Tagged Questions

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

1
vote
1answer
363 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
5
votes
7answers
23k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
1answer
233 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...
0
votes
1answer
140 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...
0
votes
5answers
229 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
5
votes
2answers
260 views

Special form of file system to prevent recovering after secure wipe data

I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe. Say, encrypted container via loop mounted like ext4 - journal file system. This is good ...
2
votes
2answers
129 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
0
votes
2answers
642 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
7
votes
2answers
888 views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
-1
votes
1answer
2k views

Files deleted by some Employee . How to find what time it happened and whether done from another computer on network? [closed]

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What ...
-1
votes
1answer
584 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
2
votes
1answer
201 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
3
votes
2answers
2k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...
0
votes
1answer
225 views

Definitions of computer forensics and information security [closed]

I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security What I want to know is: What is the ...
2
votes
1answer
745 views

Can Windows 7 hibernation files be recovered?

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
5
votes
2answers
3k views

Using EnCase to recover InPrivate browsing history

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible? If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
1
vote
1answer
215 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
3
votes
1answer
282 views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
5
votes
2answers
464 views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
2
votes
5answers
1k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
20
votes
3answers
6k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
2
votes
3answers
3k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
3
votes
5answers
2k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
5
votes
1answer
245 views

Can DD on its own be used to acquire a hard drive?

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
0
votes
2answers
987 views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
4
votes
1answer
235 views

Approaching a steganalysis challenge

I am currently doing one of the Honeynet.org challenges, specifically the 13th forensic challenge dealing with steganography. Several PNGs have been provided and participants are to find and extract ...
2
votes
1answer
168 views

Decoding SMS in Chinese extracted from a Blackberry

I have a bunch of SMSs in Chinese from a forensic extraction of a blackberry bold 9780 via Cellebrite UFED. While messages in English are clear-text readable (making me feel that this has nothing to ...
2
votes
0answers
146 views

SANS Forensic Course -worth it? [closed]

I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
4
votes
1answer
238 views

Accessing hidden partitons

I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
5
votes
2answers
1k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
3
votes
1answer
2k views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
1
vote
4answers
495 views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
0
votes
1answer
728 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
6
votes
4answers
266 views

What do I need to be aware of to select a transfer method for digital forensic data?

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices? I would try to better explain this scenario, by considering a work ...
13
votes
3answers
22k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
1
vote
1answer
607 views

File system history on USB drives

I want to find out who deleted a specific file from a USB disk. The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
3
votes
5answers
5k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
1
vote
1answer
142 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
5
votes
2answers
423 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
7
votes
1answer
6k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
3
votes
3answers
169 views

What I need checking when analysing an invasion?

A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc. I know that I need first ...
1
vote
3answers
67k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
0
votes
2answers
2k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
4
votes
4answers
2k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
-1
votes
3answers
433 views

Digital Forensic test image?

Does anyone know where I can get a free forensic test image for FTK? I need it to be below 5000 files for the demo. I found one but it is larger than 5k and it spits errors back at me.
2
votes
1answer
74 views

Can we just provide VM snapshopts to LEA

Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation. Have we thought of any policy guidelines where VM images/snapshots ...
0
votes
1answer
88 views

What expertise is required to create an Windows intrusion report?

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
-2
votes
2answers
433 views

Learn IP address of sender of a self-destructing email

How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
4
votes
2answers
179 views

Did I miss anything when checking for passwords?

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
3
votes
2answers
34k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?