Tagged Questions
-3
votes
0answers
29 views
How much can I recover memory data from memory dump created when BSOD occurred? [closed]
Let's say in Windows 7 every Windows setting is set to default. Computer suddenly goes onto BSOD, and creates memory dump automatically. In this case, how much would one be able to read into memory ...
2
votes
1answer
59 views
Can Windows 7 hibernation files be recovered?
As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
0
votes
3answers
7k views
How to detect if files were saved or copied to a USB drive?
How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
0
votes
1answer
72 views
What expertise is required to create an Windows intrusion report?
I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
4
votes
3answers
933 views
How to make / dump contents of memory for forensics analysis?
I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
1
vote
2answers
172 views
Windows process and socket capture
I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason.
The ...
6
votes
4answers
217 views
Finding date of last network access
I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
