Solving crimes with science!
5
votes
2answers
144 views
Using EnCase to recover InPrivate browsing history
I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible?
If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
2
votes
1answer
60 views
Can Windows 7 hibernation files be recovered?
As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
-3
votes
0answers
29 views
How much can I recover memory data from memory dump created when BSOD occurred? [closed]
Let's say in Windows 7 every Windows setting is set to default. Computer suddenly goes onto BSOD, and creates memory dump automatically. In this case, how much would one be able to read into memory ...
1
vote
1answer
114 views
Can particular object be detected and extracted from RAM? [closed]
I was Googling for a while now, and I don't seem to find what I am looking for.
Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
3
votes
1answer
79 views
What is the danger of the “FTP RNFR ././ attempt”?
I am analysing an old attack and I got a scenario which does not really make sense to me.
The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
21
votes
3answers
989 views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
5
votes
2answers
156 views
Forensics after web server compromise
I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :).
...
0
votes
3answers
7k views
How to detect if files were saved or copied to a USB drive?
How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
2
votes
3answers
222 views
How secure is wiping an encrypted Android device?
based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
0
votes
3answers
145 views
Digital Forensic test image?
Does anyone know where I can get a free forensic test image for FTK? I need it to be below 5000 files for the demo. I found one but it is larger than 5k and it spits errors back at me.
2
votes
2answers
128 views
How can I find the source of traffic allegedly originating from my IP address?
I have a problem that has been going on for at least 6 weeks.
I have Time Warner for my Internet provider and some websites hosted at GoDaddy.
From what GoDaddy tells me the reason I can not view ...
7
votes
3answers
720 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
6
votes
1answer
121 views
Can DD on its own be used to acquire a hard drive?
If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
0
votes
2answers
296 views
Why can't the police/government shut down black market websites? [duplicate]
I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
4
votes
1answer
100 views
Approaching a steganalysis challenge
I am currently doing one of the Honeynet.org challenges, specifically the 13th forensic challenge dealing with steganography. Several PNGs have been provided and participants are to find and extract ...
2
votes
1answer
112 views
Forensic Decoding Problem
I have a bunch of SMSs in Chinese from a forensic extraction of a blackberry bold 9780 via Cellebrite UFED. While messages in English are clear-text readable (making me feel that this has nothing to ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
2
votes
1answer
155 views
Secure erase iOS devices
All iOS devices from the iPhone 3GS have a hardware encryption chip, right?
When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
2
votes
0answers
74 views
SANS Forensic Course -worth it? [closed]
I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
4
votes
1answer
135 views
Accessing hidden partitons
I have two disks. They're both bootable and run Linux.
When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
4
votes
3answers
936 views
How to make / dump contents of memory for forensics analysis?
I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
5
votes
2answers
137 views
Linux forensics questions (ssh config, user activity)
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.
We're supposed to answer:
...
24
votes
5answers
6k views
Detecting Steganography in images
I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
0
votes
4answers
161 views
How does one go about network forensics investigation with no prior knowledge?
I am being asked to perform a forensics investigation on a network.
The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
0
votes
1answer
372 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
5
votes
3answers
131 views
What do I need to be aware of to select a transfer method for digital forensic data?
I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?
I would try to better explain this scenario, by considering a work ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
8
votes
1answer
313 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
8
votes
2answers
10k views
Can wiped SSD data be recovered?
I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
10
votes
3answers
2k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
5
votes
2answers
255 views
Connection on port 3387 Event viewer says “authorized”
This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
1
vote
1answer
157 views
File system history on USB drives
I want to find out who deleted a specific file from a USB disk.
The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
16
votes
5answers
464 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
2
votes
4answers
354 views
How to Investigate Wi-Fi Intrusion and where to look for evidence?
I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected.
eg. If someone with a wi-fi enabled laptop ...
1
vote
1answer
84 views
How does window.w3ssss hack occur
Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site.
While we have cleaned it up, I have not been able to ...
7
votes
3answers
874 views
How to recover securely deleted data
Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
3
votes
2answers
10k views
Can a SIM card be tracked without cell phone and battery?
I have a SIM card alone without cell phone and battery. Can it be be tracked?
1
vote
0answers
295 views
what the differences between cyber security, information security, computer forensics, digital forensics [closed]
what is the purpose or difference between of master cyber security, information security, computer forensics, digital forensics .i will to be computer investigator who is the best. Thanks
0
votes
0answers
57 views
How to use the Volatality Framework for Linux [closed]
I'm trying to run Volatality Framework on Linux memory Image but all the modules are for Windows,
So there are some other plug-ins available for Linux. Now it is asking for "--profile=XXXXX"
How I ...
1
vote
3answers
132 views
What I need checking when analysing an invasion?
A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc.
I know that I need first ...
0
votes
2answers
617 views
IS Maltego is the best forensic/intelligence solution out there? [closed]
i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web .
please recommend me the best software out there ... and if you ...
3
votes
4answers
398 views
Definitive certification list [closed]
What are a list of useful certificates for someone who wants to work on the information security field?
I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
4
votes
3answers
324 views
Access point fingerprinting
Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the ...
2
votes
1answer
64 views
Can we just provide VM snapshopts to LEA
Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation.
Have we thought of any policy guidelines where VM images/snapshots ...
0
votes
1answer
72 views
What expertise is required to create an Windows intrusion report?
I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
-2
votes
2answers
293 views
Learn IP address of sender of a self-destructing email
How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
4
votes
2answers
165 views
Did I miss anything when checking for passwords?
I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
4
votes
3answers
312 views
Android phone number from disk image
I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
1
vote
2answers
172 views
Windows process and socket capture
I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason.
The ...
3
votes
2answers
423 views
How do I run a security check on my WordPress server?
I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.
But I don't know how ...
