Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

3
votes
2answers
277 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
1
vote
2answers
73 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
1
vote
1answer
98 views

Finding artefacts of software

I was wondering if there is an established way to tell what running a particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
1
vote
1answer
568 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
1
vote
0answers
35 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
0answers
35 views

Identifying EXIF Tempering

Is it really impossible to detect changes to EXIF data? Reading from this link, it seems that it is not possible to detect EXIF changes: ...
1
vote
0answers
236 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
0
votes
0answers
48 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
0answers
39 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
0
votes
0answers
49 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...