Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
0
votes
1answer
40 views

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware. As far as I know, hibernation saves RAM memory ...
2
votes
0answers
81 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
2
votes
2answers
222 views

SD card planted in my pocket

Today, I found a SD card in my pocket. I've never seen it before and am nearly certain I didn't put it there myself. My suspicion is that someone stealthily planted it there while I was walking ...
1
vote
0answers
107 views

Forensics methods for obtaining WhatsApp data from Windows Desktop PCs

WhatsApp has the option to download a Windows (or Mac) Desktop version. Installation requires pairing the software with a mobile phone. I have read a similar question about Android devices, and ...
1
vote
0answers
78 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
4
votes
0answers
120 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
0
votes
0answers
51 views

Access Android files without entering pass-code

I have a Samsung A5 from a friend. Her screen is totally broken (black) and she wants me to recover her files. The problem is that you need to enter the pass-code of the phone in order to be able to ...
1
vote
1answer
91 views

Is it posible recover file from an encrypted home directory with a forensic tool?

Lately I have done forensic analysis on my computer(with photorec) to see how many deleted files I can recover. During the analysis I recover some photos and videos of my different partitions: Windows,...
1
vote
1answer
111 views

Is the SSH last login message reliable or rather something easy to get tampered with?

My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following: The Log ...
2
votes
3answers
192 views

How to investigate an IP address that was involved a security breach?

I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach? The specific situation is this - recently two of our servers were hacked into ...
3
votes
2answers
302 views

Analysis of hacked servers — daily RDP connections I can't find an obvious reason for

I'm cleaning up after an incident where a few servers were hacked. A new IDS has been put in place, the firewall has been upgraded, the services used in the attack are being replaced with more secure ...
0
votes
0answers
30 views

Opening a .raw file in FTKimager

I have this file link And I need to find evidence using FTKImager to find evidence of accessing “notable document.rft”. But I don't know how. I've opened the file and I see the other files that are ...
0
votes
0answers
16 views

WMI ActiveScriptEventConsumer Creation Datec

So recently I've been trying to solve a ctf. I was able to determine WMI persistence mechanism is used with the aid of ActiveScriptEventConsumer& EventFilter classes. I believe finding the ...
-1
votes
1answer
88 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
0
votes
1answer
79 views

Recovering data on unallocated space from FAT16 USB drive

I'm actually trying to make my hand around forensic and information security as a whole. To do this, I'm trying to make a lot of CTFs. The last one I got to do is puzzling me, 1st because I have no ...
1
vote
0answers
111 views

Can SSD data be recovered through Forensic Explorer?

I am trying to recover deleted files from a SSD using Forensic Explorer. Once the image processing on the SSD had been completed using the write blocker, I opened up AccessData FTK Imager and then I ...
0
votes
2answers
141 views

How do I list IP addresses a system is connecting to from its memory dump or OS image (obtained from FTK Imager)? [closed]

I'm looking for a tool that will enumerate the IP addresses that a system is connecting to. This is mainly for forensic purposes, to gather IOCs. I know we can run a netstat on windows, but would like ...
0
votes
0answers
48 views

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely ...
1
vote
0answers
72 views

Is there a way to get a forensic image of EC2 instance [closed]

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
0
votes
0answers
217 views

How to analyze a split EnCase Image with Volatility?

I acquired a RAM image using EnCase so that I can run it through Volatility. The acquired image came as a split image (i.e. .E01, .E02, etc.). How can I combine all the individual files as one raw ...
1
vote
1answer
106 views

Linux forensics- How can I extract sysfs procfs from a raw image?

I'm developing a software that extracts files from a Linux raw image (dd). I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders. I know ...
1
vote
0answers
90 views

The last logon time of the Administrator user in Windows 7 system is prior to the OS installation date, why?

What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS ...
1
vote
2answers
195 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
0
votes
3answers
178 views

Can you detect that new files were added to a hard drive that was removed and replaced?

The internal HDD was removed from my laptop (with Windows 7) and connected to another machine to tamper with. Some new files were also created/copied by the mischief maker. After the tampering was ...
5
votes
1answer
156 views

What forensic analysis can be done with physical access to a machine but without the hard drive?

What forensic analysis techniques target computer components other than the hard drive once the device is powered off?
2
votes
1answer
179 views

How to do forensis MBR hex dump?

I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ? I take copy bytes dump using my Ubuntu ...
1
vote
1answer
94 views

Understanding the philosophy of recovering data

It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells. But i wounder how the bytes ...
0
votes
1answer
114 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
0
votes
2answers
69 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
1
vote
2answers
123 views

How to view last run shell command via cmd.exe through a HKEY_CURRENT_USER.reg file?

I'm working on improving my security skills and a challenge I have is a .reg file which is HKEY_CURRENT_USER. I need to find what the last run command on the box was.
0
votes
0answers
16 views

Backup information with Disk2vhd?

To make a backup of a partition along with its metadata (dates of access, modification, etc) can Disk2vhd be used or is it necessary to make a copy sector by sector? I need to copy the information ...
0
votes
1answer
244 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
0
votes
0answers
188 views

Why do i get so many ADD [EAX], AL assembly in the output of malfind in volatility? (Memory Forensics)

I have a memory dump, and it has some malware in it and when i use the malfind command, almost all of the processes that it shows have a LOT of ADD [EAX], AL assembly commands, i know x86 but i don't ...
5
votes
0answers
335 views

Forensic investigation of a vehicle infotainment system [closed]

As far as I know most vehicle infotainment systems are run on a customized Linux system built with Yocto. Forensic toolkits such as Berla iVe allows to extract information such as GPS data, call log, ...
0
votes
2answers
165 views

Find the process that queries a malicious domain every 2 minutes

I found suspicious traffic in a client a few days ago. A process in the client queries a malicious domain every 2 minutes. The domain is hostingcloud.science that hosts a javascript file for coin ...
0
votes
1answer
44 views

Commodity Conversion Cables with Write Blockers

Looking at write-blocking devices I've notice a large variety of specialized hardware based on different source connector types, including USB-to-USB write blockers. It seems as though it should be ...
4
votes
1answer
226 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
2
votes
2answers
237 views

How to detect spyware over HTTP?

I am trying to detect spyware on my PC by traffic analysis. I am connected to a VPS (the sniffer) by a VPN and I am going to select all the sent data by the POST method. Is this correct? I mean the ...
0
votes
1answer
56 views

What does the existence of this file indicate? [closed]

C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk on a Microsoft Windows system, and use the xxd program to dump the contents of this file:
1
vote
2answers
320 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
0
votes
1answer
683 views

SRUM (system resource usage monitor) forensics - Windows server?

Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
2
votes
0answers
354 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
-1
votes
1answer
128 views

Recovering hidden contents from a jpg picture [duplicate]

Is there any way someone could recover hidden text from a jpg. For example in the picture
2
votes
4answers
115 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
0
votes
2answers
418 views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
1
vote
1answer
121 views

Verification After Data Wipe

A lot of data wipe algorithms have the final wiping pass with random characters. They discuss about verification after the wipe. An example of this is from this link: https://www.datanumen.com/blogs/...
0
votes
1answer
48 views

How to recover disk image from a smartphone in “bootloop” state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
0
votes
1answer
248 views

security leak in working with hardware write blockers?

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the ...
1
vote
2answers
95 views

How to capture not only the mtime but also the ctime when making forensic copies of files?

Context I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
2
votes
1answer
265 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...