Solving crimes with science!
24
votes
5answers
6k views
Detecting Steganography in images
I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
21
votes
3answers
947 views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
16
votes
5answers
463 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
14
votes
3answers
671 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
14
votes
2answers
689 views
Can it be proved that two CDs were burned by different computers?
A friend of mine made a personal data CD. Days later he found a copy elsewhere.
He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
13
votes
1answer
717 views
Did someone really plug an iphone in, or are these symptoms of an exploit attempt?
My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
11
votes
2answers
780 views
What should be included in a jump bag and how often should it be reviewed?
What items should be included in a jump bag? How often do you review your jump bag?
10
votes
3answers
1k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
9
votes
1answer
234 views
Looking for signs of forensics - Assuming they didn't do the smart thing
I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, ...
8
votes
2answers
10k views
Can wiped SSD data be recovered?
I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
8
votes
3answers
805 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
8
votes
4answers
383 views
Possible Rogue Admin
This does not involve me directly. However a friend believes her files are being tampered with and/or deleted by the only Windows domain admin there. (She has since kept backups) This started after ...
8
votes
1answer
313 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
7
votes
3answers
866 views
How to recover securely deleted data
Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
7
votes
3answers
718 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
7
votes
1answer
481 views
Do burned DVDs contain trackable information?
I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
6
votes
4answers
217 views
Finding date of last network access
I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
6
votes
1answer
121 views
Can DD on its own be used to acquire a hard drive?
If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?
6
votes
2answers
123 views
“Fingerprinting” and human error
Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
5
votes
3answers
394 views
Appropriate defense for 404s in my logs - persistent web scans from one region
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
5
votes
1answer
545 views
What on earth is this log entry in Apache?
error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4
[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
5
votes
2answers
152 views
Forensics after web server compromise
I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :).
...
5
votes
2answers
136 views
Linux forensics questions (ssh config, user activity)
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.
We're supposed to answer:
...
5
votes
3answers
128 views
What do I need to be aware of to select a transfer method for digital forensic data?
I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?
I would try to better explain this scenario, by considering a work ...
5
votes
3answers
788 views
Hard disk forensics - Format & Image tracks
Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed.
Any ...
5
votes
3answers
249 views
Forensics on a SOHO router
I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to ...
5
votes
2answers
255 views
Connection on port 3387 Event viewer says “authorized”
This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
5
votes
1answer
223 views
SMS PDU specification and carving techniques?
I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
1answer
213 views
What is it called when you give hackers a way in?
Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to?)
An is there a name for ...
4
votes
1answer
134 views
Accessing hidden partitons
I have two disks. They're both bootable and run Linux.
When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
4
votes
2answers
165 views
Did I miss anything when checking for passwords?
I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
4
votes
3answers
323 views
Access point fingerprinting
Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the ...
4
votes
3answers
923 views
How to make / dump contents of memory for forensics analysis?
I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
4
votes
1answer
100 views
Approaching a steganalysis challenge
I am currently doing one of the Honeynet.org challenges, specifically the 13th forensic challenge dealing with steganography. Several PNGs have been provided and participants are to find and extract ...
4
votes
3answers
312 views
Android phone number from disk image
I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
4
votes
1answer
164 views
Data analyzer tools
I have to find information that can be located in files on a hard drive.
Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
3
votes
2answers
10k views
Can a SIM card be tracked without cell phone and battery?
I have a SIM card alone without cell phone and battery. Can it be be tracked?
3
votes
5answers
260 views
Tool to grab sensitive information from command lines
Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps).
Is there a known tool to automate this kind ...
3
votes
4answers
391 views
Definitive certification list [closed]
What are a list of useful certificates for someone who wants to work on the information security field?
I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
3
votes
1answer
1k views
How can you see the device history of a computer when doing forensics?
I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices ...
3
votes
1answer
78 views
What is the danger of the “FTP RNFR ././ attempt”?
I am analysing an old attack and I got a scenario which does not really make sense to me.
The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
3
votes
3answers
1k views
Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?
How secure do you consider this process?
A drive has data from a previous OS installation.
A new OS installation is made on the drive, and Heidi Eraser is run on free space.
What are the chances ...
3
votes
2answers
418 views
How do I run a security check on my WordPress server?
I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.
But I don't know how ...
3
votes
1answer
370 views
Is XRY Forensic Tool able to extract data from iPhones?
As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
3
votes
3answers
641 views
What are some recommended open source tools for web browser history analysis?
I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
3
votes
1answer
224 views
Distance Education Programs in Digital Forensics
I am looking for a distance education program with the end product being a Masters of Science in Digital Forensics. I looked through the site and did not find any results, and was hoping since most ...
3
votes
1answer
233 views
Do you know any .xry reader for MacOS/*BSD or Linux?
I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
2
votes
3answers
216 views
How secure is wiping an encrypted Android device?
based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
