Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

0
votes
0answers
24 views

What is the layers of abstraction (Digital Forensics)? [closed]

Its my understanding that the layers of abstraction role is to translate abstraction layers into manageable data from 1's and 0's. But what exactly are the layers of abstraction?
0
votes
1answer
10 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
0
votes
0answers
27 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
0
votes
1answer
19 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
1
vote
2answers
46 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
1
vote
0answers
24 views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
1
vote
0answers
19 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
8
votes
1answer
128 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
4
votes
2answers
112 views

How to determine if JPG EXIF data has been changed by “OEM” software (without third party tools)?

I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at 15:10:13, Dec 31, 2015 and I need to determine if this date ...
4
votes
1answer
81 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
-1
votes
2answers
43 views

How likely is it to find valuable information in the slack space of a workstation?

I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the ...
3
votes
1answer
73 views

Can a rootkit hide processes from “Volatility” or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
-4
votes
2answers
108 views

Can forensic investigators find my webmail emails in my laptop?

When I send an email using the web interface of Yahoo Mail or Gmail, can the email can be found somewhere (even if encrypted) on my laptop by forensic investigators? Somewhere on my hard drive or RAM? ...
0
votes
1answer
44 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
-1
votes
1answer
34 views

Regarding computer forensics and forensic accounting [closed]

I feel that these 2 forensic fields should work hand in hand. However, I do not have a background in computer science, but would like to upgrade myself to enhance my knowledge in this field. There ...
3
votes
4answers
59 views

Retrieving passcodes through forensic discovery

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery. What about the passcode itself? Is that encrypted too? Can forensic analysts ...
4
votes
1answer
113 views

How often should I check for unknown open ports

I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries. My question is how often should this job run so I ...
-1
votes
1answer
128 views

WhatsApp Forensic Analysis [closed]

I was wondering if anyone is aware of any conferences that cover WhatsApp security on android or something similar. My project requires me to look for three conference papers and justify why they are ...
3
votes
2answers
100 views

The UK Terror Watchdog says this is very difficult in practise, is it?

I saw this quote today in the Guardian David Anderson QC, the terror legislation watchdog commissioned to report on the state of Britain’s surveillance laws in the aftermath of Snowden’s ...
5
votes
1answer
85 views

Is the content of my RAM kept if the OS is shut down but the PC is still running?

I just asked myself if the content of my RAM is kept when I shut down the OS but the PC is still running. For example when I do apply updates they sometimes require a reboot. Is the informaiton that ...
4
votes
1answer
124 views

Convert raw memory dump into a format recognized by volatility

I dumped the RAM of a Windows 7 pc using LiveKd which basicly worked. The memory was dumped but then the convert of the binary dump into "summary format" failed. When I then tried to read the file ...
3
votes
3answers
73 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
4
votes
1answer
66 views

Can I tell Linux not to swap out the data space of a specific process?

I need to be able to write a program that uses a secret value that I want to ensure never gets written to disk during a page swap. The value is securely entered when the program starts, and gets ...
1
vote
1answer
123 views

how to track IP address from which mail has been sent?

I am from India. I have get few mails from some random Gmail ID. How to get the information from which IP address it has been sent ?
1
vote
1answer
93 views

Volatility Plugins Directory Using Windows

I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly ...
0
votes
1answer
93 views

Forensics, evidence collection vs data acquisition

I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events: Imaging the RAM on a live system; ...
2
votes
1answer
81 views

Selling used ram [DDr3 SODIMM]. Need to erase?

Does DDr3 SODIMM memory hold information after being removed? I would like to sell the memory I just removed from my computer, however I wasn't sure if I had to wipe/erase it first some how. Please ...
2
votes
2answers
121 views

Spyware on Sony Xperia z3 compact ? comand: adb reboot bootloader results in error device not found

Please help as I can not pay a forensic data investigator. For a while now I suspect to being spied on my computers and cellphones. I have two Sony xperia Z3 compact and both were acting strangely ...
0
votes
1answer
54 views

Forensics live data collection

The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link). I'm also following an online training where the trainer collects live data (processes ...
16
votes
7answers
3k views

Is there a need to image the hard drive when using a write blocker?

Forensics books often recommend working on an image of the hard drive instead of the original drive. Should I take this precaution even if I use a write blocker? If so, why?
0
votes
2answers
41 views

Write blocker, blocked operations

In forensics, write blockers devices should block every operation that might change the hard drive content. Besides the write operation what other operations should a write blocker block?
0
votes
1answer
31 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
1
vote
1answer
87 views

Forensics procedures, volatile data collection [closed]

In forensics procedures, it's often recommended to thoroughly document a crime scene before proceeding to evidence collection. In case of volatile data, these evidences can be lost before having the ...
0
votes
2answers
126 views

How do I find the source of network traffic from a specific host?

My firewall identifies an unusual amount of traffic to 8.8.4.4 from host 192.168.76.22 (a Mac OS X Server). Within that server, the network connections are defined with a primary DNS pointing to my ...
1
vote
1answer
69 views

Forensics copy, dcfldd

dcfldd is often recommended in forensics to duplicate hard drives. One of the reasons dcfldd is preferred over dd is the on-the-fly hashing feature. Q: can I really rely on this feature to ensure the ...
2
votes
1answer
33 views

Forensics hdparm command

I'm new to forensics and I don't know yet what I'm allowed to do or not. I would like to know if I'm allowed to issue the following command hdparm -I /dev/sdb where /dev/sdb is the hard drive to ...
2
votes
1answer
198 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
3
votes
1answer
67 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
0
votes
0answers
53 views

Can information be extracted from the CPU Register

To my knowledge, the Process Control Block (PCB), which stores information about the state of processes whilst they are on hold, is stored in the CPU Register, otherwise and additional Fetch cycle ...
2
votes
1answer
87 views

Forensics Tools on Linux Servers

I am trying to consolidate a list of security tools for our data center servers. We are predominantly Linux shop (RHEL) with some Windows 2008/12 servers. The core business is Software as a Service, ...
0
votes
0answers
46 views

What artifacts to acquire when looking for IoC? [closed]

I want to hunt for the Indicators of Compromise (IoC) in a potentially infected Windows PC. I am writing a batch script that would record the information needed for analysis. It includes the ...
1
vote
1answer
55 views

Detecting the source of dll injection

Is it possible to determine the process that performed DLL injection against a victim process?
2
votes
4answers
177 views

Can data be forensically retrieved off an encrypted hard drive?

If a hard drive is encrypted, is it still possible to retrieve data off of it? What about if the password to decrypt it is known? If this is the case, given that OSX now encrypts your drive by ...
1
vote
1answer
131 views

Can data be tampered with after expert clones a drive?

Introduction 3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were ...
4
votes
3answers
517 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
0
votes
1answer
64 views

Going to host a “hidden service”, should I “wipe” or edit file metadata?

I have made a site that is a hidden service on the Tor network. I was wondering if there any security risks by leaving metadata untouched for various files including but not limited to stylesheets ...
1
vote
1answer
93 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
3
votes
1answer
169 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
3
votes
2answers
128 views

Identifying EXIF Tampering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
3
votes
2answers
99 views

Prove that a Breach Didn't Result in a Leak

I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access ...