Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

0
votes
0answers
11 views

Backup information with Disk2vhd?

To make a backup of a partition along with its metadata (dates of access, modification, etc) can Disk2vhd be used or is it necessary to make a copy sector by sector? I need to copy the information ...
0
votes
1answer
23 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
0
votes
0answers
30 views

Why do i get so many ADD [EAX], AL assembly in the output of malfind in volatility? (Memory Forensics)

I have a memory dump, and it has some malware in it and when i use the malfind command, almost all of the processes that it shows have a LOT of ADD [EAX], AL assembly commands, i know x86 but i don't ...
-1
votes
0answers
91 views

Is VirtualBox Disk Encryption safe?

I start using Disk Encryption for my Virtual Machine AES-XTS256-PLAIN64. But after I encrypt the Virtual Machine I can't use Eraser inside Virtual Machine it gives errors. And now I can't securely ...
5
votes
0answers
94 views

Forensic investigation of a vehicle infotainment system [closed]

As far as I know most vehicle infotainment systems are run on a customized Linux system built with Yocto. Forensic toolkits such as Berla iVe allows to extract information such as GPS data, call log, ...
0
votes
2answers
95 views

Find the process that queries a malicious domain every 2 minutes

I found suspicious traffic in a client a few days ago. A process in the client queries a malicious domain every 2 minutes. The domain is hostingcloud.science that hosts a javascript file for coin ...
0
votes
1answer
29 views

Commodity Conversion Cables with Write Blockers

Looking at write-blocking devices I've notice a large variety of specialized hardware based on different source connector types, including USB-to-USB write blockers. It seems as though it should be ...
4
votes
1answer
106 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
2
votes
2answers
113 views

how to detect a spyware over http?

I am trying to detect a spyware on my pc by traffic analysis. I am connected to a vps (the sniffer) by a vpn and I am going to select all the sent data by the post method. Is this correct ? I mean the ...
0
votes
1answer
47 views

What does the existence of this file indicate? [closed]

C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk on a Microsoft Windows system, and use the xxd program to dump the contents of this file:
1
vote
1answer
109 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
0
votes
1answer
91 views

SRUM (system resource usage monitor) forensics - Windows server?

Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
2
votes
0answers
125 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
-1
votes
1answer
69 views

Recovering hidden contents from a jpg picture [duplicate]

Is there any way someone could recover hidden text from a jpg. For example in the picture
2
votes
4answers
112 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
0
votes
2answers
118 views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
1
vote
1answer
58 views

Verification After Data Wipe

A lot of data wipe algorithms have the final wiping pass with random characters. They discuss about verification after the wipe. An example of this is from this link: https://www.datanumen.com/blogs/...
0
votes
1answer
34 views

How to recover disk image from a smartphone in “bootloop” state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
0
votes
1answer
109 views

security leak in working with hardware write blockers?

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the ...
1
vote
2answers
55 views

How to capture not only the mtime but also the ctime when making forensic copies of files?

Context I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
1
vote
1answer
221 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
0
votes
0answers
39 views

Forensic software to clone phone physical volume and bypass passcode

I've seen on some forensic blogs dealing with recovering phone data, it will be noted that a phone with a passcode set and usb debugging disabled can still be accessed through specific tools or ...
0
votes
0answers
878 views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
1
vote
1answer
164 views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...
4
votes
1answer
142 views

Which protocol could have been likely candidates for leaking a laptop serial number

Having read this article, one line in particular caught my attention: The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
3
votes
1answer
56 views

Methodology for finding existing adversary presence on network

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is ...
4
votes
0answers
511 views

What type of data can be recovered from the swap file / page file and thumbs file

This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
1
vote
2answers
248 views

Linux command to wipe files on an SD Card?

Are there any commands, tools or python libraries to securely wipe specific files from an SD or micro SD card (devices that use flash memory)? For example, with a regular magnetic hard drive, you can ...
0
votes
2answers
58 views

Are contents of PHP sessions forensically valuable?

PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/...
0
votes
2answers
167 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
0
votes
1answer
50 views

What frameworks are available to analyze a security breach?

I come from an engineering background where we use tools like 5-times-why or 8D for Root Cause Analysis. Are there similar frameworks to perform an analysis on a reported a security incident?
7
votes
1answer
348 views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
1
vote
2answers
152 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
2
votes
1answer
201 views

Cloning a system for forensic analysis

How can I clone a system without leaving any footprint? I want to acquire RAM and other physical hard drives so that after cloning all the work can be done in VM without disturbing the target machine. ...
1
vote
2answers
370 views

Secure erase hard drive [duplicate]

What device/method do you usually use to securely erase a hard drive? The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later, I can ...
-2
votes
1answer
262 views

Types of evidence in Digital Forensic

While studying Digital Forensic, I am getting puzzled between different types of evidence, especially circumstantial and corroborative evidence. Hypothetical scenario: An IDS alert is generated due ...
1
vote
1answer
42 views

Retrieved files were corrupted after file carving

I have used scalpel to carve files from a memory dump. But some of the image files are incomplete or corrupted . I cannot see an image preview. What will be the reason for this ?
2
votes
1answer
405 views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
13
votes
1answer
398 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
135
votes
8answers
18k views

Secure way of masking out sensitive information in screenshots? [duplicate]

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below I ...
2
votes
1answer
247 views

Encrypted data embedded in JPG and Other file types

This is some data found near the end of a JPG file: 18{8uck3y3$} ! 18{b4063c521f76545d8c94e999dd63f445d8c01cfc} # 18{U2FsdGVkX19RJjdBbDB51ok1hkFXaB91NpZNoQjbVXYlMeMTaWRTdg==}? Other files on the ...
2
votes
0answers
201 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
-1
votes
1answer
75 views

What is the role of procmon in responding to malware? [closed]

I am forced respond to malware with procmon. I do not understand how to use procmon (createFile, RegQueryKeyValue, ...) to help. Is it possible to explain to me these operation? Thank you.
1
vote
0answers
48 views

Hardware Write Blocked SD Reader [closed]

I needed to look into getting a hardware write blocker that will be compatible with SD cards. I've come across the Tableau Forensic USB 3.0 Bridge and the CRU USB 3.0 WriteBlocker Does anyone ...
4
votes
1answer
310 views

Volatility Forensics with Large dumps

Today I was tasked with the analysis of a .vmem file of a Windows RDS one of our customers due to some "strange" connections coming from native Windows processes. The extracted .vmem file has a size ...
2
votes
2answers
237 views

Can a forensic exam find an image's geographic metadata after geotagging was disabled?

We recently did a lab in my computer forensics class where we analyzed images of a suspect's phone, and used the metadata of the photos found therein to show he was in the vicinity of where a crime ...
12
votes
2answers
1k views

Do XSS attempts leave any trace on the server?

If I do a test with a classic <script>alert(1)</script>, does the website owner see my attempt? Does XSS leave some trace behind? I will try to build a little server on my Ubuntu with a ...
2
votes
1answer
372 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
1
vote
1answer
95 views

Is it possible for digital forensic evidence to be multiple types of evidence at the same time?

I'm studying for the CCSP certification and the online training course I'm taking is a little vague on the topic of evidence types (within the context of digital forensics). Specifically, I'd like ...
3
votes
2answers
177 views

What's a practical example of how volatile information can be preserved in a digital forensics investigation?

I'm taking a study course on CCSP and am going over a section on the digital forensics investigation process. In particular, the instructor discussed the following: I'm curious on two bullet points ...