Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
0 votes
1 answer
120 views

What does the existence of this file indicate? [closed]

C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk on a Microsoft Windows system, and use the xxd program to dump the contents of this file:
Fredrick Norman's user avatar
1 vote
2 answers
504 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
Mark Brown's user avatar
0 votes
1 answer
3k views

SRUM (system resource usage monitor) forensics - Windows server?

Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
HamblePie's user avatar
2 votes
0 answers
1k views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
evilcode1's user avatar
-1 votes
1 answer
2k views

Recovering hidden contents from a jpg picture [duplicate]

Is there any way someone could recover hidden text from a jpg. For example in the picture
Leon's user avatar
  • 1
2 votes
4 answers
178 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
Danilo Gomes's user avatar
0 votes
2 answers
2k views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
mcgyver5's user avatar
  • 6,864
1 vote
1 answer
480 views

Verification After Data Wipe

A lot of data wipe algorithms have the final wiping pass with random characters. They discuss about verification after the wipe. An example of this is from this link: https://www.datanumen.com/blogs/...
netrox's user avatar
  • 131
0 votes
1 answer
131 views

How to recover disk image from a smartphone in "bootloop" state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
Fnr's user avatar
  • 206
0 votes
1 answer
814 views

security leak in working with hardware write blockers?

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the ...
karts's user avatar
  • 1
2 votes
3 answers
740 views

How to capture not only the mtime but also the ctime when making forensic copies of files?

Context I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
Axel Beckert's user avatar
3 votes
2 answers
437 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
John Doe's user avatar
0 votes
0 answers
1k views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
dan's user avatar
  • 3,058
1 vote
1 answer
2k views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...
Grimes's user avatar
  • 11
4 votes
1 answer
230 views

Which protocol could have been likely candidates for leaking a laptop serial number

Having read this article, one line in particular caught my attention: The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
David's user avatar
  • 167
3 votes
1 answer
125 views

Methodology for finding existing adversary presence on network

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is ...
DocSpiegel's user avatar
7 votes
2 answers
6k views

What type of data can be recovered from the swap file / page file and thumbs file

This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
James009's user avatar
  • 111
2 votes
2 answers
3k views

Linux command to wipe files on an SD Card?

Are there any commands, tools or python libraries to securely wipe specific files from an SD or micro SD card (devices that use flash memory)? For example, with a regular magnetic hard drive, you can ...
SomeRandomGuy12's user avatar
0 votes
2 answers
188 views

Are contents of PHP sessions forensically valuable?

PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/...
Bruce Ediger's user avatar
  • 4,532
0 votes
2 answers
3k views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
Glegan's user avatar
  • 1
0 votes
1 answer
118 views

What frameworks are available to analyze a security breach?

I come from an engineering background where we use tools like 5-times-why or 8D for Root Cause Analysis. Are there similar frameworks to perform an analysis on a reported a security incident?
fazineroso's user avatar
7 votes
1 answer
1k views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
user5623335's user avatar
2 votes
2 answers
704 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
Karlhuna's user avatar
  • 153
3 votes
1 answer
996 views

Cloning a system for forensic analysis

How can I clone a system without leaving any footprint? I want to acquire RAM and other physical hard drives so that after cloning all the work can be done in VM without disturbing the target machine. ...
Jheel rathod's user avatar
1 vote
2 answers
922 views

Secure erase hard drive [duplicate]

What device/method do you usually use to securely erase a hard drive? The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later, I can ...
mau5's user avatar
  • 134
-2 votes
1 answer
2k views

Types of evidence in Digital Forensic

While studying Digital Forensic, I am getting puzzled between different types of evidence, especially circumstantial and corroborative evidence. Hypothetical scenario: An IDS alert is generated due ...
arif's user avatar
  • 1,156
1 vote
1 answer
186 views

Retrieved files were corrupted after file carving

I have used scalpel to carve files from a memory dump. But some of the image files are incomplete or corrupted . I cannot see an image preview. What will be the reason for this ?
not 0x12's user avatar
  • 113
4 votes
1 answer
17k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
user avatar
15 votes
1 answer
954 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
forest's user avatar
  • 66.7k
142 votes
8 answers
28k views

Secure way of masking out sensitive information in screenshots? [duplicate]

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below I ...
xandfury's user avatar
  • 1,351
2 votes
1 answer
892 views

Encrypted data embedded in JPG and Other file types

This is some data found near the end of a JPG file: 18{8uck3y3$} ! 18{b4063c521f76545d8c94e999dd63f445d8c01cfc} # 18{U2FsdGVkX19RJjdBbDB51ok1hkFXaB91NpZNoQjbVXYlMeMTaWRTdg==}? Other files on the ...
Les's user avatar
  • 123
2 votes
0 answers
529 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
jas-'s user avatar
  • 939
1 vote
0 answers
153 views

Hardware Write Blocked SD Reader [closed]

I needed to look into getting a hardware write blocker that will be compatible with SD cards. I've come across the Tableau Forensic USB 3.0 Bridge and the CRU USB 3.0 WriteBlocker Does anyone ...
Chasester's user avatar
  • 111
4 votes
1 answer
4k views

Volatility Forensics with Large dumps

Today I was tasked with the analysis of a .vmem file of a Windows RDS one of our customers due to some "strange" connections coming from native Windows processes. The extracted .vmem file has a size ...
Nomad's user avatar
  • 2,379
2 votes
2 answers
517 views

Can a forensic exam find an image's geographic metadata after geotagging was disabled?

We recently did a lab in my computer forensics class where we analyzed images of a suspect's phone, and used the metadata of the photos found therein to show he was in the vicinity of where a crime ...
user avatar
12 votes
2 answers
2k views

Do XSS attempts leave any trace on the server?

If I do a test with a classic <script>alert(1)</script>, does the website owner see my attempt? Does XSS leave some trace behind? I will try to build a little server on my Ubuntu with a ...
onec0de's user avatar
  • 121
5 votes
1 answer
799 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
J. Doe's user avatar
  • 53
1 vote
1 answer
277 views

Is it possible for digital forensic evidence to be multiple types of evidence at the same time?

I'm studying for the CCSP certification and the online training course I'm taking is a little vague on the topic of evidence types (within the context of digital forensics). Specifically, I'd like ...
Mike B's user avatar
  • 3,458
3 votes
2 answers
533 views

What's a practical example of how volatile information can be preserved in a digital forensics investigation?

I'm taking a study course on CCSP and am going over a section on the digital forensics investigation process. In particular, the instructor discussed the following: I'm curious on two bullet points ...
Mike B's user avatar
  • 3,458
2 votes
1 answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
Charlie4n6's user avatar
4 votes
1 answer
393 views

Best strategy to recover running Macbook "modern" Pro ram

(Take a Macbook Pro 2017 Sierra 10.12.5 for example.) What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
Pacerier's user avatar
  • 3,313
0 votes
1 answer
174 views

Can an attacker add malicious instructions to a cracked Password Manager app to exfiltrate credentials ? (1Password, oneSafe, etc.)

(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the ...
scugn1zz0's user avatar
  • 113
1 vote
1 answer
357 views

E-mail forensics for dummies

Long story short, I am getting Dutch language spam from a group; it has been going on for years, and they send several of them daily. They got my e-mail when I lived in the Netherlands and imagine ...
Gabor's user avatar
  • 113
2 votes
1 answer
282 views

Is it possible data which was generated with JavaScript in Google Chrome could exist in my Mac'sRAM?

I generated a private key using this website: https://www.stellar.org/account-viewer/#!/ I was supposed to write down the private key but I didn't and I lost it. I have since unplugged the internet ...
aadu's user avatar
  • 123
1 vote
3 answers
269 views

Keyboard forensics? (Physical layer)

If I had a strong bootup password that I typed into my keyboard daily to mount my "encrypted system partition"... Q1) Would it be possible for an adversary to find out my password by analyzing my ...
Starzzzzz's user avatar
  • 165
1 vote
1 answer
319 views

User accessed Phishing link but didn't provide the credential but got hacked?

One of my colleagues received a phishing email in which he clicked on a link. The domain (www.phishing-link.biz) redirected to adfx.xxx.edu which does look like adfs authentication page. Colleague ...
MS Guy's user avatar
  • 95
3 votes
1 answer
4k views

When do flash drives overwrite previously written data?

Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten? ...
God San's user avatar
  • 33
3 votes
1 answer
717 views

Verifying factory reset on phone?

I have some old Android phones that I'd like to recycle, but obviously I want to wipe them before doing so. While I realize it's unlikely anyone will attempt a forensic recovery on my phones after ...
David's user avatar
  • 16.1k
3 votes
1 answer
1k views

How to secure erase files and folders? [duplicate]

How to securely erase/delete files or folders in different file systems (NTFS, ext3, ext4) ? Need to delete files so it will be impossible to recover that files and no traces of metadata and traces in ...
user15943's user avatar
2 votes
2 answers
1k views

What's the danger of malicious JS and .DOC files in the AppData\Local\Temp folder?

I keep seeing malicious .DOC and .JS files appear in the \AppData\Local\Temp & the \Temporary Internet Files of users. A few questions: Under what circumstances do DOCs and JS files appear in ...
Asa Hunt's user avatar

1 2 3
4
5
11