New answers tagged

0

The only accepted way to erase data from a hard drive using magnetism is through a process called degaussing, which involves using an extremely powerful electromagnet which alternates its polarity thousands of times a second. It is the changing magnetic field which erases data, not the presence of magnetism itself. A human being cannot rotate a magnet fast ...


2

You can use Apache Tika and create your own program to extract metadata, it is pretty easy to do and here is a tutorial on how to do that. As the other answer says there is no surefire way to extract metadata from every type of file but Tika covers an alright amount.


1

The Unix/Linux file command will extract a lot of metadata inside files, and if you are using Windows, you can install cygwin to gain access to that command. Some example output: C:\Users\stewmark\ScreenShots>file *.png ChangePW.png: PNG image data, 1167 x 1046, 8-bit/color RGB, non-interlaced ChangePW_link.png: PNG image ...


3

Where metadata is stored will be up to the OS and the file that created it (as you say about Notepad and Word docs). Some file types even create a separate file just to hold the metadata. Because of #1, there is no free "give me all the metadata" tool. There are tools that can find the metadata of a wide range of well-known file types, though. Because of ...


3

With a weak kitchen magnet this can take many passes and a fair amount of time. In fact if all you have is a fridge magnet you may be better off scraping the strip off. However a more powerful magnet can erase the card fairly quickly. See http://www.creditcards.com/credit-card-news/video-magnets-make-credit-card-mag-stripe-not-work-1457.php for details. ...


1

If you happen to use a tool like IDAPro, you can debug your malware and check the content of the memory and registers When reaching any pre-selected debug breakpoint Instruction per instruction As mentionned here (https://www.hex-rays.com/products/ida/support/idadoc/1470.shtml), you can use IDAPro to take snapshots while you are in a suspended state ...


0

I just came across a DARPA project that appears to be what you're looking for. In particular the python based tool Differential Analysis of Malware in Memory (DAMM) by 504ENSICS Labs Disclaimer, I haven't used it.


2

First I want to address the DDR3 vs DDR4 issue. The differences between DDR3 and DDR4 are mostly voltage and clock speed. I've looked to see if there's any research on cold booting DDR4, and so far it looks like there's no academic papers out concerning their practicality. While commercial forensics labs may be performing cold boot attacks on DDR4 they're ...


1

When the FBI finally found the server it was due to the silkroad server leaking an IP address via captcha. The FBI was able to use that to track down the hosting provider. They showed up with a warrant and grabbed one of the drives. The Raid controller happily re-built the mirror onto a fresh drive and the operators never noticed. The FBI then had an ...


1

OK, I will try to focus on the part of "who". My question is is there a way to see who and how was able to edit these files? It depends, but what can you do is following: analyze server logs (auth, apache, ftp etc.) while you are analyzing logs keep in mind to check if there is any kind of information about pre-attack phase (sometimes attackers are ...


3

There is a canonical question entitled "How do I deal with a compromised server?". Since you are on a shared host, there are some limitations to what you can do. I still strongly recommend you to read the full accepted answer. Below I will discuss how this applies to your situation (i.e. on a shared hosting). Quotes are from the mentioned answer. 1. Take ...


2

Essentially, you would be looking at forensic investigation of the server, which would look in great detail at any access logs, error logs, files with unexpected timestamps, and so on, looking for the specific method that was used in this case. This would need to be carried out at a server level in order to be worthwhile, though, which wouldn't normally be ...


1

Burp Suite lets you save/restore the state of your current pen test. For me this typically means a log of all HTTP requests made. In addition to this you can save all HTTP requests that you sent for further examination/exploitation. It sounds like you want to track more than just the HTTP level of your attack, but I'm not sure that there is a single tool ...


1

You could write a script (in bash or python) to replay your commands and act as a local proxy for your commands execution. This way, you could split the results of the log into each commands. This script should not be too long to write for the gain you will get. That would be my solution :)


0

There are multiple layers of encryption available on iOS devices which I feel are best explained before saying what can and can't be accessed. Whole Disk Encryption For iOS 3 Apple introduced whole disk encryption where the entire hard-drive is encrypted when the device is locked. However the key for this encryption are held within the device so whole disk ...


2

If the IP address of the suspected RDP source is within your managed network, and if within your network, all your IP addresses are attributed through a correctly tracked process of IP managment: DHCP or radius or 802.1X, and if this IP address attribution mechanism is correctly logged on a protected log server: through syslog, then you can get a valid ...


1

However to prove that the source IP was not spoofed is it possible that I could find the MAC address of the PC from where the RDP session was initiated? An IP address is at the network layer while the MAC is at the data link layer (see OSI model). The IP address is the same when the data travel through the various networks while the MAC address changes ...


2

No. There is no guarantee the other machine has a MAC address at all. Following the IP over everything principle, the connecting partd may be sitting in a tree using IP over avian carriers - and pidgins do not have MAC addresses. You may only get a MAC address of an IP in your local network at the time the connection in done, as the mapping can change ...


1

Well, when talking about the internals of a computer, Any access point you can access physically without pulling hardware out, so basically anything you can attach a probe-lead to without causing a short. So what can what is not accessible. CPU, this is often only available for sniffing from when using specialized equipment in between the CPU and the ...


7

Short answer: That won't work. You'll need to degauss it, which will render the drive unusable. Long answer: Sure. Get a powerful magnet, put it next to the hard drive, with N facing the drive. Then flip it around so S faces the drive. Then flip it again, then again. Do this a few thousand times a second. If you do it any slower or just put it near the ...



Top 50 recent answers are included