All Questions
Tagged with windows-10 forensics
7 questions
0
votes
1
answer
253
views
Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition
I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
- 73
1
vote
0
answers
3k
views
Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]
So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent:
PS F:\> C:\Python27\python....
- 111
1
vote
0
answers
183
views
saving entire Windows event log for auditing & preserve digital evidence
As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down.
...
- 443
2
votes
0
answers
920
views
How to detect file or file system tampering
I would like to know if the following is possible:
Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
- 21
0
votes
1
answer
3k
views
SRUM (system resource usage monitor) forensics - Windows server?
Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
2
votes
1
answer
215
views
My local certificates may have been compromised. What to do now? [closed]
My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
- 29
0
votes
2
answers
284
views
How to know if somebody has logged in and when to my win 10?
Situation: there is a computer with windows 10. There is also some system that system administrator can change password of windows account from his computer. I do not have idea what software does this....
- 352