Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

65 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
440 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
Michael Altfield's user avatar
3 votes
0 answers
119 views

Obscuring/detecting changes to a digital photograph

Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics. With so much of our modern security based on ...
thanby's user avatar
  • 183
3 votes
1 answer
390 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
Hackthatlove's user avatar
2 votes
0 answers
566 views

MMLS (Sleuth Kit) not working in some situations

I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create ...
Luca Domeneghetti's user avatar
2 votes
0 answers
764 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
ananth's user avatar
  • 21
2 votes
0 answers
531 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
jas-'s user avatar
  • 939
2 votes
1 answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
Charlie4n6's user avatar
2 votes
0 answers
306 views

How to detect malformed MP4 files that crashes iOS devices

Recently I was made aware of an iOS bug that when a specifically malformed mp4 was played on an iOS device, it would crash. After searching around for the mp4 I found it and am trying to figure out ...
MikeSchem's user avatar
  • 2,361
2 votes
0 answers
1k views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
Yang Yu's user avatar
  • 439
1 vote
0 answers
149 views

Detecting hard to detect stalkerware - a theoretical question

Suppose you have a stalker and this person has access to professional advice. Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with ...
LiamNiam's user avatar
1 vote
0 answers
93 views

How to detect/trace if a Windows Live/PE used on a system?

Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.
Pishtazan NowAndish Hadi's user avatar
1 vote
0 answers
185 views

Get file from the linux_volshell from volatility

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (...
P00's user avatar
  • 43
1 vote
1 answer
195 views

Reducing web browser artifacts from a web developers perspective

Situation: Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
Thedrick's user avatar
1 vote
1 answer
5k views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
randomSapien's user avatar
1 vote
0 answers
195 views

How to do forensics on RaspberryPi in home network?

while debugging some strange effects in my home network (bad video call quality due to packet loss) I found out this only happens when my RBPI is connected to the network. When I wanted to log in I ...
perelin's user avatar
  • 111
1 vote
0 answers
157 views

Recovering files with recovery key after double FileVault activation - is that possible?

Let's imagine I have a work macbook with ssd and I use FileVault, and the company has the FileVault recovery key. I want to make sure my data is erased and unrecoverable, what is the best way to ...
int 2Eh's user avatar
  • 153
1 vote
0 answers
242 views

AuditD and SysCall alerts

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...
Jason's user avatar
  • 3,106
1 vote
0 answers
468 views

Finding NonPagedPool Start and End Address using volatility

I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
aneela's user avatar
  • 201
1 vote
0 answers
327 views

What is the forensic procedure in investigating DDoS attacks

I'm currently in the process of researching for an assignment. In this assignment, I am asked to produce reports on new crimes enabled by technology and how, in Cyber Forensics, one would investigate ...
Duke Jake Morgan's user avatar
1 vote
0 answers
227 views

Determining Windows version from a list of files

I have a list of files taken from a dead system, but not the actual files themselves, or any other information (e.g. properties) that would indicate the OS version. Is there a way to determine the ...
Plesbien's user avatar
1 vote
2 answers
334 views

iCloud deletion

If I delete photos which are stored in iCloud from my phone. (Which is also linked to my iPad) I know the data is then made ‘free space’ but is still on the phone In some format. If I delete it from ...
MP115's user avatar
  • 31
1 vote
0 answers
151 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
ron's user avatar
  • 177
1 vote
0 answers
282 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
Hercslure's user avatar
1 vote
0 answers
3k views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
synthesis's user avatar
  • 155
1 vote
0 answers
385 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
Ville's user avatar
  • 19
1 vote
0 answers
569 views

Can SSD data be recovered through Forensic Explorer?

I am trying to recover deleted files from a SSD using Forensic Explorer. Once the image processing on the SSD had been completed using the write blocker, I opened up AccessData FTK Imager and then I ...
Ciph3r8's user avatar
  • 11
1 vote
0 answers
240 views

The last logon time of the Administrator user in Windows 7 system is prior to the OS installation date, why?

What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS ...
Gradient's user avatar
1 vote
0 answers
125 views

Windows disk write - does short write fill whole cluster?

Suppose I have a Windows program that writes to a hard disk. The hard disk has physical sectors of 512 byte length. These sectors are accessed as clusters of 4 kilobytes each. Therefore, each cluster ...
Peter M.'s user avatar
  • 111
1 vote
0 answers
121 views

How can I diagnose what happened after a system was exposed to infection?

A system was connected to an already infected (or not secure) network and was used for few hours for normal use before the infection or hacking was detected. What things or steps should be taken to ...
ThankYouSRT's user avatar
  • 1,345
1 vote
0 answers
185 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
ayesha's user avatar
  • 11
1 vote
0 answers
249 views

Forensic image of a VPS

Is it possible to acquire forensic image of a VPS without rebooting it ? Are any signs to an end user that it's VPS was imaged by the VPS provider ?
sektor's user avatar
  • 165
1 vote
0 answers
150 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
brbtsl's user avatar
  • 111
1 vote
0 answers
169 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
Mars's user avatar
  • 1,843
1 vote
0 answers
1k views

Does erasing slack space ever make sense on flash-based storage?

Slack space appears when a file written to the disk does not occupy the last cluster entirely. For example, if I write a 512B file on the HDD formatted with 16KB clusters, only a single 512B sector ...
Dmitry Grigoryev's user avatar
1 vote
0 answers
203 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
user3200534's user avatar
1 vote
0 answers
994 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From http://robert.penz.name/68/do-you-know-what-a-host-protected-area-...
Manumit's user avatar
  • 599
0 votes
0 answers
26 views

EEPROM with HDD calibration data

I understand that in a Hard Disk Drive (HDD) there is EEPROM which stores calibration data. This is not directly accessible by any ring-3 (usermode) or ring-0 (kernel mode) programs. I was curious as ...
user5623335's user avatar
0 votes
0 answers
59 views

How do I start inspecting, in a basic way, what a socket is or was doing?

Exploring a plist related with a flash pop-up when booting, I found this folders: launchctl print gui/$(id -u)/com.apple.sharingd ... path = /System/Library/LaunchAgents/com.apple.sharingd.plist ...
nostromo's user avatar
0 votes
0 answers
102 views

Can malware module be signed as Microsoft Corporation module?

In this security tutorial: https://youtu.be/dykc9YC9Z6U?t=257 the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows ...
InfiniteLoop's user avatar
0 votes
0 answers
90 views

What are the challenges when doing forensics on cloud storage services?

My class question: "What are the key challenges for cloud forensics on cloud storage such as Dropbox?" With what I've been told and what I generally understand, the question is basically ...
Thanos's user avatar
  • 111
0 votes
0 answers
147 views

malicious dll making GET & POST requests to legit sites. What could it be doing?

Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp ...
DK36's user avatar
  • 1
0 votes
0 answers
102 views

From a forensics standpoint how much leftovers do package managers in Linux leave behind?

Let's assume that for my question we're using the equivalent of apt purge, which also removes configuration files. What's left behind after apt purge and similar commands from other package managers? ...
Sir Muffington's user avatar
0 votes
0 answers
160 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
N S's user avatar
  • 41
0 votes
0 answers
129 views

Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF

This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating. I'm only here for guidance ...
Anass Naqqad's user avatar
0 votes
0 answers
138 views

"Intercepting" executable with FTK Imager

I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager. However, it looks like --given the environment I have-- the program only ...
Néstor Llop's user avatar
0 votes
1 answer
993 views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
cyberf0rensicsx's user avatar
0 votes
0 answers
111 views

How useful are memory forensic tools for detecting active attacks (considering current devices)

Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and ...
SauceAsAService's user avatar
0 votes
0 answers
183 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
Bob's user avatar
  • 1
0 votes
0 answers
120 views

Recovery files fails Raspberry Pi 3b

i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS I would like to start with forensics file management, and ...
onec0de's user avatar
  • 121
0 votes
0 answers
145 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
Julián's user avatar
  • 249