Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

6
votes
6answers
35k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
0
votes
2answers
111 views

Forensic in Cloud environment

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to ...
1
vote
0answers
37 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
1answer
98 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
4
votes
1answer
112 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
1
vote
0answers
36 views

Identifying EXIF Tempering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
1
vote
1answer
152 views

Hidden OS: Decoy OS ≠ Hidden OS?

I wanted to use two different OS then two OS equal in the distinct functions: Hidden OS: Linux Decoy OS: Windows Has how? because what I have read until today were processes done with even OS, I do ...
13
votes
3answers
34k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
3
votes
2answers
279 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
1
vote
2answers
73 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
2
votes
2answers
81 views

Prove that a Breach Didn't Result in a Leak

I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access ...
1
vote
1answer
568 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
0
votes
1answer
36 views

Is it possible to detect the real IP from a modifed header [closed]

Is it possible to find the real IP from a header which seems to be changed in order to hide the sender's IP?
0
votes
2answers
70 views

How to make data in hard disk unrecoverable on linux [duplicate]

I need to wipe completely the data on my hard disk so it's unrecoverable. I'm actually using Linux, i have seen this command on the web, but I don't know if its secure. shred -zvn 35 /dev/sdb
3
votes
3answers
107 views

How do I know how a file got onto my computer?

I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually ...
0
votes
2answers
79 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
0
votes
0answers
48 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
1
vote
1answer
63 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
0
votes
0answers
39 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
1
vote
1answer
35 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
3
votes
3answers
101 views

How do I prevent SSD file recovery?

I use a Kingston V300 SSD (specifically SV300S37A) According to this answer The 'best' modern drives support a vendor-specific secure erase functionality. Examples of this are Intels new 320 ...
2
votes
1answer
116 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
1
vote
1answer
22 views

Resources needed in the protection of all activities related to the computer [closed]

Countries with strong censorship have agencies like NSA, of course they have not the same power and abilities but they could be very harmful; so we should be safe from their eyes and hands. My target ...
2
votes
2answers
102 views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user ...
1
vote
2answers
41 views

Are there standards for software disk image acquisition in forensics?

I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another ...
14
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
2
votes
1answer
91 views

Autopsy/SleuthKit in the courthouse? [closed]

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
1
vote
1answer
54 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
7
votes
3answers
5k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
-4
votes
2answers
109 views

Do webcams generates logs on operating system? [closed]

I would like to know if the activity of a webcam (date and hour when it was on, etc.) is stored somewhere in the operating system. Webcam to which I refer can be integrated or USB camera and the OS ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
1
vote
1answer
88 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
-1
votes
3answers
118 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
1
vote
1answer
250 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
1answer
41 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
1answer
43 views

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...
2
votes
2answers
104 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
1
vote
1answer
73 views

Forensics - Mounting Drives in RAM

From a computer forensics standpoint. If someone were to mount a partition in RAM using something like: mount -t tmpfs tmpfs /mnt -o size=1024m How much more difficult would it be to recover data ...
3
votes
5answers
3k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
1
vote
2answers
105 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
0
votes
1answer
110 views

Can you trace network attacker by ip address? [closed]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
1
vote
2answers
48 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
115 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
-1
votes
1answer
86 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
2answers
101 views

Are there any artifacts for filesystem forensics in memory?

I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?
-2
votes
1answer
138 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
5
votes
2answers
227 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
6
votes
3answers
409 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
2answers
2k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
0
votes
1answer
191 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?