Tag Info

New answers tagged

3

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set. So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the ...


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


1

The answer all depends on the rootkit and how it operated. There WILL BE remnants, but whether they are visible, encrypted, mangled, etc., are another story. Since you have a memory image, you can analyze it with Volatility, carve out data from the dmp with psdispscan if you can detect the anomaly from the memory. You could also use scalpel to do this but ...



Top 50 recent answers are included