Tag Info

New answers tagged


I try not to do this but this is very much a yes and no answer. Tools like FTK Remote Agent run as a service on the system. An investigator can connect to those tools and perform tasks (such as pulling a remote image of that particular system.) If you were to walk into the data center of AWS and could get console level access and installed than ran your ...


The following Google search produces a number of academic papers. inurl:\.edu\/ filetype:pdf password manager As a test you could run bulk_extractor on a memory image looking for a known username/password combination.


Faraz you are correct from the perspective of a security professional. However as Herringbone_Cat noted, from management perspective, you want to contain the damage as much as possible. If no data has been leaked then you would like to keep the breach quiet as not to damage company reputation; especially if you are publicly traded because it could cost ...


Forensic analysis can be conducted, even without auditing on the filesystem, to determine file access and piece together the potential scope of a breach. Basically all filesystems in use on modern computers are journaling file systems, which contain a sort of circular log trail. Using tools to read deleted/overwritten disk sectors, one can begin to see ...


No, the IP header will have been modified to remove the sender's real IP. If you believe the packet with the altered header originated within your network, you may be able to check network logs to find the origin of the packet.

Top 50 recent answers are included