Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

learn more… | top users | synonyms

34
votes
6answers
67k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
54
votes
5answers
63k views

Detecting Steganography in images

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
6
votes
3answers
625 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I don'...
11
votes
3answers
3k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
8
votes
2answers
229 views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
144
votes
6answers
27k views

How secure is 'blacking out' sensitive information using Paint?

I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint? Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
22
votes
7answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
17
votes
4answers
1k views

Network Forensics - what is in your toolbox

In similar vein to this question on computer forensics, what tools would you have in your toolbox for infrastructure and network forensics. Typical example cases would be if you were called in either ...
15
votes
1answer
2k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
19
votes
3answers
4k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
10
votes
6answers
51k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
4
votes
2answers
442 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What data/...
9
votes
4answers
5k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
8
votes
1answer
164 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
5
votes
4answers
8k views

Is it possible to recover securely deleted data from H.D.D using the forensics?

I just want to know if it's possible to recover and see securely(or wiped out) deleted data from H.D.D using forensics ? Imagine police have arrested a hacker and that hacker,before getting caught,...
1
vote
3answers
13k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
20
votes
3answers
3k views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I 'blur/...
4
votes
3answers
137k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any monitoring/...
8
votes
3answers
1k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
15
votes
2answers
2k views

Can it be proved that two CDs were burned by different computers?

A friend of mine made a personal data CD. Days later he found a copy elsewhere. He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
4
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
8
votes
3answers
2k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
8
votes
1answer
581 views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
5
votes
2answers
710 views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
4
votes
1answer
204 views

Data analyzer tools [closed]

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
1
vote
1answer
123 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
6
votes
8answers
4k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
5answers
3k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
4
votes
5answers
4k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
3
votes
1answer
605 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
2
votes
5answers
3k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
1
vote
1answer
231 views

Mitigating TrueCrypt Attack Vectors in Memory and System Cache

While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names (...
1
vote
2answers
405 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user name,...
0
votes
1answer
167 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...