treasury was made according to the ancient national
payment by weight, Matt. xxvi, 15; but in common business, trade,
wages, sale, &c, the assis and denarius and Roman coin were usual,
Matt. x, 29; xx, 3; Luke xii, 6; Mark xiv, 5; John xii, 5; vi, 7. The
more modern state taxes are likewise paid in the coin of the nation
which exercises at the time the greatest authority, Matthew xxii, 19;
Mark xii, 15; Luke xx, 24. Writers, who, in each little circumstance,
which otherwise would pass by unnoticed, so accurately describe the
period of time, must certainly have had a personal knowledge of it.
MONEY-CHANGERS, in the Gospels, were persons who exchanged
native for foreign coin, to enable those who came to Jerusalem from
distant countries to purchase the necessary sacrifices. In our Lord’s
time they had established themselves in the court of the temple; a
profanation which had probably grown up with the influence of
Roman manners, which allowed the argentarii [money-dealers] to
establish their usurious mensas, tables, by the statues of the gods,
even at the feet of Janus, in the most holy places, in porticibus
Basilicarum, or in the temples, pone ædem Castoris. The following
extract from Buckingham’s Travels among the Arabs, is illustrative:-
-“The mosque at the time of our passing through it was full of
people, though these were not worshippers, nor was it at either of
the usual hours of public prayers. Some of the parties were
assembled to smoke, others to play at chess, and some apparently
to drive bargains of trade, but certainly none to pray. It was, indeed,
a living picture of what we might believe the temple at Jerusalem to
have been, when those who sold oxen, and sheep, and doves, and
the changers of money sitting there, were driven out by Jesus, with
a scourge of cords, and their tables overturned. It was, in short, a
place of public resort and thoroughfare, a house of merchandise, as
the temple of the Jews had become in the days of the Messiah.”
MONK anciently denoted a person who retired from the world to
give himself up wholly to God, and to live in solitude and abstinence.
The word is derived from the Latin monachus, and that from the
Greek μοναχὸς, solitary. The original of monks seems to have been
this: The persecutions which attended the first ages of the Gospel
forced some Christians to retire from the world, and live in deserts
and places more private and unfrequented, in hopes of finding that
peace and comfort among beasts which were denied them among
men; and this being the case of some very extraordinary persons,
their example gave such reputation to retirement, that the practice
was continued when the reason of its commencement ceased. After
the empire became Christian, instances of this kind were numerous;
and those whose security had obliged them to live separately and
apart became afterward united into societies. We may also add, that
the mystic theology, which gained ground toward the close of the
third century, contributed to produce the same effect, and to drive
men into solitude, for the purposes of devotion. The monks, at least
the ancient ones, were distinguished into solitaries, cœnobites, and
sarabaites. The first were those who lived in places remote from all
towns and habitations of men, as do still some of the hermits. The
cœnobites were those who lived in community with several others in
the same house, and under the same superiors. The sarabaites were
strolling monks, having no fixed rule of residence. Those who are
now called monks are cœnobites, who live together in a convent or
monastery, who make vows of living according to a certain rule
established by the founder, and wear a habit which distinguishes
their order. Those that are endowed, or have a fixed revenue, are
most properly called monks, monachi; as the Chartereux,
Benedictines, Bernardines, &c. The Mendicants, or those that beg, as
the Capuchins and Franciscans, are more properly called religious,
and friars, though the names are frequently confounded.
The first monks were those of St. Anthony, who, toward the close
of the fourth century, formed them into a regular body, engaged
them to live in society with each other, and prescribed to them fixed
rules for the direction of their conduct. These regulations, which
Anthony had made in Egypt, were soon introduced into Palestine
and Syria by his disciple Hilarion. Almost about the same time,
Aones, or Eugenius, with their companions, Gaddanus and Azyzas,
instituted the monastic order in Mesopotomia, and the adjacent
countries; and their example was followed with such rapid success,
that in a short time the whole east was filled with a lazy set of
mortals, who, abandoning all human connections, advantages,
pleasures, and concerns, wore out a languishing and miserable
existence amidst hardships of want, and various kinds of suffering,
in order to arrive at a more close and rapturous communication with
God and angels. From the east this gloomy institution passed into
the west, and first into Italy and its neighbouring islands, though it is
uncertain who transplanted it thither. St. Martin, the celebrated
bishop of Tours, erected the first monasteries in Gaul, and
recommended this religious solitude with such power and efficacy,
both by his instruction and example, that his funeral is said to have
been attended by no less than two thousand monks. From hence the
monastic discipline extended its progress gradually through the other
provinces and countries of Europe. There were beside, the monks of
St. Basil, called in the east calogeri, from καλος γερων, a good old
man, and those of St. Jerom, the hermits of St. Augustine, and
afterward those of St. Benedict and St. Bernard: at length came
those of St. Francis and St. Dominic, with a legion of others.
Toward the close of the fifth century, the monks who had formerly
lived only for themselves in solitary retreats, and had never thought
of assuming any rank among the sacerdotal order, were gradually
distinguished from the populace, and endowed with such opulence
and honourable privileges that they found themselves in a condition
to claim an eminent station among the pillars and supporters of the
Christian community. The fame of their piety and sanctity was so
great, that bishops and presbyters were often chosen out of their
order; and the passion of erecting edifices and convents, in which
the monks and holy virgins might serve God in the most
commodious manner, was at this time carried beyond all bounds.
However, their licentiousness, even in this century, was become a
proverb; and they are said to have excited the most dreadful tumults
and seditions in various places. The monastic orders were at first
under the immediate jurisdiction of the bishops, from which they
were exempted by the Roman pontiff about the end of the seventh
century; and the monks in return devoted themselves wholly to
advance the interest and to maintain the dignity of the bishop of
Rome. This immunity which they obtained was a fruitful source of
licentiousness and disorder, and occasioned the greatest part of the
vices with which they were afterward so justly charged.
In the eighth century the monastic discipline was extremely
relaxed, both in the eastern and western provinces, and all efforts to
restore it were ineffectual. Nevertheless, this kind of institution was
in the highest esteem; and nothing could equal the veneration that
was paid about the close of the ninth century to such as devoted
themselves to the sacred gloom and indolence of a convent. This
veneration caused several kings and emperors to call them to their
courts, and to employ them in civil affairs of the greatest moment.
Their reformation was attempted by Louis the meek, but the effect
was of short duration. In the eleventh century, they were exempted
by the popes from the authority of their sovereigns, and new orders
of monks were continually established, insomuch that in the council
of Lateran, that was held A. D. 1215, a decree was passed, by the
advice of Innocent III., to prevent any new monastic institutions;
and several were entirely suppressed. In the fifteenth and sixteenth
centuries, it appears, from the testimony of the best writers, that the
monks were generally lazy, illiterate, profligate, and licentious
epicures, whose views in life were confined to opulence, idleness,
and pleasure. However, the reformation had a manifest influence in
restraining their excesses, and rendering them more circumspect
and cautious in their external conduct.
Monks are distinguished by the colour of their habits, into black,
white, gray, &c. Among the monks, some are called monks of the
choir, others, professed monks, and others, lay monks; which last
are destined for the service of the convent, and have neither
clericate nor literature. Cloistered monks are those who actually
reside in the house, in opposition to extra monks, who have
benefices depending on the monastery. Monks are also distinguished
into reformed, whom the civil and ecclesiastical authority have made
masters of ancient convents, and empowered to retrieve the ancient
discipline, which had been relaxed; and ancient, who remain in the
convent, to live in it according to its establishment at the time when
they made their vows, without obliging themselves to any new
reform. Anciently the monks were all laymen, and were only
distinguished from the rest of the people by a peculiar habit and an
extraordinary piety or devotion. Not only the monks were prohibited
the priesthood, but even priests were expressly prohibited from
becoming monks, as appears from the letters of St. Gregory. Pope
Syricius was the first who called them to the clericate, on account of
some great scarcity of priests that the church was supposed to
labour under; and since that time the priesthood has been usually
united to the monastical profession.
MONOPHYSITES. See Hypostatic Union.
MONOTHELITES, a denomination in the seventh century. See
Hypostatic Union.
MONTHS, ‫ירחים‬, sometimes also called ‫חדשים‬, new moons, from
the circumstance of their commencing with the new moon, anciently
had no separate names, with the exception of the first, which was
called Abib, that is, the month of the young ears of corn,” Exod. xiii,
4; xxiii, 15; xxxiv, 18; Deut. xvi, 1. During the captivity, the Hebrews
adopted the Babylonian names for their months; which were as
follows, and they were reckoned thus:--
1. ‫ניסן‬, Nisan, from the new of April, Neh. ii, 1.
moon
2. ‫זיו‬, Zif or Ziv, also called of May, 1 Kings vi, 1.
‫אייר‬,
3. ‫ִס יָון‬, Sivan, of June, Esther viii, 9.
4. ‫תמוז‬, Tammuz, of July.
5. ‫אב‬, Ab, of August.
6. ‫אלול‬, Elul, of September, Neh. vi, 15.
7. ‫תשרי‬, Tishri, also ‫ירח‬ of October, 1 Kings viii, 2.
‫האתנים‬,
8. ‫בול‬, Bul, also ‫מרחשון‬, of November, 1 Kings vi, 38.
9. ‫כסלו‬, Kislev, of December, Neh. i, 1.
10. ‫טבת‬, Tebeth, of January, Esther ii, 16.
11. ‫שבט‬, Shebat, of February, Zech. i, 7.
12. ‫אדר‬, Adar, of March, Esther iii, 7.
The first month here mentioned, Nisan, was originally called Abib.
The intercalary month is denominated in Hebrew ‫אדר‬.
MOON. Particular sacrifices were enjoined by Moses at every new
moon, which day was also celebrated as a feast. It is promised in
Psalm cxxi, 6, The sun shall not smite thee by day, nor the moon by
night.” The effect of a coup de soleil, or stroke of the sun, is well
known; and in some climates the beams of the moon are reputed
hurtful. Anderson, in his Description of the East,” says, One must
here (in Batavia) take great care not to sleep in the beams of the
moon uncovered. I have seen many people whose neck has become
crooked, so that they look more to the side than forward. I will not
decide whether it is to be ascribed to the moon, as people imagine
here.” In some of the southern parts of Europe the same opinions
are entertained of the pernicious influence of the moon beams. An
English gentleman walking in the evening in the garden of a
Portuguese nobleman at Lisbon, was most seriously admonished by
the owner to put on his hat, to protect him from the moon beams.
The fishermen in Sicily are said to cover, during the night, the fish
which they expose to dry on the sea shore, alleging that the beams
of the moon cause them to putrefy.
MORAL OBLIGATION. Different opinions have been held as to the
ground of moral obligation. Grotius, Balguy, and Dr. Samuel Clarke,
place it in the eternal and necessary fitness of things. To this there
are two objections. The first is, that it leaves the distinction between
virtue and vice, in a great measure, arbitrary and indefinite,
dependent upon our perception of fitness and unfitness, which, in
different individuals will greatly differ. The second is, that when a
fitness or unfitness is proved, it is no more than the discovery of a
natural essential difference or congruity, which alone cannot
constitute a moral obligation to choose what is fit, and to reject what
is unfit. When we have proved a fitness in a certain course of action,
we have not proved that it is obligatory. A second step is necessary
before we can reach this conclusion. Cudworth, Butler, Price, and
others, maintain, that virtue carries its own obligation in itself; that
the understanding at once perceives a certain action to be right, and
therefore it ought to be performed. Several objections lie to this
notion: 1. It supposes the understandings of men to determine
precisely in the same manner concerning all virtuous and vicious
actions; which is contrary to fact. 2. It supposes a previous rule, by
which the action is determined to be right; but if the revealed will of
God is not to be taken into consideration, what common rule exists
among men? There is evidently no such rule, and therefore no
means of certainly determining what is right. 3. If a common
standard were known among men, and if the understandings of men
determined in the same manner as to the conformity, or otherwise,
of an action to that standard; what renders it a matter of obligation
that any one should perform it? The rule must be proved to be
binding, or no ground of obligation is established.
An action is obligatory, say others, because it is agreeable to the
moral sense. This is the theory of Lord Shaftesbury and Dr.
Hutcheson. By moral sense appears to be meant an instinctive
approbation of right, and abhorrence of wrong, prior to all reflection
on their nature, or their consequences. If any thing else were
understood by it, then the moral sense must be the same with
conscience, which we know to vary with the judgment, and cannot
therefore be the basis of moral obligation. If conscience be not
meant, then the moral sense must be considered as instinctive: a
notion, certainly, which is disproved by the whole moral history of
man. It may, indeed, be conceded, that such is the constitution of
the human soul, that when those distinctions between actions, which
have been taught by religious tradition or direct revelation, are
known in their nature, relations, and consequences, the calm and
sober judgments of men will approve of them; and that especially
when they are considered abstractedly, that is, as not affecting and
controlling their own interests and passions immediately, virtue may
command complacency, and vice provoke abhorrence: but that,
independent of reflection on their nature or their consequences,
there is an instinctive principle in man which abhors evil, and loves
good, is contradicted by that variety of opinion and feeling on the
vices and virtues, which obtains among all uninstructed nations. We
applaud the forgiveness of an injury as magnanimous; a savage
despises it as mean. We think it a duty to support and cherish aged
parents; many nations, on the contrary, abandon them as useless,
and throw them to the beasts of the field. Innumerable instances of
this contrariety might be adduced, which are all contrary to the
notion of instinctive sentiment. Instincts operate uniformly, but this
assumed moral sense does not. Beside, if it be mere matter of
feeling, independent of judgment, to love virtue, and abhor vice, the
morality of the exercise of this principle is questionable; for it would
be difficult to show, that there is any more morality, properly
speaking, in the affections and disgusts of instinct than in those of
the palate. If judgment, the knowledge and comparison of things, be
included, then this principle supposes a uniform and universal
individual revelation as to the nature of things to every man, or an
intuitive faculty of determining their moral quality; both of which are
too absurd to be maintained.
Welcome to our website – the perfect destination for book lovers and
knowledge seekers. We believe that every book holds a new world,
offering opportunities for learning, discovery, and personal growth.
That’s why we are dedicated to bringing you a diverse collection of
books, ranging from classic literature and specialized publications to
self-development guides and children's books.

More than just a book-buying platform, we strive to be a bridge

connecting you with timeless cultural and intellectual values. With an
elegant, user-friendly interface and a smart search system, you can
quickly find the books that best suit your interests. Additionally,
our special promotions and home delivery services help you save time
and fully enjoy the joy of reading.

Join us on a journey of knowledge exploration, passion nurturing, and

personal growth every day!

ebookbell.com