Questions tagged [forensics]

Computer forensics works to analyze information on computer systems in an attempt to find evidence regarding certain actions of a process, application, user or computer to determine the source of change within a host, network or device.

Filter by
Sorted by
Tagged with
5 votes
1 answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
heatray's user avatar
  • 51
1 vote
0 answers
260 views

Will overwriting a file before deleting guarantee the destruction of the original file's data [duplicate]

Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, ...
eclipse's user avatar
  • 183
1 vote
2 answers
404 views

Possible leakage of metadata during forensic analysis

I'm going to encrypt external hard drive. HDD is wiped three times using the command shred --verbose --random-source=/dev/urandom --iterations=3 /dev/sdc but after it I was accidentally executed ...
user avatar
2 votes
1 answer
4k views

Autopsy uncovering slack space of a file

I'm using Autopsy and need to recover a hidden password inside a slack space in another file. Autopsy shows that each sector for my disk is 512 bytes. The file starts at 4365 of the sector and the ...
hicu0's user avatar
  • 21
1 vote
2 answers
488 views

Use explicit_bzero() to zero entire memory

Functions like bzero(), explicit_bzero() and ZeroMemory are designed to delete sensitive data from RAM (Like keys). Can I use explicit_bzero() to delete entire RAM (e.g. 2 GB RAM)? Is this a feasible ...
Kiavash Satvat's user avatar
1 vote
1 answer
216 views

USB activity monitoring [closed]

Is there any method or tool which will allow to monitor activity on USB? With activity I mean if you can by any chance see if files like (pdf, jpeg, doc, etc, ...) was copied or opened on USB device.
Dejan's user avatar
  • 33
3 votes
1 answer
388 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
Hackthatlove's user avatar
1 vote
1 answer
299 views

Erase RAM while device is on [closed]

Is there anyway to get rid of the data in RAM without powering off the system? or better to say how we can reduce the chance of getting meaning full information from the volatile memory while the ...
Mah's user avatar
  • 11
1 vote
1 answer
230 views

Proving download via https

Suppose I download a file hxxps://example.com/somefile.txt with a client that logs everything, including short-term session keys. Do these logs constitute sufficient proof that the given file has ...
bohdan_trotsenko's user avatar
2 votes
2 answers
757 views

Database compromised (SQL-injection): how to handle the situaton, after the fact?

Situation We found out that one of our (MySQL) databases has been compromised through SQL-injection. The injection vector was a query that was vulnerable to SQL-injection due to string-concatenation ...
Monika's user avatar
  • 1,092
5 votes
1 answer
736 views

Equifax Data Breach 2017

In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced. How did the criminals access this data? What was the exploit?
Matthew James Briggs's user avatar
5 votes
2 answers
8k views

Finding the company name by the AWS IP address [closed]

Is there any way to find out company/domain name of the company name by a given AWS IP address owned by them? nslookup and centralops.com will show only indicate the IP is on AWS.
Ashish Gupta's user avatar
6 votes
1 answer
486 views

What are the most valuable information when handling an IT security event/incident?

I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
Tom K.'s user avatar
  • 7,976
0 votes
1 answer
1k views

EML file type analysis

I'm working on finding infection points in EML file format. Want to know on what grounds does a scanner declare an email as spam or attachment as malicious? I mean does it scan by MIME content or any ...
rhym1n's user avatar
  • 3
2 votes
2 answers
463 views

Is it possible to browse Windows 7 Previous Versions of an offline hard drive?

Short of buying identical hardware, my sister's computer died and she kept only the hard drive. She moved a file to a USB FD prior to it dying, but she can't find the FD. She knows it was on the ...
user208145's user avatar
2 votes
1 answer
680 views

Does corrupting several bytes of an encrypted zip make it unrecoverable?

Can adversary extract data from a deliberately corrupted archive? If I archive a folder with 7zip, and I use a password (including header encryption) will garbling a few bytes at a particular offset ...
John G's user avatar
  • 21
0 votes
4 answers
1k views

If I create a website using a VPN, am I safe from law enforcement finding out I made the website?

If I created a website online using a VPN, can law enforcement still find out I made the website? What other forms of identification could potentially give away that my computer made this website, and ...
user8358234's user avatar
-1 votes
1 answer
144 views

Modifying the date time of the files before creating a zip archive

When we create a zip archive with same content more than once, the output zip archive may have different digest. It because date and time in the files we used in creating the zip archive. Because of ...
RPG's user avatar
  • 1
1 vote
1 answer
780 views

How can I capture files malware creates and then deletes? [closed]

Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?
Polo's user avatar
  • 11
1 vote
1 answer
451 views

How to look up a file that has been split into segments in a memory snapshot

I have a snapshot of the memory of a device loaded up in FTK Imager. I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the ...
Kaito Kid's user avatar
  • 135
1 vote
2 answers
200 views

What should I check on temporarily lost computer?

I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in ...
ericksonla's user avatar
1 vote
2 answers
244 views

How to store malware executables?

I have been developing a simple honeypot system. Configuration of the honeypot system is: Main router R has two parts: part A and B. Part A is turned off and part B is set as a DMZ with a single PC ...
Shamindra Parui's user avatar
1 vote
2 answers
652 views

NTFS volume not recognized by autopsy

Using dcfldd, I have imaged one disk of a win10 mirrored volume. Autopsy does not recognize it as an NTFS file system, but instead shows "SFS" or "secure file system". The target machine is, indeed, ...
DrDamnit's user avatar
  • 864
1 vote
1 answer
2k views

Is it possible to prevent VirtualBox (or other VM) from leaving traces on host?

The context: I already use FDE on my system drive (strong cipher, long unguessable password, etc.), but on the off-chance that my password is stolen or my computer is cold-booted, I want to prevent ...
Walter's user avatar
  • 111
2 votes
1 answer
204 views

My local certificates may have been compromised. What to do now? [closed]

My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
victim's user avatar
  • 29
7 votes
2 answers
1k views

Is there a way to perform data acquisition on CPU's registers?

In Digital Forensics, as a best practice, an investigator should collect data from the most volatile source to the least volatile source. Usually, when talking about live/Dynamic Acquisition, most ...
HSN's user avatar
  • 998
1 vote
1 answer
3k views

How to analyse a zip file forensically? [closed]

I have a zip file and want to know as much as possible about it. Some information is obvious like creation date etc. But what kind of information could be found by a forensic analysis?
honze's user avatar
  • 1,106
1 vote
1 answer
199 views

Break anonymity in a Kippo honeypot

I've installed a Kippo honeypot on my server and I wanted to know if there are some tools I can launch to collect more information about the cracker. I want more information to be able to start some ...
dh4rm4's user avatar
  • 11
4 votes
1 answer
3k views

Equivalent of Windows Process Hollowing on Linux/Unix/MacOS

To sum up process hollowing on Windows: basically, a legitimate PE binary (exe usually) is used to start a process in suspended state, after which process memory is replaced with code and data of a ...
Andy T's user avatar
  • 41
2 votes
0 answers
1k views

How to extract watermark from an image [closed]

I have a task to extract watermark itself from a highly complex image. Below there is an example. We have, say this image: Then we have some watermark like this one which is either transparent or ...
tna0y's user avatar
  • 129
2 votes
1 answer
5k views

Grabbing a hash from a suspected sqllite3 database file

I have a .db file that is encrypted when opened with DB Browser for SQLite as it asks for a password which is not known. I am trying to obtain the hash and hash type for this file as I know it has ...
PacketDecoy's user avatar
0 votes
1 answer
290 views

How do you create a password list for a forensics case based on the evidence [closed]

I would like to compile a list of strings and filenames based on digital evidence obtained to make them into a password dictionary. I understand that FTK offers this solution but it's not free to use. ...
PacketDecoy's user avatar
-3 votes
1 answer
2k views

How do I do computer forensic from an IP address to the actual computer? [duplicate]

I want to genuinely trace and identify computers connecting to my server with malicious intend. I am quite new to networking world. That is trace malicious ip back to the actual computer. I wanted ...
eskoba's user avatar
  • 113
2 votes
1 answer
335 views

Will a `dd` clone between two drives effectively "wipe" the contents of the target drive?

From a security standpoint, given two drives having the same capacity (i.e. 256 GB), source drive (A) and target drive (B), will performing a full dd clone of Drive A effectively "wipe" the contents ...
Matt Borja's user avatar
2 votes
2 answers
300 views

GPS vs Telecom companies

My phone is able to give me an exact position of my whereabous, using Google Maps I am able to pinpoint my exact location. However, what can the phone telecom company see? I've read many different ...
AndroidStupid's user avatar
2 votes
1 answer
258 views

How would this be traced back?

I was thinking about this, and I can't wrap my mind around it. Assume a person with malicious intentions that has created malware in a virtual machine. Then, this person, using the Tor browser uploads ...
Offtkp's user avatar
  • 123
1 vote
4 answers
11k views

is deleted data immediately overwritten with new data in hard drives

In hard drives deleted data can be overwritten. But is it immediately overwritten when new data is stored? For example, I take a picture and deleted it. After sometime, I take a new picture. Is that ...
user avatar
3 votes
1 answer
200 views

Is it "normal" to find procedures in the middle of a .mov file with a disassembler?

I used hopper disassembler to see if there was any strange activity on this particular mov file. What was bizarre and unexpected was This .mov file is particularly strange such as it seems to lower ...
BillTheMagnificient's user avatar
1 vote
1 answer
207 views

Veracrypt - When using Full OS encryption, isn't it easier to decrypt using the OS file placement?

Let say you encrypt A.jpg and B.jpg , B is just after A in the hard drive. let say A = 0101 B = 1001 on unencrypted HDD : AB = 01011001 once encrypted : AB = 11111011 if someone know A is the ...
Kindred's Kaiser's user avatar
3 votes
1 answer
253 views

Does an end user (or CA) certificate have any "fingerprinting" to indicate the brand of PKI being used?

As part of my forensics, I want to determine if a given certificate has any indicator of which PKI software was used to create it. So far, I see differences in the following properties for a ...
makerofthings7's user avatar
2 votes
4 answers
40k views

How can I locate the device that log in my gmail account?

My company Gmail was logged into by someone else and sent out unhealthy messages to people in my company. I looked back to my login history and found a phone device login which is not mine. Can I ...
Anh Tai's user avatar
  • 23
2 votes
3 answers
449 views

Searching for files on unknown/proprietary filesystem [closed]

I am attempting to find any files or folders on an SD card. Currently I've been looking at it with Foremost, but with no success. I know for certain that the file-system on the SD card is non-...
Spriter's user avatar
  • 43
1 vote
1 answer
150 views

Anonymity of session hijackers using dsploit [closed]

I was wondering about the possibility of finding out culprits who hijacked others' sessions and tried using google to find an answer several times, but I always failed. Before I ask a question, let's ...
Jim's user avatar
  • 11
0 votes
1 answer
325 views

it is possible to make a copy of an iPhone?

Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer? Can I use the dd command to do this? Are any alternative ways to a clone an ...
duca's user avatar
  • 23
1 vote
1 answer
221 views

How to find the vulnerability of my server after attack? [duplicate]

A few days ago, my company server was attacked by hackers who wiped the whole database in /var/lib/mysql/ folder. Fortunately, I was able to restore everything from backups, but I'm not able to find ...
Marko T's user avatar
  • 11
2 votes
0 answers
304 views

How to detect malformed MP4 files that crashes iOS devices

Recently I was made aware of an iOS bug that when a specifically malformed mp4 was played on an iOS device, it would crash. After searching around for the mp4 I found it and am trying to figure out ...
MikeSchem's user avatar
  • 2,361
2 votes
3 answers
2k views

How to investigate my wifi router for devices which are disconnected earlier

I have a D-link 600M router with a simple WPA2 password that got cracked. 60 Gb of data was downloaded (I think they downloaded torrent movies), which resulted in the renewal of my data plan. I ...
john doglas's user avatar
3 votes
0 answers
117 views

Obscuring/detecting changes to a digital photograph

Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics. With so much of our modern security based on ...
thanby's user avatar
  • 183
1 vote
1 answer
118 views

What methods are there for using an encrypted database to perform logging that is legally and forensically trustworthy?

I am researching logging in a way that it could be used legally and also forensically trustworthy. I have seen discussions about remote logging, hash chaining, timestamp chaining, write-once media. ...
AztecJones's user avatar
2 votes
0 answers
1k views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
Yang Yu's user avatar
  • 439

1
3 4
5
6 7
11