191
votes
Accepted
Secure way of masking out sensitive information in screenshots?
Yes, it can be recovered.
As long as shutter does not use layer (it almost certainly does not) and as long as the black is really all black (it must not be transparent), it is enough.
The picture ...
- 7,858
158
votes
Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?
Yes, they're safe. Consumer memory DIMMs use volatile SDRAM memory. Volatile means that it does not hold its state after you turn it off.
SDRAM memory chips are constructed from an array of memory ...
- 136k
153
votes
Why is this 435 × 652 pixel JPEG over 6 MB?
Short answer: It's an artifact of Nikon Picture Project
I had difficulty finding "Nikon Picture Project" but finally found a 1.5 version to try. The last version produced was 1.7.6 .
It turns out ...
- 8,213
79
votes
Secure way of masking out sensitive information in screenshots?
You don't even need to use an image editor in this case to recover the "redacted" text. Simply zooming in on the image is enough to read it.
So I would say that yes, it most certainly is possible to ...
- 757
70
votes
Secure way of masking out sensitive information in screenshots?
In this case the image can be recovered very well
As others already pointed out the dark patch is not completely black. It has a transparent effect and only darkens the original image. The original ...
70
votes
Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?
Yes, they’re safe to sell. No consumer PCs use non-volatile RAM for their main memory.
- 10.3k
63
votes
Accepted
Is a password-protected stolen laptop safe?
Is a password-protected stolen laptop safe?
No.
The immutable laws of security say:
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
It doesn'...
- 1,117
44
votes
Accepted
Is NTFS encrypted by default?
No, NTFS is not encrypted by default.
can data be read straight from the sectors in clear text?
Yes, by default NTFS files are unencrypted. Since NTFS 3.0, EFS (Encrypting File System) is a ...
- 73.3k
44
votes
Why is this 435 × 652 pixel JPEG over 6 MB?
This was less interesting than it seemed at first. The user might just have a broken camera, broken memory card, or malfunctioning photo editing software that fails to save the full resolution image, ...
- 19.4k
40
votes
At what point is deleted data irrecoverable?
This depends a lot on what medium is used to store the data and what you consider "irrecoverable".
"Deleting" data mostly does not what most people think it does.
Simply put, after a standard ...
- 1,194
35
votes
How can you trust a forensic scientist to have maintained the chain of custody?
Traditionally, the investigator would physically remove the disk, put it in an evidence bag and take it to the lab. In the lab, they would remove it from the bag and use a physical read-only ...
- 34.7k
29
votes
Secure way of masking out sensitive information in screenshots?
Yes, the text can be unmasked, either by simply zooming in or using any of the techniques - but not restricted to - pointed by pabouk and Peter answers.
I have clearly asked for the correct/most ...
- 534
29
votes
Accepted
Why is this 435 × 652 pixel JPEG over 6 MB?
As other commenters have mentioned, the file contains data from Nikon Picture Project. What if you couldn't run that software, but you still wanted to know what was hidden inside?
Nikon's Picture ...
- 783
26
votes
How can you trust a forensic scientist to have maintained the chain of custody?
Ultimately you can't - there always has to be a level of trust in the people involved.
Once you have a hash of the original contents of the drive you can easily compare that to the hash of the image(s)...
- 16.5k
21
votes
Is a password-protected stolen laptop safe?
Just to add a very simple answer here, I regularly boot a linux live cd/usb on friends' computers who have done something weird and need to recover files, and simply copy them over to an external ...
17
votes
Why is this 435 × 652 pixel JPEG over 6 MB?
It's not corrupt, it's just filled with APP10 segments, containing some sort of application specific data. Nikon-specific probably, because there are Nikon-references in the APP1/EXIF segment at the ...
- 171
14
votes
How can you detect kernel exploits?
No, there is nothing all kernel exploits have in common.
Or at least, there is nothing unique to them and not present in standard, legal interaction with the kernel (such as using syscalls or ...
- 67.3k
13
votes
Is NTFS encrypted by default?
It actually doesn't need any forensics effort and is routinely done by Windows sysadmins.
Change the password of the Windows admin by booting a toolset of choice or simply attach the disk to a ...
- 3,608
12
votes
Is a password-protected stolen laptop safe?
As anion's answer points out, the data on your hard disk is generally not safe under the system you described. However, Windows does offer several encryption methods beyond just BitLocker, and they ...
- 52.1k
11
votes
Secure way of masking out sensitive information in screenshots?
Examples
As shown above, your example was breakable,the blacks of the redaction had variation showing the text.
Real life example
New York Times Suffers Redaction Failure, Exposes Name Of NSA Agent ...
- 3,197
11
votes
At what point is deleted data irrecoverable?
While the current leading answer dives into the technical details of data recovery, I will (try to) take the broader approach.
How do we define "irrecoverable"?
Depending on the circle you may ...
- 3,042
10
votes
Do XSS attempts leave any trace on the server?
What can the website owner see?
Basically everything.
If the XSS vector (<script>alert(1)</script> in your case) is part of:
- HTTP headers (including cookies)
- URL (path, query string)...
- 14.7k
10
votes
How can police get someone's search history?
What are the possible ways they can do that?
The main ways police can obtain search records are by:
Looking at local browser history on the suspect's computer (as you mentioned).
Demanding ...
- 67.3k
8
votes
Accepted
How can a user defeat anti-live forensics software?
There are many ways to compromise a running computer if you have physical access. How likely it is that you will be able to obtain the level of access you need depends on several factors, including ...
- 67.3k
8
votes
Secure way of masking out sensitive information in screenshots?
I think you may be misusing what's meant to be a highlight tool (I'm not at any of my Ubuntu machines ATM and don't have shutter installed anyway to test). I can't quite believe that a tool meant for ...
- 4,425
8
votes
Secure way of masking out sensitive information in screenshots?
Don't provide screnshots. Provide descriptions OR sample screenshots taken at times when sensitive data is not on the screen, with description that "X appeared here".
"It's no evidence!" you may say. ...
- 1,939
7
votes
Accepted
Is it possible data which was generated with JavaScript in Google Chrome could exist in my Mac'sRAM?
Very unlikely. The memory used by that page will have been freed and will almost certainly have been decommitted from the process, which means the OS will have scrubbed it by now.
At best you could ...
- 136k
7
votes
Accepted
How to dump the memory of a given process with Volatility 3?
To dump the whole memory (not only binary itself) of the given process in Volatility 3 you need to use windows.memmap.Memmap plugin with --pid and --dump options as explained here.
For example:
vol.py ...
- 86
6
votes
My local certificates may have been compromised. What to do now?
If you think an attacker has had unauthorised access to your system, the only way to be sure that you've removed the infection is to rebuild the system completely from trusted media.
Whilst you may ...
- 62.6k
6
votes
Accepted
Can I safely sell a used keyboard without risk of new owner recovering previous inputs?
Can this be somehow reprogrammed to store other data than just LEDs color combo?
Yes. Anything that have writable memory and a processor can be programmed. Will it be reprogrammed? I seriously doubt.
...
- 55.5k
Only top scored, non community-wiki answers of a minimum length are eligible