Tag Info

New answers tagged

4

Your points are good ones, and this is the interesting thing about tracing hacks: it is easy to cast suspicion, but is very difficult to conclusively prove where an attack came from. Some things that narrow the field: The language in which a program was written can often be determined, as you suggest. This is of course suggestive, but not definitive. ...


1

This is perfectly feasible. Current RAM only holds its storage while power is applied to it, so doing that in a mobile device is no different to doing it in a computer. And you are right - turning the power off will lose all data on the drive in a very short time frame. Your question 2 is irrelevant. All common RAM implementations can do this. All you are ...


1

You shouldn't get the image, they are already there on your vmware repos. You need only investigate them. It is best possible if you set up (or use a soon created) virtual machine. So: stop the comporomised VMs get away their disks give them to your investigating/service VM check everything from it. Luns haven't anything with them to do, they are only ...


1

Yes it is possible but unnecessary in your case. People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do. To defeat forensics all you need is full disk encryption ...


0

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter? Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than ...


0

It depends. The kernel can use swapfiles as backing store for a tmpfs filesystem: if the kernel decides that it needs to swap out something to free up physical RAM, the contents of the filesystem are candidates for swapping out, either in whole or in part. If you're lucky (or unlucky), coherent pieces of data will wind up in the swapfile for an ...


0

@JohnCharles117 Your media destruction policy should directly support your data destruction policy, and your data destruction policy should be based upon your threat model and hte value of your data assets. Per NISPOM (DoD 5220.22-M, section 8, table 1) as recently as 1997 allowed for media destruction via securely overwriting the medium via a special ...


0

What you are referring to what I call a heuristic investigation where the investigator tracks a particular behaviour and tries to tie that to an individual. This technique is used in many fields not just cyber-forensics. The method your article most likely proposed was somehow obtaining a list of the keyword th3j35t3r correlated with IP addresses that ...


-1

In addition to Google Analytics, Google Webmaster Tools can also provide you with information about words people are searching for to discover your website. Additionally, certain SEO toolsets such as Raven Tools can provide details about what keywords are driving traffic to a website.


0

Please download something like Parted Magic or Hirens boot cd. There are tools on these disks to secure erase your hard drive or SSD. I personally use Parted Magic just because I find it easy to work with. just start a ATA secure erase. The normal command will overwrite all user data with zeros, the enhanced version of the command will overwrite all bad ...



Top 50 recent answers are included