Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

0
votes
0answers
44 views

What other actions can I take to remove malware from an compromised device and how do I do them? [on hold]

My device has been infected with a RAT (Remote Access Trojan) or whatever the phone equivalent is. Here is my device info: Model: Samsung Galaxy Note 5 (CDMA) (SM-N920V) Service Provider: Verizon ...
1
vote
0answers
37 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
2
votes
1answer
31 views

Can data be restored from a hard drive after using magnets to wipe the data?

Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
-1
votes
3answers
40 views

Forensic analysis of file metadata

Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware ...
4
votes
1answer
68 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
1
vote
0answers
22 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
4
votes
3answers
93 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
5
votes
2answers
56 views

Is there anyway to analyze memory dynamically?

I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
4
votes
2answers
52 views

frameworks for collecting all activities in a pentest

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm ...
1
vote
3answers
48 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
2
votes
1answer
34 views

What buses carrying sensitive information on a running computer are vulnerable to sniffing?

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to ...
7
votes
1answer
89 views

Methods of cold boot attacks in the wild

As far as I know, there are two methods for performing cold boot attacks: Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports ...
8
votes
2answers
173 views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
0
votes
1answer
45 views

Which forensic disk image format should be preferred?

I want take a forensic image of an hard disk. However I am a little confused on which format should I take the image. DD (raw) or E01? What are the advantages and disadvantages of each?
3
votes
0answers
47 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
1
vote
0answers
37 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
4
votes
1answer
69 views

Detect PC Boot from Live CD

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained? I suspect my PC has been booted through a ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
0
votes
1answer
30 views

How can I secure the state of a compromised iPhone for evidence of evil before resetting it?

I'm a web developer and generalist programmer with a bit of mobile experience. A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to ...
3
votes
2answers
118 views

Need some recommendations on good IR hands-on training

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
-1
votes
1answer
72 views

Can VPN,proxy servers and TOR evade/remove Browser Fingerprinting in terms of anonymity? [duplicate]

If not what are other ways to beat browser fingerprinting?Thank you.
0
votes
1answer
18 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
0
votes
0answers
128 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
0
votes
1answer
26 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
1
vote
2answers
63 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
1
vote
0answers
40 views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
1
vote
0answers
29 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
8
votes
1answer
150 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
4
votes
2answers
164 views

How to determine if JPG EXIF data has been changed by “OEM” software (without third party tools)?

I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at 15:10:13, Dec 31, 2015 and I need to determine if this date ...
4
votes
1answer
118 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
-1
votes
2answers
51 views

How likely is it to find valuable information in the slack space of a workstation?

I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the ...
3
votes
1answer
93 views

Can a rootkit hide processes from “Volatility” or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
-4
votes
2answers
139 views

Can forensic investigators find my webmail emails in my laptop?

When I send an email using the web interface of Yahoo Mail or Gmail, can the email can be found somewhere (even if encrypted) on my laptop by forensic investigators? Somewhere on my hard drive or RAM? ...
0
votes
1answer
56 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
-1
votes
1answer
44 views

Regarding computer forensics and forensic accounting [closed]

I feel that these 2 forensic fields should work hand in hand. However, I do not have a background in computer science, but would like to upgrade myself to enhance my knowledge in this field. There ...
3
votes
4answers
62 views

Retrieving passcodes through forensic discovery

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery. What about the passcode itself? Is that encrypted too? Can forensic analysts ...
4
votes
1answer
117 views

How often should I check for unknown open ports

I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries. My question is how often should this job run so I ...
-1
votes
1answer
203 views

WhatsApp Forensic Analysis [closed]

I was wondering if anyone is aware of any conferences that cover WhatsApp security on android or something similar. My project requires me to look for three conference papers and justify why they are ...
3
votes
2answers
104 views

The UK Terror Watchdog says this is very difficult in practise, is it?

I saw this quote today in the Guardian David Anderson QC, the terror legislation watchdog commissioned to report on the state of Britain’s surveillance laws in the aftermath of Snowden’s ...
5
votes
1answer
92 views

Is the content of my RAM kept if the OS is shut down but the PC is still running?

I just asked myself if the content of my RAM is kept when I shut down the OS but the PC is still running. For example when I do apply updates they sometimes require a reboot. Is the informaiton that ...
4
votes
1answer
298 views

Convert raw memory dump into a format recognized by volatility

I dumped the RAM of a Windows 7 pc using LiveKd which basicly worked. The memory was dumped but then the convert of the binary dump into "summary format" failed. When I then tried to read the file ...
3
votes
3answers
81 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
3
votes
1answer
76 views

Can I tell Linux not to swap out the data space of a specific process?

I need to be able to write a program that uses a secret value that I want to ensure never gets written to disk during a page swap. The value is securely entered when the program starts, and gets ...
1
vote
1answer
147 views

how to track IP address from which mail has been sent?

I am from India. I have get few mails from some random Gmail ID. How to get the information from which IP address it has been sent ?
1
vote
1answer
243 views

Volatility Plugins Directory Using Windows

I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly ...
0
votes
2answers
152 views

Forensics, evidence collection vs data acquisition

I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events: Imaging the RAM on a live system; ...
2
votes
1answer
94 views

Selling used ram [DDr3 SODIMM]. Need to erase?

Does DDr3 SODIMM memory hold information after being removed? I would like to sell the memory I just removed from my computer, however I wasn't sure if I had to wipe/erase it first some how. Please ...
2
votes
2answers
145 views

Spyware on Sony Xperia z3 compact ? comand: adb reboot bootloader results in error device not found

Please help as I can not pay a forensic data investigator. For a while now I suspect to being spied on my computers and cellphones. I have two Sony xperia Z3 compact and both were acting strangely ...
0
votes
2answers
101 views

Forensics live data collection

The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link). I'm also following an online training where the trainer collects live data (processes ...
17
votes
7answers
4k views

Is there a need to image the hard drive when using a write blocker?

Forensics books often recommend working on an image of the hard drive instead of the original drive. Should I take this precaution even if I use a write blocker? If so, why?