Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
0 votes
0 answers
55 views

How do I start inspecting, in a basic way, what a socket is or was doing?

Exploring a plist related with a flash pop-up when booting, I found this folders: launchctl print gui/$(id -u)/com.apple.sharingd ... path = /System/Library/LaunchAgents/com.apple.sharingd.plist ...
0 votes
1 answer
983 views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
1 vote
2 answers
332 views

iCloud deletion

If I delete photos which are stored in iCloud from my phone. (Which is also linked to my iPad) I know the data is then made ‘free space’ but is still on the phone In some format. If I delete it from ...
1 vote
1 answer
214 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use? [closed]

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
2 votes
1 answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
1 vote
1 answer
192 views

Reducing web browser artifacts from a web developers perspective

Situation: Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
1 vote
1 answer
5k views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
0 votes
1 answer
2k views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
0 votes
2 answers
1k views

How to trace the remains of deleted files?

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise ...
1 vote
1 answer
132 views

Can malware detect memory dumping?

Morning, I recently had need to check for malware on my PC by dumping the memory and searching for unwanted processes which could be malware, my question it's, is it possibile for malware to detect ...
3 votes
1 answer
303 views

What can forensic analysts extract from a fully encrypted phone? [closed]

I was very disappointed to hear that my friend, who had his Android phone seized not too long ago, has had his phone broken by police forensics. As far as I know, it was a few years old, Samsung, and ...
-2 votes
2 answers
399 views

Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone? [closed]

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones. There are several third party tools they can use, but one of the most popular is '...
1 vote
0 answers
145 views

Detecting hard to detect stalkerware - a theoretical question

Suppose you have a stalker and this person has access to professional advice. Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with ...
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
1 vote
0 answers
90 views

How to detect/trace if a Windows Live/PE used on a system?

Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.
0 votes
0 answers
98 views

Can malware module be signed as Microsoft Corporation module?

In this security tutorial: https://youtu.be/dykc9YC9Z6U?t=257 the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows ...
1 vote
1 answer
2k views

Veracrypt SSD encryption security analysis vs HDD

I have a SSD and wanted to use VeraCrypt for plausible deniability and protection against any & all level attacks e.g. state sponsored, non sponsored. My goal was to use a VM and place it in the ...
3 votes
3 answers
5k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
1 vote
1 answer
1k views

How to extract a RSA private key from an ssh-agent core dump

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
1 vote
1 answer
234 views

How to forensically check if some data on .vmdk disk has been hidden/deleted?

I was presented with a task. I have .vmdk disk available and I have to check its contents - forensically check the data on it without modifiying it and then check whether some data on this disk has ...
0 votes
2 answers
157 views

As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?

From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
1 vote
0 answers
177 views

Get file from the linux_volshell from volatility

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (...
2 votes
0 answers
866 views

How to recover a file with volatility from a linux profile [closed]

I'm trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 ...
0 votes
0 answers
87 views

What are the challenges when doing forensics on cloud storage services?

My class question: "What are the key challenges for cloud forensics on cloud storage such as Dropbox?" With what I've been told and what I generally understand, the question is basically ...
2 votes
0 answers
557 views

MMLS (Sleuth Kit) not working in some situations

I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create ...
0 votes
1 answer
324 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
2 votes
1 answer
554 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this with ...
3 votes
2 answers
437 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
0 votes
1 answer
145 views

What might one want to accomplish by running ffmpeg -i video.mp4 -map 0 -map_metadata 0:s:0 -c copy video.mp4 in terms of forensics?

In the eighth episode of the second series of Mr. Robot, Trenton does this to the video that was recorded by a VHS camera before releasing it to the public via Vimeo. ffmpeg -i fuxFBI.mp4 -map 0 -...
2 votes
2 answers
704 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
1 vote
1 answer
257 views

Cuckoo dump a PE file from a memory dump?

Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process. There is Process-...
1 vote
1 answer
252 views

How to make a virtual machine forensics-proof - completely or to the maximum possible level?

I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
0 votes
1 answer
1k views

Is there a way to get Windows login password hint from SAM hive with volatility?

We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
1 vote
1 answer
172 views

Reasons for recovering small amounts of deleted data from SSDs

In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs. For their experiments, they wrote large amounts of text to ...
6 votes
1 answer
786 views

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
0 votes
0 answers
144 views

malicious dll making GET & POST requests to legit sites. What could it be doing?

Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp ...
15 votes
1 answer
954 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
4 votes
2 answers
22k views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
5 votes
1 answer
799 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
0 votes
0 answers
99 views

From a forensics standpoint how much leftovers do package managers in Linux leave behind?

Let's assume that for my question we're using the equivalent of apt purge, which also removes configuration files. What's left behind after apt purge and similar commands from other package managers? ...
1 vote
2 answers
2k views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
0 votes
1 answer
867 views

Is this 36 character long string a hash [closed]

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be?
5 votes
1 answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
2 votes
1 answer
258 views

How would this be traced back?

I was thinking about this, and I can't wrap my mind around it. Assume a person with malicious intentions that has created malware in a virtual machine. Then, this person, using the Tor browser uploads ...
0 votes
2 answers
3k views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
5 votes
1 answer
406 views

What buses carrying sensitive information on a running computer are vulnerable to sniffing?

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to ...
0 votes
1 answer
94 views

Do popular pentest tools leave any digital fingerprints?

Do pentesting tools leave behind any information in order to identify the attacker?
5 votes
1 answer
2k views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
4 votes
2 answers
389 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple hash ...

1
2 3 4 5
11