Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

32
votes
6answers
57k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
0
votes
1answer
88 views

Forensics, evidence collection vs data acquisition

I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events: Imaging the RAM on a live system; ...
3
votes
2answers
152 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
0
votes
0answers
24 views

What is the layers of abstraction (Digital Forensics)? [on hold]

Its my understanding that the layers of abstraction role is to translate abstraction layers into manageable data from 1's and 0's. But what exactly are the layers of abstraction?
0
votes
1answer
10 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
1
vote
2answers
45 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
0
votes
0answers
21 views

Memory Forensics dumping the memory contents of a running PID [closed]

There was an old security tool called PMdump that could dump memory contents of a running PID without disturbing those contents, which is useful for analyzing suspicious processes. However this tools ...
0
votes
0answers
24 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
4
votes
1answer
66 views

Can I tell Linux not to swap out the data space of a specific process?

I need to be able to write a program that uses a secret value that I want to ensure never gets written to disk during a page swap. The value is securely entered when the program starts, and gets ...
0
votes
1answer
19 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
0
votes
1answer
31 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
3
votes
2answers
7k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
2
votes
1answer
734 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
1
vote
2answers
694 views

Extracting Facebook ID or email from browser's history

While I was looking at my browser's history I noticed there has been a Facebook login from my computer, there are some Facebook related messaging and profile links in my browser history (chrome). The ...
1
vote
0answers
24 views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
1
vote
0answers
19 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
-2
votes
0answers
36 views

How to get complete memory dump in Windows 10? [migrated]

It is possible to get information like process ID, process type, physical & virtual address from a memory dump in Windows 10?
4
votes
2answers
112 views

How to determine if JPG EXIF data has been changed by “OEM” software (without third party tools)?

I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at 15:10:13, Dec 31, 2015 and I need to determine if this date ...
8
votes
1answer
128 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
3
votes
2answers
99 views

How to know the time of compilation

I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
15
votes
3answers
46k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
4
votes
1answer
79 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
-1
votes
2answers
42 views

How likely is it to find valuable information in the slack space of a workstation?

I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the ...
4
votes
1answer
113 views

How often should I check for unknown open ports

I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries. My question is how often should this job run so I ...
3
votes
1answer
72 views

Can a rootkit hide processes from “Volatility” or other memory forensics tools?

I know that a rootkit can hide processes from the OS by fooling around in the userspace. But can a rootkit also modify a processes metadata in a way that it won't even be recognized by a RAM forensic ...
4
votes
1answer
119 views

Convert raw memory dump into a format recognized by volatility

I dumped the RAM of a Windows 7 pc using LiveKd which basicly worked. The memory was dumped but then the convert of the binary dump into "summary format" failed. When I then tried to read the file ...
9
votes
3answers
169 views

Finding artifacts of software

I was wondering if there is an established way to know what a running particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
-4
votes
2answers
107 views

Can forensic investigators find my webmail emails in my laptop?

When I send an email using the web interface of Yahoo Mail or Gmail, can the email can be found somewhere (even if encrypted) on my laptop by forensic investigators? Somewhere on my hard drive or RAM? ...
0
votes
1answer
44 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
-1
votes
1answer
33 views

Regarding computer forensics and forensic accounting [closed]

I feel that these 2 forensic fields should work hand in hand. However, I do not have a background in computer science, but would like to upgrade myself to enhance my knowledge in this field. There ...
16
votes
7answers
3k views

Is there a need to image the hard drive when using a write blocker?

Forensics books often recommend working on an image of the hard drive instead of the original drive. Should I take this precaution even if I use a write blocker? If so, why?
19
votes
6answers
697 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
1
vote
1answer
89 views

Volatility Plugins Directory Using Windows

I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly ...
3
votes
4answers
59 views

Retrieving passcodes through forensic discovery

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery. What about the passcode itself? Is that encrypted too? Can forensic analysts ...
3
votes
2answers
100 views

The UK Terror Watchdog says this is very difficult in practise, is it?

I saw this quote today in the Guardian David Anderson QC, the terror legislation watchdog commissioned to report on the state of Britain’s surveillance laws in the aftermath of Snowden’s ...
-1
votes
1answer
127 views

WhatsApp Forensic Analysis [closed]

I was wondering if anyone is aware of any conferences that cover WhatsApp security on android or something similar. My project requires me to look for three conference papers and justify why they are ...
5
votes
1answer
85 views

Is the content of my RAM kept if the OS is shut down but the PC is still running?

I just asked myself if the content of my RAM is kept when I shut down the OS but the PC is still running. For example when I do apply updates they sometimes require a reboot. Is the informaiton that ...
3
votes
3answers
73 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
3
votes
2answers
127 views

Identifying EXIF Tampering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
3
votes
1answer
169 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
1answer
121 views

how to track IP address from which mail has been sent?

I am from India. I have get few mails from some random Gmail ID. How to get the information from which IP address it has been sent ?
3
votes
1answer
3k views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
2
votes
1answer
81 views

Selling used ram [DDr3 SODIMM]. Need to erase?

Does DDr3 SODIMM memory hold information after being removed? I would like to sell the memory I just removed from my computer, however I wasn't sure if I had to wipe/erase it first some how. Please ...
2
votes
2answers
120 views

Spyware on Sony Xperia z3 compact ? comand: adb reboot bootloader results in error device not found

Please help as I can not pay a forensic data investigator. For a while now I suspect to being spied on my computers and cellphones. I have two Sony xperia Z3 compact and both were acting strangely ...
6
votes
3answers
609 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
0
votes
1answer
53 views

Forensics live data collection

The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link). I'm also following an online training where the trainer collects live data (processes ...
5
votes
2answers
4k views

Using EnCase to recover InPrivate browsing history

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible? If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
1
vote
2answers
163 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
1
vote
1answer
87 views

Forensics procedures, volatile data collection [closed]

In forensics procedures, it's often recommended to thoroughly document a crime scene before proceeding to evidence collection. In case of volatile data, these evidences can be lost before having the ...
0
votes
2answers
41 views

Write blocker, blocked operations

In forensics, write blockers devices should block every operation that might change the hard drive content. Besides the write operation what other operations should a write blocker block?