Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

0
votes
0answers
16 views

tool for passive device forensics [migrated]

Not sure if there is a tool out there but I basically would like to find a piece of software or multiple pieces of software that I could install on all my hosts within a network, for example my office ...
2
votes
1answer
53 views

Autopsy/SleuthKit in the courthouse? [on hold]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
1
vote
1answer
36 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
-4
votes
2answers
85 views

Do webcams generates logs on operating system? [closed]

I would like to know if the activity of a webcam (date and hour when it was on, etc.) is stored somewhere in the operating system. Webcam to which I refer can be integrated or USB camera and the OS ...
1
vote
1answer
34 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
0
votes
1answer
52 views

Forensic in Cloud environment

I'm new to forensic and I'm trying to do a simple research about forensic in the cloud. let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username ...
-1
votes
3answers
77 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
0
votes
1answer
167 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
1answer
34 views

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...
2
votes
2answers
78 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
0
votes
0answers
23 views

Removing Virtual Guest Additions Safely

So say I have a virtual machine that has been handed to me by an end user for forensics. It's a virtual machine exported as an appliance. I don't want VirtualBox's guest additions or VMWare Tools to ...
1
vote
1answer
34 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
2answers
76 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
0
votes
1answer
86 views

Can you trace network attacker by ip address? [closed]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
1
vote
2answers
37 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
92 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
-2
votes
1answer
44 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
1answer
62 views

Forensics - Mounting Drives in RAM

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m How much more difficult would it be to recover data ...
-2
votes
1answer
114 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
5
votes
2answers
169 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
4
votes
8answers
892 views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
0
votes
0answers
37 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
6
votes
3answers
244 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
1answer
153 views

What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
2
votes
4answers
122 views

Online Shop got hacked, fixed but is still under attack - what to do?

an xt-commerce-based online shop from a friend of mine got hacked recently. The attacker mailed that the shop is vulnerable, he showed the extracted data (basically he dumped the databases and cracked ...
1
vote
2answers
845 views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
0
votes
1answer
86 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
1
vote
2answers
85 views

Are there any artifacts for filesystem forensics in memory?

I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?
1
vote
2answers
52 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
2
votes
1answer
160 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
4
votes
1answer
72 views

Principles of memory forensics tools

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
-1
votes
1answer
82 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
1answer
77 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
4
votes
3answers
452 views

Ip tracking of stolen laptop

Somebody stole my laptop. I made a connection to it while he had Teamviewer still running. The police says that they can't start tracing the laptop because the IP is abroad. But what doesn't make ...
0
votes
2answers
450 views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
1
vote
1answer
35 views

How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?

I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode. Then, I search in ...
1
vote
3answers
103 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
8
votes
4answers
2k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
1
vote
1answer
68 views

Data recovery from file collections [closed]

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
2
votes
2answers
502 views

How can I identify which computers a USB drive has been used on?

Is there a way to find out in which and/or how many computers a USB flash disk entered. And if its possible can we find out how many times a file was read/edited. I heard that its possible , but I ...
1
vote
1answer
121 views

Mitigating TrueCrypt Attack Vectors in Memory and System Cache

While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names ...
3
votes
1answer
70 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
1
vote
2answers
161 views

How does police or somebody find out that an Arp Spoofing attack was done?

If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see ...
2
votes
2answers
364 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
3
votes
2answers
82 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
3
votes
4answers
426 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
2
votes
2answers
1k views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
288 views

An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?

I'm trying to simulate a possible attack scenario for my studies. I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too. ...
0
votes
2answers
601 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
1answer
156 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...