Tag Info

New answers tagged

9

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is ...


3

When you paint over a jpg or png file, you are not putting a sticker over the image, you are more ripping a hole on the image and filling the hole with ink. Even on Photoshop, if you export the picture as jpg it will flatten the image, merging all layers together and destroying the original obscured area forever. There's no way to reconstruct the original ...


2

No, the security is no better. The typical formats used for screenshots (JPEG or PNG) are not image formats that support layers like say, a PSD does. When you add the green scribble, you're not adding a layer, you're replacing part of the image. The extra step, the screenshot-of-a-screenshot should give you an image file that's materially the same. ...


1

Simply turning on the machine can already alter/destroy data that can be potential evidence, let alone booting its original OS. The best solution is to remove the hard drive, connect it to another computer through a hardware write blocker and then grab a complete image of it with dd or some equivalent. The write blocker is necessary to prevent accidental ...


0

My gut is that you don't know how long ago you've been hacked. By patching the site and combing for known vulnerabilities, you're basically hoping the hacker doesn't know what he's doing. The first thing the hacker probably did was to delete the logs and install multiple backdoors. Even if you properly patch the system, even if you scrub every ...


0

Generally speaking you should take close to the following steps: Secure your site and regain access Lock down the site and prevent all external access. Try to avoid "contamination" in the process by modifying potentially compromised files If you need to retain an on-line presence then set up something like a separate landing page hosted on an isolated ...


2

I would do a few more things to clean up the site: Change every password Yes, before you do anything, change all admin passwords, ftp, ssh, MySQL and so. Move all website's files to an inaccessible folder Take the site offline and put a Under Maintenance sign to give you time to fix everything. This will disable any changed file from the attacker. Shells ...


-1

You can scan the site to find if the hacker had put some javascript using the admin account. If he did it he can keep stealing cookies from site users! You should also change all passwords including MySQL password and FTP password.


0

You can hash/extract each artifact (in a VM) and compare that with a malware database. I assume you have already taken a forensically sound image of the system of course.


0

One possible solution would be to take a forensically sound image of the target (entire HDD or a specific area or even the RAM) before and after the program you are wanting to analyze runs. Then simply* compare the two images. I would start with comparing hashes just to be certain something did change (so you dont waste time 'looking'). Many times, ...



Top 50 recent answers are included