Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions to achieve certain goals.

learn more… | top users | synonyms

41
votes
5answers
28k views

Detecting Steganography in images

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
38
votes
9answers
6k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
20
votes
4answers
1k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
20
votes
3answers
7k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
18
votes
2answers
33k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
17
votes
5answers
562 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
15
votes
2answers
1k views

Can it be proved that two CDs were burned by different computers?

A friend of mine made a personal data CD. Days later he found a copy elsewhere. He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
14
votes
6answers
2k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
14
votes
2answers
968 views

Are there any tell-tale signs of self-hacking? [closed]

After the Mt.Gox crash, and also keeping in mind recently published attacks on Target and Neiman Marcus, one is led to believe that sometimes so-called hacking is perpetrated by insiders. What are ...
14
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
14
votes
1answer
898 views

Did someone really plug an iphone in, or are these symptoms of an exploit attempt?

My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
13
votes
3answers
23k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
10
votes
1answer
2k views

Do burned DVDs contain trackable information?

I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
9
votes
3answers
2k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
9
votes
1answer
313 views

Looking for signs of forensics - Assuming they didn't do the smart thing

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, ...
8
votes
3answers
1k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
8
votes
4answers
2k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
8
votes
4answers
455 views

Possible Rogue Admin

This does not involve me directly. However a friend believes her files are being tampered with and/or deleted by the only Windows domain admin there. (She has since kept backups) This started after ...
8
votes
1answer
417 views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
7
votes
5answers
1k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
7
votes
2answers
915 views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
7
votes
1answer
6k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
7
votes
0answers
370 views

Find the service creation date in Windows? [migrated]

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the ...
6
votes
3answers
530 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
6
votes
3answers
223 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
6
votes
4answers
414 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
6
votes
3answers
2k views

Hard disk forensics - Format & Image tracks

Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed. Any ...
6
votes
4answers
270 views

What do I need to be aware of to select a transfer method for digital forensic data?

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices? I would try to better explain this scenario, by considering a work ...
6
votes
2answers
128 views

“Fingerprinting” and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
6
votes
2answers
9k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
5
votes
1answer
284 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
5
votes
3answers
2k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
5
votes
8answers
3k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
5
votes
2answers
266 views

Special form of file system to prevent recovering after secure wipe data

I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe. Say, encrypted container via loop mounted like ext4 - journal file system. This is good ...
5
votes
1answer
902 views

What on earth is this log entry in Apache?

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4 [Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
5
votes
7answers
24k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
5
votes
2answers
3k views

Using EnCase to recover InPrivate browsing history

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible? If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
5
votes
2answers
474 views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
5
votes
1answer
247 views

Can DD on its own be used to acquire a hard drive?

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
5
votes
2answers
1k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
5
votes
2answers
8k views

How can you see the device history of a computer when doing forensics?

I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices ...
5
votes
3answers
342 views

Forensics on a SOHO router

I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to ...
5
votes
2answers
137 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
5
votes
2answers
429 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
5
votes
1answer
304 views

SMS PDU specification and carving techniques?

I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
4
votes
8answers
514 views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
4
votes
5answers
357 views

Tool to grab sensitive information from command lines [closed]

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
4
votes
4answers
2k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...