Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
204 votes
6 answers
51k views

How secure is 'blacking out' sensitive information using MS Paint?

I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint? Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
Mirsad's user avatar
  • 10.2k
142 votes
8 answers
28k views

Secure way of masking out sensitive information in screenshots? [duplicate]

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below I ...
xandfury's user avatar
  • 1,351
101 votes
4 answers
15k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
David's user avatar
  • 782
75 votes
5 answers
174k views

Detecting steganography in images

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
Chris's user avatar
  • 905
65 votes
3 answers
18k views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
58 votes
6 answers
169k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
cutrightjm's user avatar
  • 1,743
43 votes
9 answers
13k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files"....
Green Fly's user avatar
  • 1,957
42 votes
3 answers
67k views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that aftermarket addition so to speak? For instance I take a screenshot (using MS snipper) Then I 'blur/...
Matthew Peters's user avatar
39 votes
7 answers
11k views

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is ...
Yoshi's user avatar
  • 407
28 votes
5 answers
9k views

Is a password-protected stolen laptop safe?

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity. If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for ...
MrJoe's user avatar
  • 809
28 votes
4 answers
2k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
tylerl's user avatar
  • 83.4k
26 votes
3 answers
11k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
symcbean's user avatar
  • 18.6k
22 votes
2 answers
7k views

Is NTFS encrypted by default?

Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
ZedPython's user avatar
  • 339
22 votes
7 answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
gbr's user avatar
  • 2,020
21 votes
3 answers
24k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
Gary William Murning's user avatar
19 votes
6 answers
4k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
Anna's user avatar
  • 191
18 votes
6 answers
984 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
Crash893's user avatar
  • 351
18 votes
3 answers
114k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
Ruth Bravo's user avatar
17 votes
4 answers
2k views

Network Forensics - what is in your toolbox

In similar vein to this question on computer forensics, what tools would you have in your toolbox for infrastructure and network forensics. Typical example cases would be if you were called in either ...
Rory Alsop's user avatar
  • 61.5k
17 votes
3 answers
9k views

Is there a real-world example of SSD data recovery?

Secure data deletion is known to be more complicated and elusive on a solid-state drive than for a regular hard drive. For instance, the logical block mapping on the SSD's flash translation layer ...
Arminius's user avatar
  • 44.7k
17 votes
1 answer
2k views

Did someone really plug an iphone in, or are these symptoms of an exploit attempt?

My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
Jeromy Evans's user avatar
16 votes
7 answers
6k views

Is there a need to image the hard drive when using a write blocker?

Forensics books often recommend working on an image of the hard drive instead of the original drive. Should I take this precaution even if I use a write blocker? If so, why?
Othman's user avatar
  • 587
15 votes
2 answers
1k views

Are there any tell-tale signs of self-hacking? [closed]

After the Mt.Gox crash, and also keeping in mind recently published attacks on Target and Neiman Marcus, one is led to believe that sometimes so-called hacking is perpetrated by insiders. What are ...
Deer Hunter's user avatar
  • 5,337
15 votes
5 answers
27k views

Is it possible to recover securely deleted data from a hard drive using forensics?

Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics? Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all ...
user41890's user avatar
  • 167
15 votes
1 answer
4k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
sdanelson's user avatar
  • 1,287
15 votes
2 answers
3k views

Can it be proved that two CDs were burned by different computers?

A friend of mine made a personal data CD. Days later he found a copy elsewhere. He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another ...
ASalazar's user avatar
  • 261
15 votes
1 answer
954 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
forest's user avatar
  • 66.7k
14 votes
3 answers
4k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
Canadian Luke's user avatar
14 votes
6 answers
783 views

How are attacks and APTs attributed?

It's increasingly common to see major attacks on governments and corporations attributed to a specific country or group. Typically we don't know for certain, but it's at least suspected. Given the ...
NotMyRealName's user avatar
14 votes
1 answer
9k views

Do burned DVDs contain trackable information?

I'd like to know if it's possible to burn a video DVD (not just a regular CDFS DVD with video files in it; I mean a DVD that you can play the video of using regular DVD players), without the ...
Privacy please's user avatar
13 votes
2 answers
9k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
Salvador Dali's user avatar
12 votes
2 answers
2k views

Do XSS attempts leave any trace on the server?

If I do a test with a classic <script>alert(1)</script>, does the website owner see my attempt? Does XSS leave some trace behind? I will try to build a little server on my Ubuntu with a ...
onec0de's user avatar
  • 121
10 votes
1 answer
743 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
700 Software's user avatar
10 votes
6 answers
57k views

Scanning for files than have been encrypted by CryptoLocker

I am just asking in case someone has already done the analysis. A customer has a large set of network drives that were mapped to a CryptoLocker infected machine. The infection itself has been treated. ...
Paul Doom's user avatar
  • 279
10 votes
2 answers
5k views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
k1308517's user avatar
  • 1,292
10 votes
2 answers
3k views

Methods of cold boot attacks in the wild

As far as I know, there are two methods for performing cold boot attacks: Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports ...
forest's user avatar
  • 66.7k
10 votes
1 answer
598 views

Looking for signs of forensics - Assuming they didn't do the smart thing

I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, ...
Faileas Grey's user avatar
10 votes
3 answers
66k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
JJC's user avatar
  • 481
9 votes
4 answers
11k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
user46850's user avatar
  • 199
9 votes
3 answers
3k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
Chris Dale's user avatar
  • 16.2k
9 votes
5 answers
5k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
Black Magic's user avatar
  • 1,212
9 votes
4 answers
15k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
Computernerd's user avatar
  • 2,431
9 votes
2 answers
3k views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
Callum Wilson's user avatar
9 votes
3 answers
9k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
octo-carrot's user avatar
9 votes
3 answers
291 views

Finding artifacts of software

I was wondering if there is an established way to know what a running particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this ...
user45195's user avatar
  • 137
9 votes
1 answer
529 views

How long would a computer have to be off to be resistant to a cold boot attack?

I understand that the longer a computer is off, the more resistant it is to a cold boot attack. I also understand that an AES key can be reconstructed from a redundant round key schedule even after a ...
Zen Hacker's user avatar
8 votes
3 answers
323k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any monitoring/...
Saladin's user avatar
  • 1,557
8 votes
4 answers
836 views

Possible Rogue Admin

This does not involve me directly. However a friend believes her files are being tampered with and/or deleted by the only Windows domain admin there. (She has since kept backups) This started after ...
Steven's user avatar
  • 257
8 votes
8 answers
9k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
MarkKGreenway's user avatar
8 votes
1 answer
1k views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
KilledKenny's user avatar
  • 1,672

1
2 3 4 5
11