Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

5
votes
2answers
684 views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
3
votes
1answer
799 views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
1
vote
4answers
420 views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
0
votes
1answer
608 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
6
votes
4answers
205 views

What do I need to be aware of to select a transfer method for digital forensic data?

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices? I would try to better explain this scenario, by considering a work ...
13
votes
3answers
12k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
1
vote
1answer
477 views

File system history on USB drives

I want to find out who deleted a specific file from a USB disk. The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
3
votes
5answers
3k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
1
vote
1answer
121 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
5
votes
2answers
359 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
7
votes
1answer
5k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
2
votes
3answers
156 views

What I need checking when analysing an invasion?

A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc. I know that I need first ...
1
vote
3answers
47k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
0
votes
2answers
2k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
3
votes
4answers
1k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
0
votes
3answers
307 views

Digital Forensic test image?

Does anyone know where I can get a free forensic test image for FTK? I need it to be below 5000 files for the demo. I found one but it is larger than 5k and it spits errors back at me.
2
votes
1answer
72 views

Can we just provide VM snapshopts to LEA

Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation. Have we thought of any policy guidelines where VM images/snapshots ...
0
votes
1answer
82 views

What expertise is required to create an Windows intrusion report?

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
-2
votes
2answers
394 views

Learn IP address of sender of a self-destructing email

How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
4
votes
2answers
177 views

Did I miss anything when checking for passwords?

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
3
votes
2answers
24k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?
4
votes
4answers
3k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
1
vote
2answers
280 views

Windows process and socket capture

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason. The ...
3
votes
2answers
767 views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
6
votes
4answers
334 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
4
votes
3answers
361 views

Android phone number from disk image

I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
1
vote
3answers
6k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
3
votes
5answers
312 views

Tool to grab sensitive information from command lines

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
1
vote
1answer
199 views

Detect Axcrypt files on hard drive

I have lost some Axcrypt files on my hard drive, as I have changed the extension. Is there a way to detect those files (via header, size, etc.) If not, are there some tools to detect discordance ...
3
votes
2answers
6k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
3
votes
1answer
471 views

Is XRY Forensic Tool able to extract data from iPhones?

As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
5
votes
2answers
4k views

How can you see the device history of a computer when doing forensics?

I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices ...
12
votes
2answers
24k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
10
votes
1answer
1k views

Do burned DVDs contain trackable information?

I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
5
votes
1answer
276 views

SMS PDU specification and carving techniques?

I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
4
votes
1answer
177 views

Data analyzer tools

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
4
votes
3answers
477 views

Access point fingerprinting

Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the ...
3
votes
3answers
1k views

What are some recommended open source tools for web browser history analysis?

I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
3
votes
3answers
2k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
14
votes
2answers
845 views

Can it be proved that two CDs were burned by different computers?

A friend of mine made a personal data CD. Days later he found a copy elsewhere. He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
4
votes
1answer
258 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to?) An is there a name for ...
8
votes
3answers
1k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
8
votes
4answers
418 views

Possible Rogue Admin

This does not involve me directly. However a friend believes her files are being tampered with and/or deleted by the only Windows domain admin there. (She has since kept backups) This started after ...
5
votes
1answer
823 views

What on earth is this log entry in Apache?

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4 [Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
9
votes
1answer
282 views

Looking for signs of forensics - Assuming they didn't do the smart thing

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, ...
2
votes
2answers
288 views

SOHO router intrusion

In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
17
votes
5answers
526 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
4
votes
1answer
265 views

Distance Education Programs in Digital Forensics

I am looking for a distance education program with the end product being a Masters of Science in Digital Forensics. I looked through the site and did not find any results, and was hoping since most ...
6
votes
3answers
469 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
6
votes
3answers
1k views

Hard disk forensics - Format & Image tracks

Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed. Any ...