Questions tagged [forensics]
Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.
504
questions
0
votes
0
answers
21
views
Log analysis of suspicious activity [closed]
I have taken a DFIR course, but I have not worked with an SME. Looking at this SuperTimeline output, I saw something like what is pictured. SVCHOST executing from prefetch and the file then being ...
0
votes
1
answer
62
views
As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
- 1,542
1
vote
0
answers
48
views
MMLS (Sleuth Kit) not working in some situations
I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create ...
1
vote
1
answer
69
views
Reducing web browser artifacts from a web developers perspective
Situation:
Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
- 11
0
votes
1
answer
71
views
What might one want to accomplish by running ffmpeg -i video.mp4 -map 0 -map_metadata 0:s:0 -c copy video.mp4 in terms of forensics?
In the eighth episode of the second series of Mr. Robot, Trenton
does this to the video that was recorded by a VHS camera before releasing it to the public via Vimeo.
ffmpeg -i fuxFBI.mp4 -map 0 -...
- 137
1
vote
1
answer
58
views
Cuckoo dump a PE file from a memory dump?
Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process.
There is Process-...
- 113
0
votes
0
answers
146
views
Creating disk image with FTK Imager: Failure: The specified network resource or device is no longer available. (55)
I want to image a drive with FTK Imager's feature 'Create Disk Image' but the external hard drive has some issues. The external HDD does not appear in Windows File Explorer but it appears in Disk ...
- 400
1
vote
1
answer
139
views
How to make a virtual machine forensics-proof - completely or to the maximum possible level?
I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
- 119
1
vote
1
answer
79
views
Reasons for recovering small amounts of deleted data from SSDs
In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs.
For their experiments, they wrote large amounts of text to ...
- 459
0
votes
1
answer
187
views
Is there a way to get Windows login password hint from SAM hive with volatility?
We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
- 23
1
vote
0
answers
1k
views
How to extract a RSA private key from an ssh-agent core dump
I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
- 11
0
votes
0
answers
58
views
malicious dll making GET & POST requests to legit sites. What could it be doing?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp ...
- 1
0
votes
1
answer
351
views
Is this 36 character long string a hash [closed]
I found this string
b2335332-d28f-449b-8d00-80a550b43046
Do you think it´s a hash?
If yes any idea which one and if not any other ideas what it could be?
0
votes
0
answers
64
views
From a forensics standpoint how much leftovers do package managers in Linux leave behind?
Let's assume that for my question we're using the equivalent of apt purge, which also removes configuration files. What's left behind after apt purge and similar commands from other package managers?
...
- 1,542
0
votes
1
answer
144
views
How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?
An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so:
#define CONNECTIONS 1
They then attack with xerxes-executable mydomain 433.
Their strategy is to ...
- 137
0
votes
1
answer
60
views
Do popular pentest tools leave any digital fingerprints?
Do pentesting tools leave behind any information in order to identify the attacker?
0
votes
0
answers
72
views
Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?
Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
- 41
1
vote
0
answers
115
views
What traces are left on a flash card reader after using it? [duplicate]
If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used?
I know OS can log ...
- 21
1
vote
1
answer
476
views
What traces are left on a USB stick after using it?
If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick?
I know OS can log which ...
- 21
1
vote
1
answer
124
views
Why is it advisable to capture a disk image before shutting down? [closed]
I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
0
votes
0
answers
68
views
Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF
This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating.
I'm only here for guidance ...
1
vote
1
answer
2k
views
How to identify hidden processes with volatility using psxview?
I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes.
The assignment was,
It's fairly common for malware to attempt to hide itself and the
process ...
- 11
0
votes
1
answer
116
views
RAM as a attack target
What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer?
What access requirements are necessary for this? Is a search in a hex dump always ...
- 246
0
votes
0
answers
85
views
"Intercepting" executable with FTK Imager
I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager.
However, it looks like --given the environment I have-- the program only ...
- 23
1
vote
0
answers
151
views
How to do forensics on RaspberryPi in home network?
while debugging some strange effects in my home network (bad video call quality due to packet loss) I found out this only happens when my RBPI is connected to the network. When I wanted to log in I ...
- 111
1
vote
0
answers
116
views
How to do a post-mortem after being hacked [closed]
I am wondering what the general steps are in retrospect for trying to find out how one ends up being hacked.
A couple of times I have had Linux servers that ended up being hacked. I noticed this in ...
- 111
0
votes
1
answer
518
views
How do I get a forensic copy of an EC2 server?
Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
1
vote
2
answers
358
views
Create memory image of infected machine without risk
I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics.
The problem is that the machine does not have the tools for ...
- 11
0
votes
1
answer
143
views
Memory Forensics on exited process
I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
1
vote
1
answer
91
views
File based background data eraser
I am making a series of python scripts for data overwriting. My current prototype creates a series of large files and simply fills the memory (using a different system for additional overwrites). Is ...
- 13
0
votes
0
answers
81
views
How useful are memory forensic tools for detecting active attacks (considering current devices)
Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and ...
1
vote
1
answer
973
views
Veracrypt SSD encryption security analysis vs HDD
I have a SSD and wanted to use Veracrypt for plausible deniability and protection against any & all level attacks e.g. state sponsored, non sponsored. My goal was to use a VM and place it in the ...
- 11
0
votes
0
answers
41
views
how to check a device (mouse, USB-VGA, USB-HDMI) contains no malware [duplicate]
I got my fingers seriously burnt with some garbage bought online, which was a USB-3.0 to VGA cable. It contained a driver that requested an install, that led to my computer being unstable and a few ...
- 101
2
votes
1
answer
232
views
Preserving crime evidence from a website I do not own
Is there a standard procedure when it comes to preserving evidence of a crime committed on a website of a third party?
Let's assume that a crime was committed on a website I visit, like defamation. ...
- 33
1
vote
2
answers
569
views
Clonezilla for forensic disk image
I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine.
Since some of the commercial products are very expensive I'm turning to open source ...
- 11
0
votes
3
answers
199
views
How to donate a computer without jeopardizing personal information?
I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user250432
1
vote
0
answers
81
views
Image Scanning vs Document Scanning — How to tell difference? [closed]
I have a project where we are asked to assume the existence of a document D on a soft page which is handwritten in ink, a jpeg file of its native photograph (image A), and another discolored and ...
- 11
1
vote
0
answers
115
views
Recovering files with recovery key after double FileVault activation - is that possible?
Let's imagine I have a work macbook with ssd and I use FileVault, and the company has the FileVault recovery key. I want to make sure my data is erased and unrecoverable, what is the best way to ...
- 153
1
vote
0
answers
142
views
AuditD and SysCall alerts
Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?
When an application gets executed do all the ...
- 3,086
3
votes
1
answer
199
views
Google Chrome folder protection during HDD forensics
Is there any protection provided by Chrome browser against HDD dump and further forensics (with volatility-like tools)? For example, is it possible to extract google profile from Chrome folder and use ...
- 154
1
vote
1
answer
241
views
Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?
I am looking into M.2 docking stations such as the Maiwo K3016S as shown below.
Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...
- 6,337
2
votes
2
answers
3k
views
Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?
I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
- 6,337
66
votes
3
answers
17k
views
Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?
I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user250432
4
votes
1
answer
906
views
Data recovery from TRIMmed SSDs
Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM:
If the drive is formatted, or has ...
- 143
0
votes
0
answers
129
views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
- 1
-1
votes
1
answer
3k
views
Can A Picture be Unredacted? [duplicate]
I know a text can be unredacted but can pictures too? I have a picture I would love to unredact can that be done? Please and Thank you.
5
votes
1
answer
570
views
What's the DRAT word of my SSD?
This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine):
As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
- 459
5
votes
1
answer
1k
views
Does formatting an SSD securely delete all data?
This article on thomas-krenn.com states:
Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
- 459
0
votes
0
answers
33
views
How to track anonymous email sender (alternatives to IP tracking) [duplicate]
Are there any ways to get information on who is sending certain emails from an anonymous email address?
Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
- 101
1
vote
0
answers
311
views
Finding NonPagedPool Start and End Address using volatility
I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
- 191