Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

2
votes
4answers
85 views

Can data be forensically retrieved off an encrypted hard drive?

If a hard drive is encrypted, is it still possible to retrieve data off of it? What about if the password to decrypt it is known? If this is the case, given that OSX now encrypts your drive by ...
1
vote
1answer
90 views

Can data be tampered with after expert clones a drive?

Introduction 3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were ...
4
votes
3answers
62 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
0
votes
1answer
41 views

Going to host a “hidden service”, should I “wipe” or edit file metadata?

I have made a site that is a hidden service on the Tor network. I was wondering if there any security risks by leaving metadata untouched for various files including but not limited to stylesheets ...
1
vote
1answer
53 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
3
votes
1answer
64 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
2
votes
1answer
50 views

Identifying EXIF Tempering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
2
votes
2answers
86 views

Prove that a Breach Didn't Result in a Leak

I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access ...
0
votes
1answer
40 views

Is it possible to detect the real IP from a modifed header [closed]

Is it possible to find the real IP from a header which seems to be changed in order to hide the sender's IP?
0
votes
2answers
89 views

How to make data in hard disk unrecoverable on linux [duplicate]

I need to wipe completely the data on my hard disk so it's unrecoverable. I'm actually using Linux, i have seen this command on the web, but I don't know if its secure. shred -zvn 35 /dev/sdb
3
votes
3answers
115 views

How do I know how a file got onto my computer?

I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually ...
0
votes
2answers
113 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
0
votes
0answers
57 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
0answers
47 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
2
votes
1answer
70 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
1
vote
1answer
35 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
3
votes
3answers
132 views

How do I prevent SSD file recovery?

I use a Kingston V300 SSD (specifically SV300S37A) According to this answer The 'best' modern drives support a vendor-specific secure erase functionality. Examples of this are Intels new 320 ...
4
votes
1answer
117 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
2
votes
1answer
143 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
1
vote
1answer
160 views

Hidden OS: Decoy OS ≠ Hidden OS?

I wanted to use two different OS then two OS equal in the distinct functions: Hidden OS: Linux Decoy OS: Windows Has how? because what I have read until today were processes done with even OS, I do ...
5
votes
3answers
362 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
2
votes
2answers
119 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user ...
1
vote
1answer
22 views

Resources needed in the protection of all activities related to the computer [closed]

Countries with strong censorship have agencies like NSA, of course they have not the same power and abilities but they could be very harmful; so we should be safe from their eyes and hands. My target ...
1
vote
2answers
44 views

Are there standards for software disk image acquisition in forensics?

I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another ...
2
votes
1answer
95 views

Autopsy/SleuthKit in the courthouse? [closed]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
1
vote
1answer
55 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
-4
votes
2answers
120 views

Do webcams generates logs on operating system? [closed]

I would like to know if the activity of a webcam (date and hour when it was on, etc.) is stored somewhere in the operating system. Webcam to which I refer can be integrated or USB camera and the OS ...
1
vote
1answer
95 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
0
votes
2answers
116 views

Forensic in Cloud environment

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to ...
-1
votes
3answers
132 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
1
vote
1answer
273 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
1answer
47 views

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...
2
votes
2answers
114 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
1
vote
1answer
47 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
2answers
110 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
0
votes
1answer
114 views

Can you trace network attacker by ip address? [closed]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
1
vote
2answers
49 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
120 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
-1
votes
1answer
99 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
1answer
76 views

Forensics - Mounting Drives in RAM

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m How much more difficult would it be to recover data ...
-2
votes
1answer
140 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
5
votes
2answers
233 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
4
votes
8answers
3k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
0
votes
0answers
54 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
6
votes
3answers
486 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
1answer
261 views

What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
4
votes
5answers
171 views

Online Shop got hacked, fixed but is still under attack - what to do?

an xt-commerce-based online shop from a friend of mine got hacked recently. The attacker mailed that the shop is vulnerable, he showed the extracted data (basically he dumped the databases and cracked ...
1
vote
2answers
2k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
0
votes
1answer
215 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
1
vote
2answers
101 views

Are there any artifacts for filesystem forensics in memory?

I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?