Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

0
votes
0answers
37 views

How to use Truecrypt AES keys to decrypt a Truecrypt volume

I am performing a forensics experiment. I have access to a '.mem' memory dump and I am successful in extracting 2 AES keys from the dump. Now I wish to use these AES keys to decrypt a volume encrypted ...
0
votes
0answers
12 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
1
vote
1answer
38 views

Is threr any artifacts for filesystem forensics in memory?

I have a memory dump I know it is infected by a rootkit use its own filesystem installed at the end of the disk, is there ny artifacts in dmp file to show this? thanks
0
votes
0answers
13 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
2
votes
1answer
129 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
4
votes
1answer
48 views

Principles of memory forensics tools

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
1
vote
1answer
64 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
1answer
44 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
4
votes
3answers
146 views

Ip tracking of stolen laptop

Somebody stole my laptop. I made a connection to it while he had Teamviewer still running. The police says that they can't start tracing the laptop because the IP is abroad. But what doesn't make ...
0
votes
2answers
106 views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
1
vote
1answer
30 views

How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?

I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode. Then, I search in ...
1
vote
3answers
75 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
8
votes
4answers
1k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
1
vote
1answer
61 views

Data recovery from file collections [closed]

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
2
votes
2answers
301 views

How can I identify which computers a USB device has been used on?

Is there a way to find out in which and/or how many computers a USB flash disk entered. And if its possible can we find out how many times a file was read/edited. I heard that its possible , but I ...
1
vote
1answer
74 views

Mitigating TrueCrypt Attack Vectors in Memory and System Cache

While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names ...
3
votes
1answer
59 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
1
vote
2answers
140 views

How does police or somebody find out that an Arp Spoofing attack was done?

If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see ...
2
votes
2answers
232 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
1
vote
2answers
70 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
3
votes
4answers
202 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
2
votes
2answers
296 views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
246 views

An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?

I'm trying to simulate a possible attack scenario for my studies. I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too. ...
0
votes
2answers
196 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
1answer
113 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
2
votes
2answers
235 views

What can I do with private 128 bit AES Keys?

For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is ...
1
vote
4answers
497 views

Is it possible to recover securely deleted data from H.D.D using the forensics?

I just want to know if it's possible to recover and see securely(or wiped out) deleted data from H.D.D using forensics ? Imagine police have arrested a hacker and that hacker,before getting ...
5
votes
3answers
1k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
14
votes
2answers
950 views

Are there any tell-tale signs of self-hacking? [closed]

After the Mt.Gox crash, and also keeping in mind recently published attacks on Target and Neiman Marcus, one is led to believe that sometimes so-called hacking is perpetrated by insiders. What are ...
0
votes
1answer
335 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
1
vote
0answers
213 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
7
votes
5answers
1k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
13
votes
6answers
1k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
0
votes
2answers
180 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to ...
0
votes
1answer
282 views

What is the full extent of information about my computer that a website can get?

I need to know what all information a random website can get from my computer, and whether a website can tell which of my two computers on the same router I'm using. I know websites can determine ...
19
votes
4answers
971 views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
2
votes
2answers
437 views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
4answers
418 views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
2answers
88 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
38
votes
9answers
5k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
1
vote
0answers
296 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
5
votes
6answers
18k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
1answer
195 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...
0
votes
1answer
134 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...
0
votes
5answers
218 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
5
votes
2answers
245 views

Special form of file system to prevent recovering after secure wipe data

I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe. Say, encrypted container via loop mounted like ext4 - journal file system. This is good ...
2
votes
2answers
122 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
0
votes
2answers
481 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
7
votes
2answers
788 views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
-1
votes
1answer
2k views

Files deleted by some Employee . How to find what time it happened and whether done from another computer on network? [closed]

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What ...