Skip to main content

Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
18 votes
2 answers
5k views

How can you trust a forensic scientist to have maintained the chain of custody?

I have been reading about the chain of custody in cybersecurity-related forensics and I wonder how you can be so sure the forensic scientist made their job right and they are not a malicious actor. I ...
Angelixus's user avatar
  • 281
0 votes
1 answer
66 views

Are there better methods of sustaining forensic integrity apart from disk hashing?

As far as I've heard, hashing a disk image before computer forensics is started, and then comparing that hash to a new hash after the forensics is finished is the most common way to make sure that ...
security_paranoid's user avatar
1 vote
0 answers
41 views

forensics on memfd_create

I'm doing an IR on a Linux machine. The attacker has a trojan executed in memory, the file content is backed by a memfd_create based fd. My questions How can I extract the contents from memfd? When a ...
daisy's user avatar
  • 2,077
0 votes
0 answers
58 views

EEPROM with HDD calibration data

I understand that in a Hard Disk Drive (HDD) there is EEPROM which stores calibration data. This is not directly accessible by any ring-3 (usermode) or ring-0 (kernel mode) programs. I was curious as ...
user5623335's user avatar
0 votes
0 answers
82 views

How do I start inspecting, in a basic way, what a socket is or was doing?

Exploring a plist related with a flash pop-up when booting, I found this folders: launchctl print gui/$(id -u)/com.apple.sharingd ... path = /System/Library/LaunchAgents/com.apple.sharingd.plist ...
nostromo's user avatar
1 vote
1 answer
164 views

Can malware detect memory dumping?

Morning, I recently had need to check for malware on my PC by dumping the memory and searching for unwanted processes which could be malware, my question it's, is it possibile for malware to detect ...
Hopkins's user avatar
  • 13
3 votes
1 answer
500 views

What can forensic analysts extract from a fully encrypted phone? [closed]

I was very disappointed to hear that my friend, who had his Android phone seized not too long ago, has had his phone broken by police forensics. As far as I know, it was a few years old, Samsung, and ...
Elizabeth Vogue's user avatar
-2 votes
2 answers
825 views

Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone? [closed]

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones. There are several third party tools they can use, but one of the most popular is '...
Elizabeth Vogue's user avatar
1 vote
0 answers
193 views

Detecting hard to detect stalkerware - a theoretical question

Suppose you have a stalker and this person has access to professional advice. Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with ...
LiamNiam's user avatar
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
Slybot's user avatar
  • 101
1 vote
0 answers
106 views

How to detect/trace if a Windows Live/PE used on a system?

Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.
Pishtazan NowAndish Hadi's user avatar
1 vote
1 answer
350 views

How to forensically check if some data on .vmdk disk has been hidden/deleted?

I was presented with a task. I have .vmdk disk available and I have to check its contents - forensically check the data on it without modifiying it and then check whether some data on this disk has ...
Nejc Ahtik's user avatar
1 vote
0 answers
221 views

Get file from the linux_volshell from volatility

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (...
P00's user avatar
  • 43
2 votes
0 answers
1k views

How to recover a file with volatility from a linux profile [closed]

I'm trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 ...
P00's user avatar
  • 43
0 votes
0 answers
104 views

What are the challenges when doing forensics on cloud storage services?

My class question: "What are the key challenges for cloud forensics on cloud storage such as Dropbox?" With what I've been told and what I generally understand, the question is basically ...
Thanos's user avatar
  • 111
0 votes
2 answers
172 views

As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?

From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
Sir Muffington's user avatar
2 votes
0 answers
728 views

MMLS (Sleuth Kit) not working in some situations

I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create ...
Luca Domeneghetti's user avatar
1 vote
1 answer
222 views

Reducing web browser artifacts from a web developers perspective

Situation: Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
Thedrick's user avatar
0 votes
1 answer
172 views

What might one want to accomplish by running ffmpeg -i video.mp4 -map 0 -map_metadata 0:s:0 -c copy video.mp4 in terms of forensics?

In the eighth episode of the second series of Mr. Robot, Trenton does this to the video that was recorded by a VHS camera before releasing it to the public via Vimeo. ffmpeg -i fuxFBI.mp4 -map 0 -...
John Smith's user avatar
1 vote
1 answer
303 views

Cuckoo dump a PE file from a memory dump?

Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process. There is Process-...
0xh3xa's user avatar
  • 113
1 vote
1 answer
286 views

How to make a virtual machine forensics-proof - completely or to the maximum possible level?

I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
Shy's user avatar
  • 139
1 vote
1 answer
205 views

Reasons for recovering small amounts of deleted data from SSDs

In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs. For their experiments, they wrote large amounts of text to ...
Matthias Braun's user avatar
0 votes
1 answer
1k views

Is there a way to get Windows login password hint from SAM hive with volatility?

We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
bd55's user avatar
  • 23
1 vote
1 answer
2k views

How to extract a RSA private key from an ssh-agent core dump

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
Wesley Jones's user avatar
0 votes
0 answers
167 views

malicious dll making GET & POST requests to legit sites. What could it be doing?

Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp ...
DK36's user avatar
  • 1
0 votes
1 answer
1k views

Is this 36 character long string a hash [closed]

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be?
user7954302's user avatar
0 votes
0 answers
112 views

From a forensics standpoint how much leftovers do package managers in Linux leave behind?

Let's assume that for my question we're using the equivalent of apt purge, which also removes configuration files. What's left behind after apt purge and similar commands from other package managers? ...
Sir Muffington's user avatar
0 votes
1 answer
352 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
John Smith's user avatar
0 votes
1 answer
112 views

Do popular pentest tools leave any digital fingerprints?

Do pentesting tools leave behind any information in order to identify the attacker?
user62771's user avatar
0 votes
0 answers
194 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
N S's user avatar
  • 41
1 vote
0 answers
137 views

What traces are left on a flash card reader after using it? [duplicate]

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used? I know OS can log ...
William's user avatar
  • 21
1 vote
1 answer
2k views

What traces are left on a USB stick after using it?

If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...
William's user avatar
  • 21
1 vote
1 answer
195 views

Why is it advisable to capture a disk image before shutting down? [closed]

I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
Karim Elezabawy's user avatar
0 votes
0 answers
141 views

Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF

This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating. I'm only here for guidance ...
Anass Naqqad's user avatar
1 vote
1 answer
6k views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
randomSapien's user avatar
0 votes
1 answer
180 views

RAM as a attack target

What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer? What access requirements are necessary for this? Is a search in a hex dump always ...
BeloumiX's user avatar
  • 256
0 votes
0 answers
162 views

"Intercepting" executable with FTK Imager

I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager. However, it looks like --given the environment I have-- the program only ...
Néstor Llop's user avatar
1 vote
0 answers
209 views

How to do forensics on RaspberryPi in home network?

while debugging some strange effects in my home network (bad video call quality due to packet loss) I found out this only happens when my RBPI is connected to the network. When I wanted to log in I ...
perelin's user avatar
  • 111
1 vote
0 answers
177 views

How to do a post-mortem after being hacked [closed]

I am wondering what the general steps are in retrospect for trying to find out how one ends up being hacked. A couple of times I have had Linux servers that ended up being hacked. I noticed this in ...
oligofren's user avatar
  • 111
0 votes
1 answer
1k views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
cyberf0rensicsx's user avatar
1 vote
2 answers
997 views

Create memory image of infected machine without risk

I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics. The problem is that the machine does not have the tools for ...
Rémy Legrand's user avatar
0 votes
1 answer
240 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
antmar904's user avatar
1 vote
1 answer
129 views

File based background data eraser

I am making a series of python scripts for data overwriting. My current prototype creates a series of large files and simply fills the memory (using a different system for additional overwrites). Is ...
Matt's user avatar
  • 13
0 votes
0 answers
118 views

How useful are memory forensic tools for detecting active attacks (considering current devices)

Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and ...
SauceAsAService's user avatar
1 vote
1 answer
2k views

Veracrypt SSD encryption security analysis vs HDD

I have a SSD and wanted to use VeraCrypt for plausible deniability and protection against any & all level attacks e.g. state sponsored, non sponsored. My goal was to use a VM and place it in the ...
corey robert's user avatar
0 votes
0 answers
82 views

how to check a device (mouse, USB-VGA, USB-HDMI) contains no malware [duplicate]

I got my fingers seriously burnt with some garbage bought online, which was a USB-3.0 to VGA cable. It contained a driver that requested an install, that led to my computer being unstable and a few ...
user8369515's user avatar
2 votes
1 answer
285 views

Preserving crime evidence from a website I do not own

Is there a standard procedure when it comes to preserving evidence of a crime committed on a website of a third party? Let's assume that a crime was committed on a website I visit, like defamation. ...
Lili's user avatar
  • 33
1 vote
2 answers
1k views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
Jack's user avatar
  • 11
0 votes
3 answers
255 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user avatar
1 vote
0 answers
159 views

Image Scanning vs Document Scanning — How to tell difference? [closed]

I have a project where we are asked to assume the existence of a document D on a soft page which is handwritten in ink, a jpeg file of its native photograph (image A), and another discolored and ...
JE4113's user avatar
  • 11

1
2 3 4 5
11