Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
58 votes
6 answers
169k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
cutrightjm's user avatar
  • 1,743
75 votes
5 answers
174k views

Detecting steganography in images

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
Chris's user avatar
  • 905
14 votes
6 answers
783 views

How are attacks and APTs attributed?

It's increasingly common to see major attacks on governments and corporations attributed to a specific country or group. Typically we don't know for certain, but it's at least suspected. Given the ...
NotMyRealName's user avatar
204 votes
6 answers
51k views

How secure is 'blacking out' sensitive information using MS Paint?

I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint? Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
Mirsad's user avatar
  • 10.2k
7 votes
3 answers
863 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I don'...
Thomas Ward's user avatar
1 vote
1 answer
2k views

What traces are left on a USB stick after using it?

If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...
William's user avatar
  • 21
26 votes
3 answers
11k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
symcbean's user avatar
  • 18.6k
14 votes
3 answers
4k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
Canadian Luke's user avatar
10 votes
2 answers
5k views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
k1308517's user avatar
  • 1,292
9 votes
4 answers
11k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
user46850's user avatar
  • 199
6 votes
2 answers
61k views

How can you see the device history of a computer when doing forensics?

I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices ...
Sonny Ordell's user avatar
  • 3,566
5 votes
3 answers
887 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
Anton Kastritskiy's user avatar
5 votes
1 answer
2k views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
Matthias Braun's user avatar
4 votes
1 answer
3k views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
Chechik's user avatar
  • 111
42 votes
3 answers
67k views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that aftermarket addition so to speak? For instance I take a screenshot (using MS snipper) Then I 'blur/...
Matthew Peters's user avatar
22 votes
7 answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
gbr's user avatar
  • 2,020
17 votes
4 answers
2k views

Network Forensics - what is in your toolbox

In similar vein to this question on computer forensics, what tools would you have in your toolbox for infrastructure and network forensics. Typical example cases would be if you were called in either ...
Rory Alsop's user avatar
  • 61.5k
15 votes
5 answers
27k views

Is it possible to recover securely deleted data from a hard drive using forensics?

Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics? Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all ...
user41890's user avatar
  • 167
15 votes
1 answer
4k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
sdanelson's user avatar
  • 1,287
13 votes
2 answers
9k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
Salvador Dali's user avatar
10 votes
6 answers
57k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
Paul Doom's user avatar
  • 279
5 votes
1 answer
799 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
J. Doe's user avatar
  • 53
4 votes
1 answer
393 views

Best strategy to recover running Macbook "modern" Pro ram

(Take a Macbook Pro 2017 Sierra 10.12.5 for example.) What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
Pacerier's user avatar
  • 3,313
4 votes
1 answer
2k views

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has ...
craig65535's user avatar
4 votes
2 answers
2k views

What data is not encrypted in iOS 8+ when "locked"

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What data/...
Manumit's user avatar
  • 599
3 votes
3 answers
18k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
user avatar
1 vote
1 answer
230 views

Proving download via https

Suppose I download a file hxxps://example.com/somefile.txt with a client that logs everything, including short-term session keys. Do these logs constitute sufficient proof that the given file has ...
bohdan_trotsenko's user avatar
0 votes
4 answers
1k views

If I create a website using a VPN, am I safe from law enforcement finding out I made the website?

If I created a website online using a VPN, can law enforcement still find out I made the website? What other forms of identification could potentially give away that my computer made this website, and ...
user8358234's user avatar
142 votes
8 answers
28k views

Secure way of masking out sensitive information in screenshots? [duplicate]

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below I ...
xandfury's user avatar
  • 1,351
65 votes
3 answers
18k views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
21 votes
3 answers
24k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
Gary William Murning's user avatar
15 votes
1 answer
954 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
forest's user avatar
  • 66.7k
15 votes
2 answers
3k views

Can it be proved that two CDs were burned by different computers?

A friend of mine made a personal data CD. Days later he found a copy elsewhere. He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
ASalazar's user avatar
  • 261
14 votes
1 answer
9k views

Do burned DVDs contain trackable information?

I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
Privacy please's user avatar
10 votes
2 answers
3k views

Methods of cold boot attacks in the wild

As far as I know, there are two methods for performing cold boot attacks: Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports ...
forest's user avatar
  • 66.7k
9 votes
3 answers
3k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
Chris Dale's user avatar
  • 16.2k
9 votes
3 answers
9k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
octo-carrot's user avatar
8 votes
1 answer
1k views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
KilledKenny's user avatar
  • 1,672
8 votes
8 answers
9k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
MarkKGreenway's user avatar
8 votes
3 answers
323k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any monitoring/...
Saladin's user avatar
  • 1,557
5 votes
1 answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
heatray's user avatar
  • 51
5 votes
1 answer
406 views

What buses carrying sensitive information on a running computer are vulnerable to sniffing?

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to ...
forest's user avatar
  • 66.7k
5 votes
2 answers
1k views

Forensics after web server compromise

I was using sftp to give access to clients to certain folders so that they could modify their apache virtual hosts as desired. Until someone uploaded a php backdoor and erased all virtual hosts :). ...
opc0de's user avatar
  • 697
5 votes
2 answers
243k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?
priv8 s0cket's user avatar
4 votes
1 answer
297 views

Data analyzer tools [closed]

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
hotips's user avatar
  • 589
4 votes
2 answers
3k views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user name,...
cicada's user avatar
  • 43
4 votes
5 answers
5k views

How can I find the source of traffic allegedly originating from my IP address?

I have a problem that has been going on for at least 6 weeks. I have Time Warner for my Internet provider and some websites hosted at GoDaddy. From what GoDaddy tells me the reason I can not view ...
gary's user avatar
  • 41
4 votes
5 answers
9k views

Prove that you deleted the file

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.
David Allen's user avatar
4 votes
1 answer
4k views

How Concerned should I be about VM Escapes?

I intend to start learning how to do malware analysis and forensics, but I have a concern or two. I want to start by just analysing code that I write myself, and that'll be fine. But at some point I'...
Makcheese's user avatar
  • 143
4 votes
2 answers
2k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
Anders's user avatar
  • 151