Tag Info

New answers tagged

2

Unless you are going to use the tool's agents during an investigation, I would keep the forensic tools off of production servers. Generally these tools are intended to be run in a client environment, such as on an investigator's laptop or desktop. There are a few reasons for this suggestion: persistence of forensic tools in a server environment can make ...


1

It depends when you need to detect it, when it is happening or after the fact. Live detection is much easier because you can hook system functions that are used to inject DLLs and log the information. When a process debugs itself, it will get notifications when DLLs are loaded. Or you can list DLLs periodically and see differences. There are many methods ...


2

in all practicality, producing the photograph of the acquisition hash and showing the new and old hashes match will satisfy almost everyone that the drive hasn't been tampered with. However... The most accurate answer is that, depending on what hash algorithms the investigators used, they may not be able to prove the data was unchanged. If the hash ...



Top 50 recent answers are included