Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

3
votes
1answer
67 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
3
votes
1answer
394 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
3
votes
1answer
1k views

Can Windows 7 hibernation files be recovered?

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
3
votes
2answers
152 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
3
votes
1answer
80 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
3
votes
4answers
59 views

Retrieving passcodes through forensic discovery

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery. What about the passcode itself? Is that encrypted too? Can forensic analysts ...
2
votes
2answers
845 views

How can I identify which computers a USB drive has been used on?

Is there a way to find out in which and/or how many computers a USB flash disk entered. And if its possible can we find out how many times a file was read/edited. I heard that its possible , but I ...
2
votes
5answers
2k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
2
votes
4answers
1k views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
2answers
326 views

SOHO router intrusion

In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
2
votes
2answers
964 views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
1answer
81 views

Selling used ram [DDr3 SODIMM]. Need to erase?

Does DDr3 SODIMM memory hold information after being removed? I would like to sell the memory I just removed from my computer, however I wasn't sure if I had to wipe/erase it first some how. Please ...
2
votes
1answer
138 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
1answer
240 views

Decoding SMS in Chinese extracted from a Blackberry

I have a bunch of SMSs in Chinese from a forensic extraction of a blackberry bold 9780 via Cellebrite UFED. While messages in English are clear-text readable (making me feel that this has nothing to ...
2
votes
1answer
80 views

Can we just provide VM snapshopts to LEA

Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation. Have we thought of any policy guidelines where VM images/snapshots ...
2
votes
1answer
193 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
2
votes
1answer
86 views

Forensics Tools on Linux Servers

I am trying to consolidate a list of security tools for our data center servers. We are predominantly Linux shop (RHEL) with some Windows 2008/12 servers. The core business is Software as a Service, ...
2
votes
1answer
266 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
2
votes
2answers
454 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
2
votes
2answers
406 views

What can I do with private 128 bit AES Keys?

For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is ...
2
votes
1answer
729 views

Is XRY Forensic Tool able to extract data from iPhones?

As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
2
votes
2answers
120 views

Spyware on Sony Xperia z3 compact ? comand: adb reboot bootloader results in error device not found

Please help as I can not pay a forensic data investigator. For a while now I suspect to being spied on my computers and cellphones. I have two Sony xperia Z3 compact and both were acting strangely ...
2
votes
1answer
33 views

Forensics hdparm command

I'm new to forensics and I don't know yet what I'm allowed to do or not. I would like to know if I'm allowed to issue the following command hdparm -I /dev/sdb where /dev/sdb is the hard drive to ...
2
votes
2answers
306 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user ...
2
votes
1answer
201 views

Autopsy/SleuthKit in the courthouse? [closed]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
2
votes
2answers
159 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
2
votes
1answer
353 views

An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?

I'm trying to simulate a possible attack scenario for my studies. I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too. ...
2
votes
2answers
200 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
2
votes
1answer
734 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
2
votes
1answer
215 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
2
votes
0answers
167 views

SANS Forensic Course -worth it? [closed]

I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
2
votes
2answers
4k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
2
votes
4answers
177 views

Can data be forensically retrieved off an encrypted hard drive?

If a hard drive is encrypted, is it still possible to retrieve data off of it? What about if the password to decrypt it is known? If this is the case, given that OSX now encrypts your drive by ...
1
vote
2answers
45 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
1
vote
5answers
288 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
1
vote
4answers
689 views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
1
vote
3answers
12k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
1
vote
1answer
369 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
2answers
2k views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
1
vote
2answers
411 views

Windows process and socket capture

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason. The ...
1
vote
1answer
304 views

Detect Axcrypt files on hard drive

I have lost some Axcrypt files on my hard drive, as I have changed the extension. Is there a way to detect those files (via header, size, etc.) If not, are there some tools to detect discordance ...
1
vote
1answer
93 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
1
vote
2answers
210 views

How does police or somebody find out that an Arp Spoofing attack was done?

If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see ...
1
vote
1answer
878 views

File system history on USB drives

I want to find out who deleted a specific file from a USB disk. The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
1
vote
1answer
162 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
1
vote
1answer
121 views

how to track IP address from which mail has been sent?

I am from India. I have get few mails from some random Gmail ID. How to get the information from which IP address it has been sent ?
1
vote
1answer
131 views

Can data be tampered with after expert clones a drive?

Introduction 3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were ...
1
vote
1answer
69 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
1
vote
1answer
404 views

What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
1
vote
2answers
3k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.