Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
2
votes
1answer
61 views

Check TRIM space on SSD

Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
0
votes
1answer
38 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
0
votes
2answers
149 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
1
vote
1answer
125 views

Can I view a user's browser history if the history/cache has been cleared?

A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by ...
1
vote
0answers
54 views

Determining Windows version from a list of files

I have a list of files taken from a dead system, but not the actual files themselves, or any other information (e.g. properties) that would indicate the OS version. Is there a way to determine the ...
0
votes
1answer
62 views

Does Windows Device Encryption use a new key to encrypt each time?

Say I have a machine running Windows 10 with built in Device Encryption enabled. Say I want to reinstall Windows and sell the machine. I am wondering: after the format and reinstall, is a new key ...
0
votes
1answer
46 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
0
votes
0answers
59 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
0
votes
1answer
64 views

Windows forensic files

I'd like to back up important Windows files for forensic purposes. I am aware of the Event Logs and Anti Virus logs, are there any other logs or files that have personal use information, connections ...
0
votes
0answers
82 views

Can I view the format history of a usb key?

Is there a way to view when changes were made to a USB key, such as when the USB key was formatted and/or when some files were transferred? I have seen this previous stackexchange question File system ...
0
votes
0answers
44 views

Are last access time and location of connected devices recorded in iCloud?

During a Forensic investigation, I parsed the sysdiagnose log file /brctl/Brctl-dump.txt and I discovered 50 devices connected to the same iCloud account. Is it possible to retrieve from Apple the ...
0
votes
1answer
79 views

iCloud deletion

If I delete photos which are stored in iCloud from my phone. (Which is also linked to my iPad) I know the data is then made ‘free space’ but is still on the phone In some format. If I delete it from ...
1
vote
2answers
109 views

What’s the best way to permanently delete data from your iPhone?

As the title suggests what’s the best way to permanently delete data from an iPhone. I know when you delete something, it’s not really deleted, but merely marked as ‘free space’. So how, on an iPhone, ...
39
votes
7answers
7k views

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is ...
1
vote
1answer
73 views

Comparing two Linux system clones - what about non-regular files?

Could you please help me to understand the best approach to compare two filesystems / hard disks? As a practical learning exercise I created a clone of whole hard drive a month ago and again ...
0
votes
0answers
45 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
100
votes
4answers
14k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
0
votes
1answer
77 views

Identification of File Deletion Time

following problem: A file is marked as being deleted without a tracked time-deletion date. However, timestamps such as File Accessed, Entry Modified etc. point e. g. to the 30.12.2019. Is it safe to ...
0
votes
0answers
15 views

Is it possible to delete all traces and files on a mac? [duplicate]

Is it possible to delete all traces and files on a mac, so no one can recover files and there will be no traces at all for this files or any activity?
0
votes
2answers
77 views

Does software based file recovey solutions have the same results on real physical device vs dd image file?

I have a flash drive and I want to recover some files from it. Can I take a dd image of the device and perform the recovery operation on dd image instead? Does it have the same results when performing ...
1
vote
2answers
115 views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
1
vote
1answer
50 views

Finding artifacts using bulk_extractor in different methods [closed]

I have specific number of artifact, and I want to search for those particular artifacts in the disk image using the bulk_extractor tool via different methods using Random Sampling, Stop List, Alert ...
0
votes
1answer
95 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
2
votes
3answers
303 views

How to make information unrecoverable?

I manage a company's equipment and the manager has used a piece of equipment for the last 3 years. He told me, that he will give that equipment to one of the employees. However, he has told me to ...
0
votes
0answers
59 views

Is it possible to gather information about a destination-nat host?

Let's say that I'm connected to a network where the ISP has setup a dst-nat from an IP they don't control to an IP that they control,like so: 1- Their DNS server resolves example.xyz to 1.1.1.1 (the ...
0
votes
1answer
117 views

How to trace the remains of deleted files?

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise ...
3
votes
1answer
144 views

How to hide the fact that a system is virtual machine from malware

I've read that many types of malware scan a system for various clues regarding virtualization software, in order to stifle forensics. Is there any way to hide the fact that a computer is a virtual ...
23
votes
2answers
6k views

Is NTFS encrypted by default?

Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
1
vote
1answer
75 views

Host Protected Area (HPA) Imaging

I'm a student in the Digital Forensics department. I have to create an image of the HPA of my disk. I searched whole documents about creating HPA image ways but all of them are old methods. For ...
0
votes
0answers
81 views

Android Encryption: Can an attacker get the master key due to Android's default password and wear-leveling?

Since Android 5.0: Upon first boot, the device creates a randomly generated 128-bit master key and then hashes it with a default password and stored salt. The salt and the encrypted master key are ...
1
vote
1answer
185 views

Can I safely sell a used keyboard without risk of new owner recovering previous inputs?

As far as of my knowledge goes, keyboard don't store keystrokes in their memory by default (excluding those bundled with keyloggers). The thing that comes to my mind though is that some keyboards do ...
3
votes
4answers
2k views

How to physically destroy an SSD at home?

SSDs seem to be notoriously tricky to properly erase (see for example this question and answers here). An easier and potentially safer solution could be to physically destroy the SSD device. I am ...
0
votes
1answer
67 views

Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition

I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
1
vote
0answers
742 views

Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]

So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent: PS F:\> C:\Python27\python....
2
votes
1answer
156 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
1
vote
1answer
109 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
2
votes
1answer
95 views

Wannacry testing in lab - Not getting SMB scan attempts

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
1
vote
1answer
89 views

Scapy: Sending forged Probe Requests and capturing them in a different device

Objective: Sending a forged Probe Request frame from one machine and capturing it on a second machine. I have two codes running: sender.py interface = sys.argv[1] dot11 = Dot11(addr1='ff:ff:ff:ff:...
0
votes
1answer
270 views

DNS Tunnel or Not (g01.msn.com)

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before? User starts their computer, launches firefox.exe, then they hit c.msn.com ...
0
votes
0answers
135 views

Interpreting a Registry value of hashed password

I have been given a forensics challenge that contains a SYSTEM and SAM registry files as well as a wordlist. When using hivexsh (a registry analysis tool) I need to find the password (which I belive ...
0
votes
1answer
118 views

What is the significant difference between a Rogue Access Point & Client Mis-Association [closed]

As the title states, how can I differentiate both of them.
1
vote
0answers
41 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
1
vote
1answer
193 views

How Concerned should I be about VM Escapes?

I intend to start learning how to do malware analysis and forensics, but I have a concern or two. I want to start by just analysing code that I write myself, and that'll be fine. But at some point I'...
0
votes
0answers
109 views

Forensic image of hard disk on VMWare using Autopsy

Is there a recommended, forensically sound method of acquiring virtual hard drives on VMWare using Autopsy? Or is it a simple copy and paste? I’ve used other software like Caine in the past, where ...
1
vote
0answers
127 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
1
vote
0answers
114 views

Is it possible to obtain a forensic image of an Android device without installation of custom recovery mode or rooting?

I need to forensically image a Samsung phone that is not rooted or running a custom recovery mode. I have not been able to pull an image using ADB, as the default Samsung recovery mode only allows ADB ...
0
votes
0answers
43 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
3
votes
1answer
113 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple ...
3
votes
1answer
160 views

Alternative routes for Incident Response approach other than Windows Event Viewer?

I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
1
vote
0answers
914 views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...

1
2 3 4 5
10