Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

learn more… | top users | synonyms

5
votes
2answers
187 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
0
votes
2answers
216 views

Forensics, evidence collection vs data acquisition

I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events: Imaging the RAM on a live system; ...
3
votes
1answer
878 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
1
vote
1answer
61 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
3
votes
0answers
101 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
1
vote
0answers
32 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
1
vote
0answers
40 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
1
vote
0answers
64 views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
1
vote
0answers
36 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
1
vote
0answers
302 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
0
votes
0answers
188 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
0
votes
0answers
66 views

Can information be extracted from the CPU Register

To my knowledge, the Process Control Block (PCB), which stores information about the state of processes whilst they are on hold, is stored in the CPU Register, otherwise and additional Fetch cycle ...
0
votes
0answers
219 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From http://robert.penz.name/68/do-you-know-what-a-host-protected-area-...
0
votes
0answers
77 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...