Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

learn more… | top users | synonyms

0
votes
1answer
2k views

What is the full extent of information about my computer that a website can get?

I need to know what all information a random website can get from my computer, and whether a website can tell which of my two computers on the same router I'm using. I know websites can determine ...
25
votes
4answers
1k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
2
votes
2answers
1k views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
4answers
1k views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
3
votes
2answers
110 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
39
votes
9answers
9k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
3
votes
1answer
860 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
10
votes
6answers
51k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
1answer
497 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...
0
votes
1answer
166 views

Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD)

Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file. With that as a random size criteria for discussion, CAN code be written to ...
1
vote
5answers
305 views

Deep international spy forensics: what hw really needs to be destroyed?

True Scenario: Representatives from the GCHQ went into The Guardian newspaper corporate office in London and demanded top secret data (leaked by Edward Snowden) be returned to authorities. The senior ...
5
votes
3answers
356 views

Special form of file system to prevent recovering after secure wipe data

I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe. Say, encrypted container via loop mounted like ext4 - journal file system. This is good ...
2
votes
2answers
225 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
1
vote
2answers
1k views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
7
votes
2answers
2k views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
-1
votes
1answer
7k views

Files deleted by some Employee . How to find what time it happened and whether done from another computer on network? [closed]

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What ...
0
votes
1answer
1k views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is xs:...
2
votes
1answer
219 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
7
votes
2answers
6k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say $...
0
votes
1answer
494 views

Definitions of computer forensics and information security [closed]

I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security What I want to know is: What is the ...
3
votes
1answer
1k views

Can Windows 7 hibernation files be recovered?

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
5
votes
2answers
4k views

Using EnCase to recover InPrivate browsing history

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible? If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
1
vote
1answer
294 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
3
votes
1answer
579 views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
5
votes
2answers
707 views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
2
votes
5answers
3k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
20
votes
3answers
13k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
4
votes
3answers
4k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
4
votes
5answers
3k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
5
votes
1answer
375 views

Can DD on its own be used to acquire a hard drive?

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
1
vote
2answers
2k views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
4
votes
1answer
407 views

Approaching a steganalysis challenge

I am currently doing one of the Honeynet.org challenges, specifically the 13th forensic challenge dealing with steganography. Several PNGs have been provided and participants are to find and extract ...
2
votes
1answer
259 views

Decoding SMS in Chinese extracted from a Blackberry

I have a bunch of SMSs in Chinese from a forensic extraction of a blackberry bold 9780 via Cellebrite UFED. While messages in English are clear-text readable (making me feel that this has nothing to ...
2
votes
0answers
169 views

SANS Forensic Course -worth it? [closed]

I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
4
votes
1answer
311 views

Accessing hidden partitons

I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
5
votes
2answers
2k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
3
votes
1answer
3k views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
1
vote
4answers
757 views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
0
votes
1answer
1k views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
6
votes
4answers
414 views

What do I need to be aware of to select a transfer method for digital forensic data?

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices? I would try to better explain this scenario, by considering a work ...
17
votes
3answers
53k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
1
vote
1answer
947 views

File system history on USB drives

I want to find out who deleted a specific file from a USB disk. The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
3
votes
5answers
12k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
1
vote
1answer
166 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
5
votes
2answers
570 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
3
votes
3answers
216 views

What I need checking when analysing an invasion?

A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc. I know that I need first ...
4
votes
3answers
134k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any monitoring/...
2
votes
2answers
5k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
4
votes
4answers
4k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...