Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

1
vote
1answer
95 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
3
votes
1answer
89 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
0
votes
2answers
46 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
0
votes
0answers
33 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
1answer
85 views

Hidden OS: Decoy OS ≠ Hidden OS?

I wanted to use two different OS then two OS equal in the distinct functions: Hidden OS: Linux Decoy OS: Windows Has how? because what I have read until today were processes done with even OS, I do ...
1
vote
1answer
46 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
0
votes
0answers
32 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
-2
votes
0answers
20 views

Topics to start an interest group at our company [closed]

Good afternoon everyone, I'm looking to start a Communities of Practice at my job. Our company is largely involved in application development for our customers but we also want to get into, what my ...
0
votes
0answers
18 views

Checking for changes on Linux live OS's [migrated]

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
1
vote
1answer
31 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
3
votes
3answers
68 views

How do I prevent SSD file recovery?

I use a Kingston V300 SSD (specifically SV300S37A) According to this answer The 'best' modern drives support a vendor-specific secure erase functionality. Examples of this are Intels new 320 ...
3
votes
1answer
221 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
1
vote
2answers
70 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
2
votes
1answer
85 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
1
vote
1answer
534 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
0
votes
0answers
25 views

How can I convert a domain controller account to local account for forensic analysis? [migrated]

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
0
votes
1answer
83 views

Forensic in Cloud environment

I'm new to forensic and I'm trying to do a simple research about forensic in the cloud. let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username ...
1
vote
1answer
19 views

Resources needed in the protection of all activities related to the computer [closed]

Countries with strong censorship have agencies like NSA, of course they have not the same power and abilities but they could be very harmful; so we should be safe from their eyes and hands. My target ...
0
votes
0answers
23 views

How come UAC logs are not being stored in Event Viewer? [migrated]

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
0answers
11 views

basic: adding a profile in Volatility [migrated]

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the ...
2
votes
2answers
78 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user ...
1
vote
2answers
34 views

Are there standards for software disk image acquisition in forensics?

I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another ...
14
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
2
votes
1answer
81 views

Autopsy/SleuthKit in the courthouse? [closed]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
1
vote
1answer
51 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
7
votes
3answers
4k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
-4
votes
2answers
102 views

Do webcams generates logs on operating system? [closed]

I would like to know if the activity of a webcam (date and hour when it was on, etc.) is stored somewhere in the operating system. Webcam to which I refer can be integrated or USB camera and the OS ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
1
vote
1answer
68 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
-1
votes
3answers
112 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
1
vote
1answer
225 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
1answer
39 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
1answer
41 views

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...
2
votes
2answers
98 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
1
vote
1answer
70 views

Forensics - Mounting Drives in RAM

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m How much more difficult would it be to recover data ...
3
votes
5answers
3k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
1
vote
2answers
89 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
0
votes
1answer
103 views

Can you trace network attacker by ip address? [closed]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
1
vote
2answers
43 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
111 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
-1
votes
1answer
69 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
2answers
100 views

Are there any artifacts for filesystem forensics in memory?

I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?
-2
votes
1answer
133 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
5
votes
2answers
214 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
6
votes
3answers
331 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
2answers
1k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
5
votes
7answers
32k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
1answer
156 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
2
votes
2answers
577 views

How can I identify which computers a USB drive has been used on?

Is there a way to find out in which and/or how many computers a USB flash disk entered. And if its possible can we find out how many times a file was read/edited. I heard that its possible , but I ...
4
votes
8answers
1k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...