Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
2 votes
1 answer
281 views

Wannacry testing in lab - Not getting SMB scan attempts

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
Farzad Henareh's user avatar
1 vote
1 answer
957 views

Scapy: Sending forged Probe Requests and capturing them in a different device

Objective: Sending a forged Probe Request frame from one machine and capturing it on a second machine. I have two codes running: sender.py interface = sys.argv[1] dot11 = Dot11(addr1='ff:ff:ff:ff:...
Rafael's user avatar
  • 55
0 votes
1 answer
407 views

DNS Tunnel or Not (g01.msn.com)

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before? User starts their computer, launches firefox.exe, then they hit c.msn.com ...
BaldSec's user avatar
0 votes
0 answers
379 views

Interpreting a Registry value of hashed password

I have been given a forensics challenge that contains a SYSTEM and SAM registry files as well as a wordlist. When using hivexsh (a registry analysis tool) I need to find the password (which I belive ...
Ben Folland's user avatar
0 votes
1 answer
657 views

What is the significant difference between a Rogue Access Point & Client Mis-Association [closed]

As the title states, how can I differentiate both of them.
VisualKnw's user avatar
1 vote
0 answers
147 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
ron's user avatar
  • 177
4 votes
1 answer
4k views

How Concerned should I be about VM Escapes?

I intend to start learning how to do malware analysis and forensics, but I have a concern or two. I want to start by just analysing code that I write myself, and that'll be fine. But at some point I'...
Makcheese's user avatar
  • 143
0 votes
0 answers
363 views

Forensic image of hard disk on VMWare using Autopsy

Is there a recommended, forensically sound method of acquiring virtual hard drives on VMWare using Autopsy? Or is it a simple copy and paste? I’ve used other software like Caine in the past, where ...
C.Mann's user avatar
  • 73
1 vote
0 answers
280 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
Hercslure's user avatar
0 votes
0 answers
103 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
bfoxofb's user avatar
4 votes
2 answers
389 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple hash ...
xxx's user avatar
  • 167
3 votes
1 answer
307 views

Alternative routes for Incident Response approach other than Windows Event Viewer?

I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
C.Mann's user avatar
  • 73
1 vote
0 answers
3k views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
synthesis's user avatar
  • 155
1 vote
0 answers
151 views

How long would traces of a disk wipe be visible? [closed]

If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets ...
another_stack_user999's user avatar
0 votes
0 answers
536 views

Is it always possible to retrieve data from a rewritable CD? And using partitioning and formatting discuss their forensic implications

Is it possible to retrieve data from a rewritable CD? Using partitioning and formatting discuss their forensic implications.
abug tubi's user avatar
1 vote
1 answer
494 views

How can information be recovered after it has been overwritten (single pass) by a secure deletion program? [duplicate]

We know that information can be retreived after it has been deleted. There are several tools for file "undeletion" (Recuva, FTK, some tools contained in Caine, etc.) I have heard as well, that data ...
SonneRevsson's user avatar
2 votes
2 answers
221 views

Carve out all scattered pieces of a file from data

If a file is scattered in pieces on a hard drive how is it possible to find all parts of it? Forensically in a file carving situation where one do not have access to a running OS.
Daniel's user avatar
  • 195
0 votes
1 answer
174 views

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware. As far as I know, hibernation saves RAM memory ...
RedS's user avatar
  • 74
2 votes
0 answers
762 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
ananth's user avatar
  • 21
2 votes
2 answers
390 views

SD card planted in my pocket

Today, I found a SD card in my pocket. I've never seen it before and am nearly certain I didn't put it there myself. My suspicion is that someone stealthily planted it there while I was walking ...
Erik Kurzinger's user avatar
1 vote
1 answer
4k views

Forensics methods for obtaining WhatsApp data from Windows Desktop PCs

WhatsApp has the option to download a Windows (or Mac) Desktop version. Installation requires pairing the software with a mobile phone. I have read a similar question about Android devices, and ...
Michael Haephrati's user avatar
1 vote
0 answers
383 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
Ville's user avatar
  • 19
4 votes
0 answers
437 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
Michael Altfield's user avatar
0 votes
0 answers
257 views

Access Android files without entering pass-code

I have a Samsung A5 from a friend. Her screen is totally broken (black) and she wants me to recover her files. The problem is that you need to enter the pass-code of the phone in order to be able to ...
O'Niel's user avatar
  • 2,914
1 vote
1 answer
382 views

Is it posible recover file from an encrypted home directory with a forensic tool?

Lately I have done forensic analysis on my computer(with photorec) to see how many deleted files I can recover. During the analysis I recover some photos and videos of my different partitions: Windows,...
user avatar
1 vote
1 answer
325 views

Is the SSH last login message reliable or rather something easy to get tampered with?

My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following: The Log ...
Sir Muffington's user avatar
3 votes
4 answers
1k views

How to investigate an IP address that was involved a security breach?

I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach? The specific situation is this - recently two of our servers were hacked into ...
Abe Miessler's user avatar
  • 8,195
3 votes
3 answers
919 views

Analysis of hacked servers -- daily RDP connections I can't find an obvious reason for

I'm cleaning up after an incident where a few servers were hacked. A new IDS has been put in place, the firewall has been upgraded, the services used in the attack are being replaced with more secure ...
S.C.'s user avatar
  • 170
-1 votes
1 answer
384 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
Max's user avatar
  • 97
0 votes
1 answer
592 views

Recovering data on unallocated space from FAT16 USB drive

I'm actually trying to make my hand around forensic and information security as a whole. To do this, I'm trying to make a lot of CTFs. The last one I got to do is puzzling me, 1st because I have no ...
Pete's user avatar
  • 1
1 vote
0 answers
566 views

Can SSD data be recovered through Forensic Explorer?

I am trying to recover deleted files from a SSD using Forensic Explorer. Once the image processing on the SSD had been completed using the write blocker, I opened up AccessData FTK Imager and then I ...
Ciph3r8's user avatar
  • 11
0 votes
2 answers
775 views

How do I list IP addresses a system is connecting to from its memory dump or OS image (obtained from FTK Imager)? [closed]

I'm looking for a tool that will enumerate the IP addresses that a system is connecting to. This is mainly for forensic purposes, to gather IOCs. I know we can run a netstat on windows, but would like ...
Anup Michael Salve's user avatar
0 votes
0 answers
129 views

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely ...
finkforensics's user avatar
1 vote
0 answers
163 views

Is there a way to get a forensic image of EC2 instance [closed]

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
shezi27's user avatar
  • 63
2 votes
1 answer
249 views

Linux forensics- How can I extract sysfs procfs from a raw image?

I'm developing a software that extracts files from a Linux raw image (dd). I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders. I know ...
Reginiano's user avatar
1 vote
0 answers
238 views

The last logon time of the Administrator user in Windows 7 system is prior to the OS installation date, why?

What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS ...
Gradient's user avatar
1 vote
2 answers
2k views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
user402843's user avatar
0 votes
3 answers
1k views

Can you detect that new files were added to a hard drive that was removed and replaced?

The internal HDD was removed from my laptop (with Windows 7) and connected to another machine to tamper with. Some new files were also created/copied by the mischief maker. After the tampering was ...
Gradient's user avatar
5 votes
1 answer
333 views

What forensic analysis can be done with physical access to a machine but without the hard drive?

What forensic analysis techniques target computer components other than the hard drive once the device is powered off?
Richard Petersen's user avatar
2 votes
1 answer
4k views

How to do forensis MBR hex dump?

I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ? I take copy bytes dump using my Ubuntu ...
uma's user avatar
  • 183
1 vote
1 answer
164 views

Understanding the philosophy of recovering data

It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells. But i wounder how the bytes ...
Nouman Tajik's user avatar
1 vote
1 answer
619 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
daisy's user avatar
  • 2,057
0 votes
2 answers
375 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
Brian's user avatar
  • 101
1 vote
2 answers
861 views

How to view last run shell command via cmd.exe through a HKEY_CURRENT_USER.reg file?

I'm working on improving my security skills and a challenge I have is a .reg file which is HKEY_CURRENT_USER. I need to find what the last run command on the box was.
John Lancaster's user avatar
0 votes
1 answer
2k views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
Bernie Simpsons's user avatar
5 votes
0 answers
661 views

Forensic investigation of a vehicle infotainment system [closed]

As far as I know most vehicle infotainment systems are run on a customized Linux system built with Yocto. Forensic toolkits such as Berla iVe allows to extract information such as GPS data, call log, ...
Natto_Jihen's user avatar
0 votes
2 answers
2k views

Find the process that queries a malicious domain every 2 minutes

I found suspicious traffic in a client a few days ago. A process in the client queries a malicious domain every 2 minutes. The domain is hostingcloud.science that hosts a javascript file for coin ...
Giac's user avatar
  • 175
0 votes
1 answer
126 views

Commodity Conversion Cables with Write Blockers

Looking at write-blocking devices I've notice a large variety of specialized hardware based on different source connector types, including USB-to-USB write blockers. It seems as though it should be ...
Jonathan's user avatar
  • 103
4 votes
1 answer
670 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
user avatar
2 votes
2 answers
342 views

How to detect spyware over HTTP?

I am trying to detect spyware on my PC by traffic analysis. I am connected to a VPS (the sniffer) by a VPN and I am going to select all the sent data by the POST method. Is this correct? I mean the ...
MysticDog's user avatar

1 2
3
4 5
11