Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
9 votes
3 answers
3k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
Chris Dale's user avatar
  • 16.2k
26 votes
3 answers
11k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
symcbean's user avatar
  • 18.6k
17 votes
1 answer
2k views

Did someone really plug an iphone in, or are these symptoms of an exploit attempt?

My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
Jeromy Evans's user avatar
8 votes
1 answer
1k views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
KilledKenny's user avatar
  • 1,672
75 votes
5 answers
174k views

Detecting steganography in images

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward ...
Chris's user avatar
  • 905
1 vote
2 answers
594 views

is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?

Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation Like Niksun or Solera solution do ? I'm ...
boos's user avatar
  • 1,066
17 votes
4 answers
2k views

Network Forensics - what is in your toolbox

In similar vein to this question on computer forensics, what tools would you have in your toolbox for infrastructure and network forensics. Typical example cases would be if you were called in either ...
Rory Alsop's user avatar
  • 61.5k
15 votes
1 answer
4k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
sdanelson's user avatar
  • 1,287
4 votes
1 answer
1k views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
gbr's user avatar
  • 2,020
8 votes
3 answers
3k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible [closed]

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
makerofthings7's user avatar
8 votes
2 answers
237 views

"Fingerprinting" and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
Everett's user avatar
  • 1,506
8 votes
8 answers
9k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
MarkKGreenway's user avatar
22 votes
7 answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
gbr's user avatar
  • 2,020

1
7 8 9 10
11