Hot answers tagged forensics
22
Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs.
The following research paper studies erasure of data on SSDs:
...
17
To detect Steganography it really comes down to statistical analysis (not a subject I know very well).
But here are a few pages that may help you out.
Steganography Countermeasures and detection - Wikipedia page worth a read to cover the basics.
An Overview of Steganography for the Computer Forensics Examiner - Has quite a long list of tools and some ...
15
Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag.
My bag specifically contains:
Several Network Cables ...
14
This is an excellent and important question. There are several important techniques to know about:
Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...
12
The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete.
And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly.
What you ...
12
The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own.
However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).
12
It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all.
Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...
12
There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605
In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...
11
This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation.
Realize that your system is malfunctioning. It is not operating the the way it was intended to.
Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...
11
Probably someone trying to create an account on your forum and proceed to spam it.
I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43
When you URL decode the string two times and google the string you find a lot of spam on different forums.
URL Decoded one time:
èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì ...
10
The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis.
Historically I would use
EnCase
Helix LiveCD
Argus
Recently I have started moving away from that combination and on to
Argus
Autopsy - For aquisition and system analysis
BackTrack (Forensics ...
10
This is pretty well the background noise of the Internet. Since phpMyAdmin had such a poor security history it is not uncommon to see systems looking for instances of it running on the network. Chances are, that is exactly what is happening. There are a few things you could do to take action on such an activity, though which one, or ones, you choose will ...
10
I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen.
First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies.
You need to isolate access to the laptop. Shut it down completely,
boot ...
10
As tempting as it may be to try to use tools to defend herself (i.e. using personal equipment) or to catch the rogue admin in the act (logging, file integrity monitoring, etc.) many organizations have policies prohibiting these activities.
Your friend should be careful not to compromise her own integrity in response to this individual's actions. This is ...
10
Have you seen the Tor document on how a Tor Hidden Service works?
Essentially, in the same way that it's hard to find the source of traffic from a Tor exit node, it's hard to find the server operating a Tor Hidden Service. Authorities can't shut down the server, because they can't find out where it is.
The .onion TLD is not really a TLD (so there is no ...
9
Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like.
As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...
8
I'll second the reccomendation for Stegdetect: here's another good source for information http://www.outguess.org/detection.php as well as downloads for stegbreak and XSteg
You can go right to the source for the research on this if you're interested; Neil Provos's page is here http://www.citi.umich.edu/u/provos/stego/
8
See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives.
On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...
8
how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap?
There are three basic methods: multiple copies, error correction, and enhanced detection.
A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...
8
According to Microsoft (via here), CD burners can leave a digital fingerprint of sorts. What's necessary to detect and compare them, or whether it's within the reach with consumer technology I don't know though.
8
Additionally to Adnan and AndyMac's answers, which focus mostly on access to logs, if the police decide to monitor an individual that has a high enough profile (think terrorists etc) then they can explicitly request a wiretap - which in this day and age is a little more advanced than the old line tap.
The wiretap can be set up to pass every piece of traffic ...
7
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
Step one: Disconnect the machine in question from all communications channels: Ethernet, WiFi, Bluetooth, serial, Firewire, USB, audio cable, Infrared, parallel. Only the power cable, keyboard cable, and monitor cable should remain connected. Check ...
7
It is more common for people to have iPhones than 0-day exploits and there for its more likely that someone really did plug in an iphone. That being said, its entirely possible to exploit a machine via USB. In this case the ipheth kernel module could have been exploited and there is really no way to know from this log, its simply not enough information. ...
7
Yes, those are just scanning scripts, looking for vulnerable versions of phpmyadmin and other software to exploit.
There are various ways to combat such problems.
One of them is through utilities like fail2ban, that (among other things) can monitor web server logs and ban IPs on the firewall matching your criteria.
In your specific case, look at this post ...
7
How can I work out how they've been hidden
Hiding partitions is actually relatively straightforward. First up, some theory.
Your disk is a big bunch of memory addresses as far as the operating system knows - we call this LBA addressing. Ignore everything your read about CHS unless you're dealing with XP and earlier - modern hard disks do not come with ...
7
I love to answer these questions, and I feel a bit excited/proud that you'd choose Security.StackExchange to ask this question.
According to The Data Retention (EC Directive) Regulations of 2009, Internet Service Providers (ISP) are required to keep some data for 12 months. This includes which IP address people have been assigned, plus log-in and log-off ...
6
There's some great general references in the other answers here, so I'll just give some input specific to your situation:
When hiding data in pictures without changing the file size, you put it in the low-order bits; this can be detected by opening in an editor with a histogram and looking for jagged edges. But this sounds like a concantenation of a file ...
6
The other possibility to gain keychain content is the $5 wrench. Or, as it's known in the UK, the 50p chocolate bar.
6
Well, for the first 3 questions I would perform a full examination on the machine back at the office. We are lucky enough to have ongoing network monitoring in several locations in our network, both in the form of firewalls and flow collectors.
Flow Records from Argus (similar to Net- or J-flows)
Firewall logs (from both 'near by' hosts and hardware ...
6
If the information is of that high level, after the isolation and forensics parts are done it never ever leaves the organisation functional and in one piece. You could securely wipe and reuse it for the purpose of usage under the same high classification if needed, but again - it stays within the organisation. When the laptop is ready for retirement it gets ...
Only top voted, non community-wiki answers of a minimum length are eligible
