Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

1
vote
1answer
33 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
1
vote
1answer
57 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
1
vote
1answer
393 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
1
vote
0answers
220 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
0
votes
0answers
16 views

Removing Virtual Guest Additions Safely

So say I have a virtual machine that has been handed to me by an end user for forensics. It's a virtual machine exported as an appliance. I don't want VirtualBox's guest additions or VMWare Tools to ...
0
votes
0answers
33 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...