New answers tagged

0

This should be a given but as Anthony stated, you will want to contain the incident first and foremost. It wouldn't make much sense to try and collect evidence for a hack on a muti-million dollar company that trusts the security of it's information (client accounts, employee personal info, database files, etc) to you while an attacker was still free to do ...


1

In an security incident response situation, incident containment should come before evidence preservation. To give you an example, imagine a hack at your company. You would want to limit the ability of the hacker to compromise your company's system any more than he already did. Only after the incident has been contained, would evidence preservation come ...


1

Warning: This answer is pure speculation. It is also hard to get references for covert programs, but I've linked to Wikipedia pages which have some good references. I've also stayed away from examining WhatsApp's implementation, as there are several other Security SE posts discussing various aspects of it. I hope I have matched your scenario correctly in ...


1

This would be no different in design from TOR where your data is forwarded through nodes. There needs to be a separation of things here. First I will speak on "inference" which is what the government would aim for. Imagine there are a dozen in the group you speak of. The keyword is "apples" User1 --> "I will smash all apples" --> group Random Group ...


3

Some comments on previous answers (all good - SO is like watching really good crossword puzzle players.) An interesting topic which occasionally might be life-and-death important. (My overactive imagination at work, but battered women at a shelter whose location is critical to keep secret are an example that come to mind). Points that I hadn't considered ...


10

As a raster image program that does not use layers nor contain an undo history after saving, overwriting sensitive pixels in Paint irrevocably changes them in the saved image. More reasoning: Microsoft Paint is a proven simple piece of software with a long history and great popularity that works natively in simple raster image file formats. Serious flaws ...


5

JSON (nominally) doesn't have a file signature. File signatures (usually "magic" byte sequences with given offsets) exist in binary file formats; this includes executables, images, video, music, other media files, as well as numerous proprietary file formats. The purpose of file signatures is to provide a would-be API for identifying the type of hard-to-...


5

Technically there's no such thing like a JSON File. It's just a normal text file containing text in a JSON Format.


11

Already a few good answers here, saying Paint is safe. (I have no reason to believe otherwise.) Just want to add that while blacking out a rectangle that fully covers the area and any surrounding areas (lists that information is part of etc) using a basic well studied image editing program should be fairly safe, just using any image editor might not be ...


18

When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If someone removes the black cover they can see the pixels. The same applies to things like Foxit Reader (I almost sent a document with sensitive information which had ...


49

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not ...


180

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history. (Paint doesn't.) There are some things to watch out for, though: The width of the blanked region places an upper bound on the length of the secret data The height of ...


0

It sounds like the point is to discover if anti-forensic techniques leave their own distinctive, forensically-detectable evidence behind. In that case, you can probably choose to wipe the files with any method you want, regardless of how easy or difficult it is to recognize that wiping was performed, or what language is used to create the wiping routine. ...



Top 50 recent answers are included