Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

2
votes
1answer
59 views

Identifying EXIF Tempering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
2
votes
1answer
95 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
4
votes
1answer
109 views

Finding artefacts of software

I was wondering if there is an established way to know what a running particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
3
votes
4answers
6k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
2
votes
1answer
66 views

Forensics Tools on Linux Servers

I am trying to consolidate a list of security tools for our data center servers. We are predominantly Linux shop (RHEL) with some Windows 2008/12 servers. The core business is Software as a Service, ...
0
votes
0answers
31 views

What artifacts to acquire when looking for IoC?

I want to hunt for the Indicators of Compromise (IoC) in a potentially infected Windows PC. I am writing a batch script that would record the information needed for analysis. It includes the ...
2
votes
2answers
92 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
2
votes
1answer
607 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
1
vote
1answer
35 views

Detecting the source of dll injection

Is it possible to determine the process that performed DLL injection against a victim process?
1
vote
1answer
96 views

Can data be tampered with after expert clones a drive?

Introduction 3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were ...
0
votes
1answer
50 views

Going to host a “hidden service”, should I “wipe” or edit file metadata?

I have made a site that is a hidden service on the Tor network. I was wondering if there any security risks by leaving metadata untouched for various files including but not limited to stylesheets ...
2
votes
4answers
116 views

Can data be forensically retrieved off an encrypted hard drive?

If a hard drive is encrypted, is it still possible to retrieve data off of it? What about if the password to decrypt it is known? If this is the case, given that OSX now encrypts your drive by ...
25
votes
2answers
47k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
4
votes
5answers
173 views

Online Shop got hacked, fixed but is still under attack - what to do?

an xt-commerce-based online shop from a friend of mine got hacked recently. The attacker mailed that the shop is vulnerable, he showed the extracted data (basically he dumped the databases and cracked ...
4
votes
3answers
93 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
1
vote
1answer
60 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
5
votes
3answers
388 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
9
votes
6answers
39k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
2answers
121 views

Forensic in Cloud environment

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to ...
4
votes
1answer
124 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
1
vote
1answer
163 views

Hidden OS: Decoy OS ≠ Hidden OS?

I wanted to use two different OS then two OS equal in the distinct functions: Hidden OS: Linux Decoy OS: Windows Has how? because what I have read until today were processes done with even OS, I do ...
13
votes
3answers
38k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
3
votes
2answers
93 views

Prove that a Breach Didn't Result in a Leak

I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access ...
0
votes
1answer
41 views

Is it possible to detect the real IP from a modifed header [closed]

Is it possible to find the real IP from a header which seems to be changed in order to hide the sender's IP?
0
votes
2answers
118 views

How to make data in hard disk unrecoverable on linux [duplicate]

I need to wipe completely the data on my hard disk so it's unrecoverable. I'm actually using Linux, i have seen this command on the web, but I don't know if its secure. shred -zvn 35 /dev/sdb
3
votes
3answers
121 views

How do I know how a file got onto my computer?

I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually ...
0
votes
2answers
152 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
0
votes
0answers
66 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
2
votes
1answer
87 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
0
votes
0answers
50 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
1
vote
1answer
36 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
3
votes
3answers
181 views

How do I prevent SSD file recovery?

I use a Kingston V300 SSD (specifically SV300S37A) According to this answer The 'best' modern drives support a vendor-specific secure erase functionality. Examples of this are Intels new 320 ...
2
votes
1answer
185 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
1
vote
1answer
22 views

Resources needed in the protection of all activities related to the computer [closed]

Countries with strong censorship have agencies like NSA, of course they have not the same power and abilities but they could be very harmful; so we should be safe from their eyes and hands. My target ...
2
votes
2answers
163 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user ...
1
vote
2answers
52 views

Are there standards for software disk image acquisition in forensics?

I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another ...
15
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
2
votes
1answer
102 views

Autopsy/SleuthKit in the courthouse? [closed]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
1
vote
1answer
56 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
7
votes
3answers
5k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
-5
votes
2answers
132 views

Do webcams generates logs on operating system? [closed]

I would like to know if the activity of a webcam (date and hour when it was on, etc.) is stored somewhere in the operating system. Webcam to which I refer can be integrated or USB camera and the OS ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
1
vote
1answer
111 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
-1
votes
3answers
145 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
1
vote
1answer
293 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
1answer
50 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
1answer
50 views

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...
2
votes
2answers
122 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
1
vote
1answer
76 views

Forensics - Mounting Drives in RAM

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m How much more difficult would it be to recover data ...
3
votes
5answers
3k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...