2022 Developer Survey is open! Take survey.

Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
0 votes
1 answer
51 views

Is this 36 character long string a hash [closed]

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be?
user avatar
0 votes
0 answers
39 views

From a forensics standpoint how much leftovers do package managers in Linux leave behind?

Let's assume that for my question we're using the equivalent of apt purge, which also removes configuration files. What's left behind after apt purge and similar commands from other package managers? ...
user avatar
0 votes
1 answer
44 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
user avatar
0 votes
1 answer
50 views

Do popular pentest tools leave any digital fingerprints?

Do pentesting tools leave behind any information in order to identify the attacker?
user avatar
0 votes
0 answers
42 views

Does my jailbroken with root access iPad store any forensic evidence for usage of the lightning connector?

I am willing to give my iPad for a repair shop, but I would like to know whether they tamper with the OS in any way. Is there any way with or without special software to gather forensic evidence ...
user avatar
0 votes
0 answers
59 views

Any approach to copy the disk and take RAM shapshot of RouterOS (Mikrotik)?

everyone! I have discovered suspicious activity on one of Mikrotik Routers. This device had an outdated version of RouterOS with open ports web, winbox, etc. I believe that it was infected by malware, ...
user avatar
  • 46
0 votes
0 answers
51 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
user avatar
  • 41
0 votes
0 answers
100 views

Could "System Volume Information" be used to find out on which system the storage was used?

If one uses a storage device (USB stick or SD card) on Windows, then it leaves "System Volume Information" folder in the file system. Would there be a way so a forensic guy could definitely ...
user avatar
  • 21
0 votes
0 answers
69 views

Are there differences on how storages are formatted between different OS?

If one formats the same USB stick (or SD card) to FAT32 file system on Windows, or on Linux, or on Android - would there be differences so a forensic guy could definitely tell on which OS or even on ...
user avatar
  • 21
0 votes
0 answers
81 views

Which traces leave on a flash card after using it?

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android - would there be a way so a forensic guy could definitely tell on which computer the flash card was used by ...
user avatar
  • 21
1 vote
0 answers
95 views

What traces are left on a flash card reader after using it?

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used? I know OS can log ...
user avatar
  • 21
1 vote
1 answer
144 views

What traces are left on a USB stick after using it?

If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...
user avatar
  • 21
1 vote
1 answer
106 views

Why is it advisable to capture a disk image before shutting down? [closed]

I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
user avatar
0 votes
0 answers
64 views

Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF

This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating. I'm only here for guidance ...
user avatar
1 vote
1 answer
880 views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
user avatar
0 votes
1 answer
109 views

RAM as a attack target

What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer? What access requirements are necessary for this? Is a search in a hex dump always ...
user avatar
  • 246
0 votes
0 answers
81 views

"Intercepting" executable with FTK Imager

I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager. However, it looks like --given the environment I have-- the program only ...
user avatar
1 vote
0 answers
135 views

How to do forensics on RaspberryPi in home network?

while debugging some strange effects in my home network (bad video call quality due to packet loss) I found out this only happens when my RBPI is connected to the network. When I wanted to log in I ...
user avatar
  • 111
1 vote
0 answers
109 views

How to do a post-mortem after being hacked [closed]

I am wondering what the general steps are in retrospect for trying to find out how one ends up being hacked. A couple of times I have had Linux servers that ended up being hacked. I noticed this in ...
user avatar
  • 111
0 votes
0 answers
61 views

Identifying the method which an attacker used to harvest important account credentials, while the security logs are deleted

Is there a way to spot the method which an attacker used to do all of the necessary credential dumping, or stealing/forging tickets/using pass-the-hash/ticket techniques, if we don't have access to ...
user avatar
  • 33
0 votes
0 answers
85 views

Can voice analysis be used to determine if voice samples converted in two different ways are from the same person?

Suppose we have two voice samples, A and B, which are converted from the same person's voice into different voices respectively by a voice changer. In addition, let us assume that the voice conversion ...
user avatar
0 votes
1 answer
262 views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
user avatar
1 vote
2 answers
192 views

Create memory image of infected machine without risk

I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics. The problem is that the machine does not have the tools for ...
user avatar
0 votes
1 answer
118 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
user avatar
1 vote
1 answer
90 views

File based background data eraser

I am making a series of python scripts for data overwriting. My current prototype creates a series of large files and simply fills the memory (using a different system for additional overwrites). Is ...
user avatar
  • 13
0 votes
0 answers
81 views

How useful are memory forensic tools for detecting active attacks (considering current devices)

Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and ...
user avatar
1 vote
1 answer
536 views

Veracrypt SSD encryption security analysis vs HDD

I have a SSD and wanted to use Veracrypt for plausible deniability and protection against any & all level attacks e.g. state sponsored, non sponsored. My goal was to use a VM and place it in the ...
user avatar
0 votes
0 answers
31 views

how to check a device (mouse, USB-VGA, USB-HDMI) contains no malware [duplicate]

I got my fingers seriously burnt with some garbage bought online, which was a USB-3.0 to VGA cable. It contained a driver that requested an install, that led to my computer being unstable and a few ...
user avatar
2 votes
1 answer
216 views

Preserving crime evidence from a website I do not own

Is there a standard procedure when it comes to preserving evidence of a crime committed on a website of a third party? Let's assume that a crime was committed on a website I visit, like defamation. ...
user avatar
  • 33
1 vote
2 answers
329 views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
user avatar
  • 11
0 votes
3 answers
187 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user avatar
1 vote
0 answers
80 views

Image Scanning vs Document Scanning — How to tell difference? [closed]

I have a project where we are asked to assume the existence of a document D on a soft page which is handwritten in ink, a jpeg file of its native photograph (image A), and another discolored and ...
user avatar
  • 11
1 vote
0 answers
97 views

Recovering files with recovery key after double FileVault activation - is that possible?

Let's imagine I have a work macbook with ssd and I use FileVault, and the company has the FileVault recovery key. I want to make sure my data is erased and unrecoverable, what is the best way to ...
user avatar
  • 153
1 vote
0 answers
106 views

AuditD and SysCall alerts

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...
user avatar
  • 3,086
3 votes
1 answer
187 views

Google Chrome folder protection during HDD forensics

Is there any protection provided by Chrome browser against HDD dump and further forensics (with volatility-like tools)? For example, is it possible to extract google profile from Chrome folder and use ...
user avatar
  • 155
1 vote
1 answer
178 views

Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below. Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...
user avatar
  • 6,200
2 votes
2 answers
2k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
user avatar
  • 6,200
66 votes
3 answers
17k views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
4 votes
1 answer
446 views

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has ...
user avatar
0 votes
0 answers
115 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
user avatar
  • 1
-1 votes
1 answer
1k views

Can A Picture be Unredacted? [duplicate]

I know a text can be unredacted but can pictures too? I have a picture I would love to unredact can that be done? Please and Thank you.
user avatar
5 votes
1 answer
323 views

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
user avatar
5 votes
1 answer
881 views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
user avatar
0 votes
0 answers
30 views

How to track anonymous email sender (alternatives to IP tracking) [duplicate]

Are there any ways to get information on who is sending certain emails from an anonymous email address? Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
user avatar
1 vote
0 answers
210 views

Finding NonPagedPool Start and End Address using volatility

I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
user avatar
  • 201
1 vote
2 answers
255 views

Can someone know who created a cpp file?

I know that one can see the modification, access, and creation date of a file on Windows. And that the creation date, as well as other dates, can be modified at will. I just wonder if it is possible ...
user avatar
  • 179
28 votes
5 answers
7k views

Is a password-protected stolen laptop safe?

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity. If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for ...
user avatar
  • 809
1 vote
0 answers
180 views

What is the forensic procedure in investigating DDoS attacks

I'm currently in the process of researching for an assignment. In this assignment, I am asked to produce reports on new crimes enabled by technology and how, in Cyber Forensics, one would investigate ...
user avatar
0 votes
0 answers
91 views

Recovery files fails Raspberry Pi 3b

i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS I would like to start with forensics file management, and ...
user avatar
  • 121
0 votes
2 answers
7k views

How to dump the memory of a given process with Volatility 3?

It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3? The "old way" does not seem to work: If desired, the plugin can be used to ...
user avatar
  • 111

1
2 3 4 5
11