The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
18 views

What artifacts to acquire when looking for IoC? [migrated]

I want to hunt for the Indicators of Compromise (IoC) in a potentially infected Windows PC. I am writing a batch script that would record the information needed for analysis. It includes the ...
0
votes
1answer
64 views

6 year old Mac Hard Drive “date created” and “date modified” changed to 2 weeks ago

Edit: deleted because I made a mistake in providing the original situation / scenario. The "hard drive" dates were not changed ... I was mistakenly looking at the child "volume" "Alias" which always ...
0
votes
2answers
20 views

Checking for changes on Linux live OS's

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
1
vote
1answer
102 views

Raw reading USB mass storage or SCSI

Wife's USB HDD has a slight issue where a folder refuses to open (NTFS filesystem). I have been able to image the drive with Linux but for one sector (sectors are 4096 bytes). Reading that sector ...
1
vote
0answers
36 views

How can I convert a domain controller account to local account for forensic analysis?

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
1
vote
0answers
28 views

How can I view an “EA Record” (presumably part of the MFT in NTFS)?

I recently ran into a situation where a failing USB hub caused an external hard drive to not "safely disconnect." In the process of repairing the drive to avoid having Windows see it as a RAW ...
1
vote
1answer
62 views

strace to discover sudo password persistence location

strace/dtrace/ltrace ... useful for lots of things, from finding hidden access violations to network socket tracing, but maybe it can't see all. I haven't been able to figure out using strace (it ...
1
vote
1answer
50 views

Forensic DVD-R data

Forensically speaking, is there a way to read metadata, user profile, computer, or burning info on a DVD-R? I need to discover more about who made an illegal copy of a movie... Is this something ...
2
votes
0answers
42 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
1answer
40 views

basic: adding a profile in Volatility

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the ...
2
votes
2answers
56 views

File Recovery No Signatures(Magic Numbers)

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
0
votes
1answer
75 views

How to check for certain USB disk activities on windows?

I used FTK images to take image of the documents and registry files for a PC. I want to check for certain USB disk , when the last time it was used and when it was unplugged and activities during that ...
0
votes
0answers
34 views

How to display a fragment of an image file using Scalpel

I am working on a demonstration using Scalpel and its abilities to carve out image files. I took a small thumb drive and filled it with many small sized files until it was full. I then went and ...
0
votes
1answer
329 views

How to locate deleted data from recycle bin in Windows 7 and Windows 8.1?

I'm using Windows 7, but I tested Windows 8.1 with the same results. From what I understand deleted files in recycle bin are stored as $R or $I format, however nothing is visible when I search command ...
1
vote
2answers
93 views

NTFS MAC Times in Hexadecimal

I am using EnCase and a Hex Editor to analyse a virtual drive. EnCase says that the this hexadecimal: 5FBF60C54F2CCF01 is the date/time (mm/dd/yy): 02/17/14 09:18:54 (PM) I have worked out ...
1
vote
0answers
28 views

How to mount a HDD for forensics?

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?
1
vote
3answers
320 views

Can you reuse a SSD after applying a Zero-Fill software?

I am returning my laptop to the retailer but I have had it for 1 month, In this time I have stored some confidential information, Because of this I am planning to zero fill my SSD using ...
8
votes
2answers
527 views

Find the service creation date in Windows?

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the ...
2
votes
1answer
109 views

Location of Event logs in Windows

I have found that Windows logs every event such as system login/out, USB connection's history, etc. This all can be viewed in Event viewer. But my question is Where on the filesystem are the event ...
0
votes
1answer
60 views

Where can I get name of the person who registered Windows and his organization?

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
0
votes
2answers
1k views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...
0
votes
2answers
52 views

How can I tell whether I was BCCed to a MIME message?

In a MIME message, if my address is in the TO or CC fields, I know it was addressed to me in one of those ways. But what about BCC? Can I tell - from the copy of the message as I receive it from the ...
3
votes
1answer
203 views

What is this character-set corruption? (ISO-2022?)

I have a text file from a legacy source which contains corrupted characters. At first I thought the corruption was just gobbledygook, but it appears upon closer examination that some of the corrupted ...
1
vote
1answer
162 views

.ddd file - Verity Documentum?

I work in computer forensics - one of the data sets that I have recently been asked to analyse contains a number of .ddd files that I have so far been unable to open. Reading through these files in a ...
1
vote
1answer
34 views

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
2
votes
1answer
19k views

How to Recover Google Chrome User Settings

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting ...
0
votes
1answer
286 views

How do I erase a Samsung Magician encrypted solid-state drive (SSD)?

I need to securely wipe a Samsung 840 solid-state drive (SSD) of a co-worker that's leaving the company. My colleague ran into a problem he can't find the answer to. The drive is encrypted with ...
0
votes
2answers
72 views

Retain information by an IP address [closed]

What information can I get only by having an IP address ? For example: Computer name, domain name, dns servers (if it's a server) etc. Thank you.
0
votes
1answer
123 views

Is SSD safer than hard drive in terms of data not been stolen?

With hard drives, even after you delete its content permanently (not just moving it into trash), there is a specific magnetic techinique that can be used to recover data. From the point of view of ...
1
vote
0answers
309 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
0
votes
1answer
105 views

Do the Bitlocker Keys Clear from Physical Memory after Shutdown?

It is claimed that Passware Kit Forensic can recover passwords or keys of drives encrypted by Bitlocker. This needs an image of the encrypted drive plus a so-called Physical Memory image of the target ...
0
votes
0answers
55 views

Hard drive not powering

I've got a SATA hard drive attached to a forensic write blocker (Tableau e35u), but the drive will not be recognized. This is because I can't power the write blocker when the drive is attached. The ...
2
votes
0answers
144 views

Extracting blocks from a corrupt VDI snapshot in logical order

I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the ...
0
votes
3answers
4k views

What's the best way to copy data without leaving a trace? [closed]

I was wondering if uploading data from system disk onto a file sharing online service, but it seems like the system logs these and they could be traced by the cookies of that website. Is it the same ...
0
votes
0answers
196 views

Where can I find evidence of changes in the amount of RAM installed on a windows machine?

My relative recently had his motherboard replaced at a repair lab. He currently has 2GB RAM installed and if my memory serves me right he had 4GB before the 'repair'. I want to go to the shop with ...
1
vote
0answers
69 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
1
vote
1answer
2k views

Find Windows Registry Key Modify Date

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt. Is there any way to pull this information from a mounted windows ...
0
votes
0answers
314 views

Recover Files from Verizon LG EnV3 (VX9200) Phone?

I am running into trouble trying to recover files from my Verizon LG EnV3 VX9200 phone. My computer, running Windows 7, will only read the phone as a Windows Portable Device and will not assign the ...
0
votes
4answers
30k views

How to recover unsaved PSD file on MacOSX

Adobe Photoshop creates temporary *.psb files for emergency recovery at this path: ~/Library/Application Support/Adobe/Adobe Photoshop CS6/AutoRecover The files created have names like ...
0
votes
1answer
341 views

amr files properties - recording date viewer

I used my old Nokia phone to record some conversations. I copied the files to my computer. Files are in amr format. The problem is I don't remember when did I record those files. Is there a property ...
5
votes
1answer
18k views

What does dd conv=sync,noerror do?

So what is the case when adding conv=sync,noerror makes a difference when backing up an entire hard disk onto an image file? Is conv=sync,noerror a requirement when doing forensic stuff? If so, why is ...
0
votes
1answer
545 views

In Windows, when does a shutdown protect the data?

I have a Windows 7 computer and I am doing some tests: instead of shutting down it properly through the menu shutdown command I switch off the power supply. At the next boot Windows shows the message: ...
1
vote
1answer
75 views

Information flow in Linux - how to tell who is currently active and typing?

I'm currently playing a mafia/werewolves game with my cyber-security class. The basic idea is: on one machine, the moderator starts a server program all the players ssh into the machine and launch ...
0
votes
0answers
47 views

Why can't my forensics live cd mount windows share

I am having a rather aggravating issue. I want to output Dcfldd to a Windows share on another machine but I cannot mount the share, I have tried on Backtrack and Sans SIFT both in forensics mode and ...
0
votes
2answers
1k views

Trying to recover a deleted .bash_history file

It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config. I mounted the image as read-only, and found ...
1
vote
2answers
181 views

How to find the extension of a file once it has been removed or changed? [duplicate]

Say you are given a file whose extension has been removed or changed (file.tar.gz --> file.blah). This file is decompressed and its contents are used by an application. But you don't have access to ...
-1
votes
2answers
407 views

Is there a Windows utility to delete contents of RAM left by an application? [closed]

Ideally, this utility would know where in physical RAM an application was and completely clear its contents when it's closed. Does anyone know of such a utility?
11
votes
2answers
8k views

How to find out when a disc (DVD) has been written/burned?

Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it ...
0
votes
2answers
717 views

How do I find the sectors that populate a hard drive track?

How do I determine the sectors that are occupying a drive track? I am interested in locating "the last 512 bytes of the first logical drive track" in order to determine if a drive is encrypted with ...
1
vote
2answers
2k views

Read (repair) data from broken floppy disc on a linux system

How can i read an old floppy disk under Linux that has some problematic sectors? In times of DOS people used magic tools like Norton Disk Doctor and others. Some of these tools read the broken part ...