Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

1
vote
1answer
65 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
1answer
32 views

How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?

I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode. Then, I search in ...
1
vote
3answers
85 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
1
vote
1answer
82 views

Mitigating TrueCrypt Attack Vectors in Memory and System Cache

While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names ...
1
vote
2answers
72 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
1
vote
1answer
207 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
1
vote
1answer
50 views

Are there any artifacts for filesystem forensics in memory?

I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?
1
vote
1answer
45 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
1
vote
1answer
61 views

Data recovery from file collections [closed]

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
1
vote
0answers
214 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
1
vote
0answers
306 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
0
votes
1answer
135 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...
0
votes
5answers
222 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
0
votes
3answers
383 views

Digital Forensic test image?

Does anyone know where I can get a free forensic test image for FTK? I need it to be below 5000 files for the demo. I found one but it is larger than 5k and it spits errors back at me.
0
votes
2answers
234 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
2answers
927 views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
0
votes
1answer
686 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
0
votes
1answer
88 views

What expertise is required to create an Windows intrusion report?

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
0
votes
2answers
129 views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
0
votes
2answers
181 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to ...
0
votes
2answers
535 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
0
votes
1answer
209 views

Definitions of computer forensics and information security [closed]

I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security What I want to know is: What is the ...
0
votes
2answers
2k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
0
votes
1answer
117 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
0
votes
1answer
390 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
0
votes
1answer
327 views

What is the full extent of information about my computer that a website can get?

I need to know what all information a random website can get from my computer, and whether a website can tell which of my two computers on the same router I'm using. I know websites can determine ...
0
votes
1answer
206 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...
0
votes
2answers
280 views

is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?

Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation Like Niksun or Solera solution do ? I'm ...
0
votes
0answers
17 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
0
votes
0answers
15 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
0
votes
0answers
16 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
-1
votes
1answer
2k views

Files deleted by some Employee . How to find what time it happened and whether done from another computer on network? [closed]

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What ...
-1
votes
1answer
530 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
-1
votes
0answers
25 views

Scalpel/foremost usage

Would anyone be able to give a rundown on how examine this image in a forensically sound manner using scalpel? (Maybe with using an example image) Here are the images: ...
-1
votes
0answers
9 views

Are there any data sets from previous mobile forensic acquisitions available?

Even though the question by itself arises big privacy concerns, I would like to ask if there are datasets publicly or under specific agreements available, related to post-mortem forensic acquisitions ...
-2
votes
2answers
425 views

Learn IP address of sender of a self-destructing email

How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?