Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

0
votes
0answers
10 views

MSc in Cyber Security admission interview [on hold]

I've graduated in Computer Science and I'm now applying to the MSc course in Cyber Security in Tallinn. Skype interview The purpose of the interview is to verify the candidate's suitability ...
0
votes
0answers
46 views

What other actions can I take to remove malware from an compromised device and how do I do them? [on hold]

My device has been infected with a RAT (Remote Access Trojan) or whatever the phone equivalent is. Here is my device info: Model: Samsung Galaxy Note 5 (CDMA) (SM-N920V) Service Provider: Verizon ...
1
vote
0answers
37 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
2
votes
1answer
31 views

Can data be restored from a hard drive after using magnets to wipe the data?

Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
-1
votes
3answers
40 views

Forensic analysis of file metadata

Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware ...
4
votes
1answer
70 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
5
votes
2answers
56 views

Is there anyway to analyze memory dynamically?

I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
7
votes
1answer
89 views

Methods of cold boot attacks in the wild

As far as I know, there are two methods for performing cold boot attacks: Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports ...
1
vote
0answers
22 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
4
votes
3answers
93 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
0
votes
1answer
43 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
1
vote
3answers
148 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
2
votes
2answers
3k views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
2
votes
1answer
801 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
4
votes
2answers
52 views

frameworks for collecting all activities in a pentest

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm ...
1
vote
0answers
37 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
4
votes
2answers
348 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
0
votes
2answers
152 views

Forensics, evidence collection vs data acquisition

I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events: Imaging the RAM on a live system; ...
3
votes
2answers
172 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
1
vote
3answers
48 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
8
votes
2answers
173 views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
2
votes
1answer
34 views

What buses carrying sensitive information on a running computer are vulnerable to sniffing?

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to ...
0
votes
1answer
45 views

Which forensic disk image format should be preferred?

I want take a forensic image of an hard disk. However I am a little confused on which format should I take the image. DD (raw) or E01? What are the advantages and disadvantages of each?
7
votes
2answers
245 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
0
votes
2answers
101 views

Forensics live data collection

The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link). I'm also following an online training where the trainer collects live data (processes ...
3
votes
0answers
47 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
10
votes
3answers
2k views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
17
votes
3answers
50k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
4
votes
1answer
69 views

Detect PC Boot from Live CD

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained? I suspect my PC has been booted through a ...
0
votes
1answer
30 views

How can I secure the state of a compromised iPhone for evidence of evil before resetting it?

I'm a web developer and generalist programmer with a bit of mobile experience. A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
3
votes
2answers
119 views

Need some recommendations on good IR hands-on training

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
4
votes
3answers
126k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
-1
votes
1answer
72 views
33
votes
6answers
62k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
0
votes
1answer
18 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
1
vote
2answers
63 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
0
votes
0answers
128 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
3
votes
1answer
76 views

Can I tell Linux not to swap out the data space of a specific process?

I need to be able to write a program that uses a secret value that I want to ensure never gets written to disk during a page swap. The value is securely entered when the program starts, and gets ...
0
votes
1answer
26 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
4
votes
2answers
8k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
1
vote
2answers
743 views

Extracting Facebook ID or email from browser's history

While I was looking at my browser's history I noticed there has been a Facebook login from my computer, there are some Facebook related messaging and profile links in my browser history (chrome). The ...
1
vote
0answers
40 views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
1
vote
0answers
29 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
4
votes
2answers
165 views

How to determine if JPG EXIF data has been changed by “OEM” software (without third party tools)?

I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at 15:10:13, Dec 31, 2015 and I need to determine if this date ...
8
votes
1answer
151 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
3
votes
2answers
106 views

How to know the time of compilation

I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
4
votes
1answer
118 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
-1
votes
2answers
51 views

How likely is it to find valuable information in the slack space of a workstation?

I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the ...