Tag Info

New answers tagged

1

Beyond the tools that Kyle mentions if you need something you need to run from time to time check out BriMorLabs Live Response Collection it might be able to provide you all the data you could use to start to do a root cause analysis on the system.


2

Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any ...


0

It depends on the type of device First and foremost, the kind of information you can recover depends on what kind of device and how that device is used. For instance, a USB attached drive has very different information than a NAS solution. USB Attached Devices USB Attached devices are treated as a typical disk. The forensic information you could recover ...


2

If you just want to entirely wipe the disk and start over, ATA Secure Erase is what you want. It's a single command supported by almost all modern SSDs which changes the onboard crypto key (SSDs encrypt all data transparently at the physical level) to make all data on the disk unreadable. The reason for this mechanism existing is that wiping data from SSDs ...


1

To have a high confidence that deleted data is not recoverable you will want to use disk or file encryption that employs anti-forensic techniques like TKS1. Many disk encryption systems empty anti-forensic measures. LUKS uses TKS1. The basic idea is that you have some probability p of destroying a block through disk's deletion mechanism. This also means ...


0

If you want to check by your own means if the secure erase has been successful, then you can always try to use some file restoration tools or, certainly better, directly edit the disk and manually check it. However, there is still some trust remaining toward the disk manufacturer. Without mentioning backdoors, and sadly there are some, there are also simple ...


1

Any application can easily submit any DNS resolution request. There are numerous libraries available and programmers can choose to perform the resolutions whichever way they want. For example, in Python it's one line of code (maybe two) import dns.resolver answers = dns.resolver.query('dnspython.org', 'MX') To link an actual application to the UDP ...



Top 50 recent answers are included