Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
3 votes
1 answer
284 views

Google Chrome folder protection during HDD forensics

Is there any protection provided by Chrome browser against HDD dump and further forensics (with volatility-like tools)? For example, is it possible to extract google profile from Chrome folder and use ...
AseN's user avatar
  • 154
1 vote
1 answer
369 views

Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below. Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...
Bob Ortiz's user avatar
  • 6,665
3 votes
3 answers
5k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
Bob Ortiz's user avatar
  • 6,665
65 votes
3 answers
18k views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
4 votes
1 answer
2k views

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has ...
craig65535's user avatar
0 votes
0 answers
183 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
Bob's user avatar
  • 1
-1 votes
1 answer
6k views

Can A Picture be Unredacted? [duplicate]

I know a text can be unredacted but can pictures too? I have a picture I would love to unredact can that be done? Please and Thank you.
Bela Cachoeira Rara's user avatar
6 votes
1 answer
795 views

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
Matthias Braun's user avatar
5 votes
1 answer
2k views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
Matthias Braun's user avatar
0 votes
0 answers
42 views

How to track anonymous email sender (alternatives to IP tracking) [duplicate]

Are there any ways to get information on who is sending certain emails from an anonymous email address? Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
user2348684's user avatar
1 vote
0 answers
468 views

Finding NonPagedPool Start and End Address using volatility

I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
aneela's user avatar
  • 201
1 vote
2 answers
512 views

Can someone know who created a cpp file?

I know that one can see the modification, access, and creation date of a file on Windows. And that the creation date, as well as other dates, can be modified at will. I just wonder if it is possible ...
C.Unbay's user avatar
  • 207
28 votes
5 answers
9k views

Is a password-protected stolen laptop safe?

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity. If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for ...
MrJoe's user avatar
  • 809
1 vote
0 answers
327 views

What is the forensic procedure in investigating DDoS attacks

I'm currently in the process of researching for an assignment. In this assignment, I am asked to produce reports on new crimes enabled by technology and how, in Cyber Forensics, one would investigate ...
Duke Jake Morgan's user avatar
0 votes
0 answers
120 views

Recovery files fails Raspberry Pi 3b

i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS I would like to start with forensics file management, and ...
onec0de's user avatar
  • 121
1 vote
2 answers
26k views

How to dump the memory of a given process with Volatility 3?

It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3? The "old way" does not seem to work: If desired, the plugin can be used to ...
Soleil's user avatar
  • 123
2 votes
1 answer
345 views

Check TRIM space on SSD

Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
userman48's user avatar
1 vote
1 answer
216 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use? [closed]

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
George's user avatar
  • 11
0 votes
2 answers
601 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
Percival Junghans's user avatar
1 vote
1 answer
770 views

Can I view a user's browser history if the history/cache has been cleared?

A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by ...
CastleCorp's user avatar
1 vote
0 answers
227 views

Determining Windows version from a list of files

I have a list of files taken from a dead system, but not the actual files themselves, or any other information (e.g. properties) that would indicate the OS version. Is there a way to determine the ...
Plesbien's user avatar
1 vote
1 answer
767 views

Does Windows Device Encryption use a new key to encrypt each time?

Say I have a machine running Windows 10 with built in Device Encryption enabled. Say I want to reinstall Windows and sell the machine. I am wondering: after the format and reinstall, is a new key ...
crxsss's user avatar
  • 11
0 votes
1 answer
138 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
user's user avatar
  • 275
0 votes
0 answers
145 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
Julián's user avatar
  • 249
0 votes
1 answer
154 views

Windows forensic files

I'd like to back up important Windows files for forensic purposes. I am aware of the Event Logs and Anti Virus logs, are there any other logs or files that have personal use information, connections ...
Mibe's user avatar
  • 1
0 votes
0 answers
404 views

Can I view the format history of a usb key?

Is there a way to view when changes were made to a USB key, such as when the USB key was formatted and/or when some files were transferred? I have seen this previous stackexchange question File system ...
user4926345's user avatar
0 votes
0 answers
219 views

Are last access time and location of connected devices recorded in iCloud?

During a Forensic investigation, I parsed the sysdiagnose log file /brctl/Brctl-dump.txt and I discovered 50 devices connected to the same iCloud account. Is it possible to retrieve from Apple the ...
Wh1t3 P4wn48's user avatar
1 vote
2 answers
334 views

iCloud deletion

If I delete photos which are stored in iCloud from my phone. (Which is also linked to my iPad) I know the data is then made ‘free space’ but is still on the phone In some format. If I delete it from ...
MP115's user avatar
  • 31
1 vote
2 answers
897 views

What’s the best way to permanently delete data from your iPhone?

As the title suggests what’s the best way to permanently delete data from an iPhone. I know when you delete something, it’s not really deleted, but merely marked as ‘free space’. So how, on an iPhone, ...
MP115's user avatar
  • 31
39 votes
7 answers
11k views

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is ...
Yoshi's user avatar
  • 407
1 vote
1 answer
156 views

Comparing two Linux system clones - what about non-regular files?

Could you please help me to understand the best approach to compare two filesystems / hard disks? As a practical learning exercise I created a clone of whole hard drive a month ago and again ...
Luky's user avatar
  • 13
0 votes
1 answer
1k views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
user148614's user avatar
101 votes
4 answers
15k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
David's user avatar
  • 782
1 vote
1 answer
1k views

Identification of File Deletion Time

following problem: A file is marked as being deleted without a tracked time-deletion date. However, timestamps such as File Accessed, Entry Modified etc. point e. g. to the 30.12.2019. Is it safe to ...
Satu's user avatar
  • 11
0 votes
0 answers
17 views

Is it possible to delete all traces and files on a mac? [duplicate]

Is it possible to delete all traces and files on a mac, so no one can recover files and there will be no traces at all for this files or any activity?
climanton's user avatar
0 votes
2 answers
155 views

Does software based file recovey solutions have the same results on real physical device vs dd image file?

I have a flash drive and I want to recover some files from it. Can I take a dd image of the device and perform the recovery operation on dd image instead? Does it have the same results when performing ...
Rembo's user avatar
  • 17
1 vote
2 answers
2k views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
zull's user avatar
  • 11
1 vote
1 answer
251 views

Finding artifacts using bulk_extractor in different methods [closed]

I have specific number of artifact, and I want to search for those particular artifacts in the disk image using the bulk_extractor tool via different methods using Random Sampling, Stop List, Alert ...
user231925's user avatar
0 votes
1 answer
291 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
pobime7177's user avatar
3 votes
3 answers
2k views

How to make information unrecoverable?

I manage a company's equipment and the manager has used a piece of equipment for the last 3 years. He told me, that he will give that equipment to one of the employees. However, he has told me to ...
pobime7177's user avatar
0 votes
0 answers
127 views

Is it possible to gather information about a destination-nat host?

Let's say that I'm connected to a network where the ISP has setup a dst-nat from an IP they don't control to an IP that they control,like so: 1- Their DNS server resolves example.xyz to 1.1.1.1 (the ...
MOHAMMAD RASIM's user avatar
0 votes
2 answers
1k views

How to trace the remains of deleted files?

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise ...
user229077's user avatar
3 votes
1 answer
867 views

How to hide the fact that a system is virtual machine from malware

I've read that many types of malware scan a system for various clues regarding virtualization software, in order to stifle forensics. Is there any way to hide the fact that a computer is a virtual ...
john doe's user avatar
  • 708
22 votes
2 answers
7k views

Is NTFS encrypted by default?

Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
ZedPython's user avatar
  • 339
1 vote
1 answer
263 views

Host Protected Area (HPA) Imaging

I'm a student in the Digital Forensics department. I have to create an image of the HPA of my disk. I searched whole documents about creating HPA image ways but all of them are old methods. For ...
Ahmet Furkan Aydogan's user avatar
1 vote
1 answer
842 views

Can I safely sell a used keyboard without risk of new owner recovering previous inputs?

As far as of my knowledge goes, keyboard don't store keystrokes in their memory by default (excluding those bundled with keyloggers). The thing that comes to my mind though is that some keyboards do ...
Dominic's user avatar
  • 45
7 votes
4 answers
27k views

How to physically destroy an SSD at home?

SSDs seem to be notoriously tricky to properly erase (see for example this question and answers here). An easier and potentially safer solution could be to physically destroy the SSD device. I am ...
fgysin's user avatar
  • 744
0 votes
1 answer
235 views

Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition

I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
C.Mann's user avatar
  • 73
1 vote
0 answers
3k views

Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]

So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent: PS F:\> C:\Python27\python....
Adalcar's user avatar
  • 111
2 votes
1 answer
430 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
C.Mann's user avatar
  • 73

1
2
3 4 5
11