Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

1
vote
2answers
167 views

How does police or somebody find out that an Arp Spoofing attack was done?

If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see ...
2
votes
2answers
381 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
3
votes
2answers
82 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
3
votes
4answers
518 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
2
votes
2answers
2k views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
299 views

An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?

I'm trying to simulate a possible attack scenario for my studies. I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too. ...
0
votes
2answers
739 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
1answer
168 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
2
votes
2answers
304 views

What can I do with private 128 bit AES Keys?

For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is ...
1
vote
4answers
2k views

Is it possible to recover securely deleted data from H.D.D using the forensics?

I just want to know if it's possible to recover and see securely(or wiped out) deleted data from H.D.D using forensics ? Imagine police have arrested a hacker and that hacker,before getting ...
7
votes
3answers
4k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
14
votes
2answers
984 views

Are there any tell-tale signs of self-hacking? [closed]

After the Mt.Gox crash, and also keeping in mind recently published attacks on Target and Neiman Marcus, one is led to believe that sometimes so-called hacking is perpetrated by insiders. What are ...
0
votes
1answer
960 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
1
vote
0answers
232 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
7
votes
5answers
2k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
14
votes
6answers
2k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
0
votes
2answers
195 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to ...
0
votes
1answer
624 views

What is the full extent of information about my computer that a website can get?

I need to know what all information a random website can get from my computer, and whether a website can tell which of my two computers on the same router I'm using. I know websites can determine ...
20
votes
4answers
1k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
2
votes
2answers
792 views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
4answers
685 views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
2answers
100 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
39
votes
9answers
7k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
1
vote
1answer
504 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
5
votes
7answers
31k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
1answer
302 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...
0
votes
1answer
149 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...
1
vote
5answers
253 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
5
votes
2answers
288 views

Special form of file system to prevent recovering after secure wipe data

I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe. Say, encrypted container via loop mounted like ext4 - journal file system. This is good ...
2
votes
2answers
142 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
0
votes
2answers
737 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
7
votes
2answers
1k views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
-1
votes
1answer
3k views

Files deleted by some Employee . How to find what time it happened and whether done from another computer on network? [closed]

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What ...
-1
votes
1answer
710 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
2
votes
1answer
208 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
3
votes
2answers
3k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...
0
votes
1answer
274 views

Definitions of computer forensics and information security [closed]

I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security What I want to know is: What is the ...
2
votes
1answer
874 views

Can Windows 7 hibernation files be recovered?

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
5
votes
2answers
3k views

Using EnCase to recover InPrivate browsing history

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible? If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
1
vote
1answer
228 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
3
votes
1answer
354 views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
5
votes
2answers
550 views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
2
votes
5answers
1k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
20
votes
3answers
8k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
2
votes
3answers
3k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
3
votes
5answers
2k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
5
votes
1answer
260 views

Can DD on its own be used to acquire a hard drive?

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
0
votes
2answers
1k views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
4
votes
1answer
272 views

Approaching a steganalysis challenge

I am currently doing one of the Honeynet.org challenges, specifically the 13th forensic challenge dealing with steganography. Several PNGs have been provided and participants are to find and extract ...
2
votes
1answer
182 views

Decoding SMS in Chinese extracted from a Blackberry

I have a bunch of SMSs in Chinese from a forensic extraction of a blackberry bold 9780 via Cellebrite UFED. While messages in English are clear-text readable (making me feel that this has nothing to ...