Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
14 votes
1 answer
2k views

Do Blu-ray drives have an RID?

CDs and DVDs have a unique number identifying the drive that writes them named a RID (Recorder IDentification). Does a Blu-ray, a newer form of optic-media, also have an RID? This is a follow up to ...
Evan Carroll's user avatar
  • 8,875
1 vote
1 answer
268 views

How to find last user added in Linux?

We had an attack on some of our Linux servers and we need to find if new users where added to the OS, I checked /etc/passwd and it doesn't seem to be something strange, but it doesn't show when each ...
Chico3001's user avatar
  • 274
0 votes
1 answer
182 views

How to obtain a lost version of an edited notepad [.txt] file on a Windows 10 hard drive using a SATA SSD to USB dongle

About 1 year ago I had saved some code on a notepad text file (.txt) I was building using a Windows 10 computer. However, I deleted a portion of the code and saved the text file with a new c++ code ...
user avatar
0 votes
0 answers
40 views

External Hard drive is not detected on disk manager despite showing in device manager

My external Hard drive is not detected on my computer, It shows up on device manager under but in disk management section it does not appear I have exhausted all possible reason like, issue with ...
Dhaval Patel's user avatar
1 vote
0 answers
124 views

How can I get the Product Key with Autopsy or FTK viewer?

I have a disk image divided in 4 files, image.E01, image.E02, image.E03 and image.E04. I created a case in autopsy and I'm trying to recover the Product ID and the Product Key. The product ID I ...
user avatar
0 votes
0 answers
352 views

How to install The Sleuth Kit if "configure" file is missing?

I tried installing from source on macOS. The repo does not have a configure file, so I cannot run $ ./configure as mentioned in the installation instructions. The repo has a configure.ac, so ...
miguelmorin's user avatar
  • 2,047
0 votes
1 answer
436 views

How can i dump the contents of a file that was opened with nano in a running process? (Linux)

I have run the command ps -ef and found the following : UID PID PPID C STIME TTY TIME CMD root 1 0 0 12:30 ? 00:00:00 socat tcp-l:1024,reuseaddr,f root ...
Astral Wanderer's user avatar
0 votes
1 answer
90 views

What happens to the free space of HDD2 if dd is used to write the smaller device HDD1, to HDD2?

What happens to the space left on sdb in this case? I assume dd will write the data at the beginning, replace the partition table, and the free space will be untouched (not usable). sda = 10 GB sdb = ...
MikeSkril's user avatar
10 votes
4 answers
4k views

Recover a file after shred command

Let's say I have some sensitive files in my computer and I want to completely delete them so that no one can ever retrieve them. For that, I can use the rm command, but it's still easily recoverable. ...
Vincent's user avatar
  • 111
0 votes
2 answers
247 views

Does Bitlocker securely erase the blocks where the first and last partition will go?

I have a question regarding bitlocker. Suppose I have any operating system installed on an unencrypted disk (windows for example) and I have confidential data on it. Then, someone formats the disk and ...
yellowdog's user avatar
  • 403
0 votes
0 answers
61 views

Recovery of deleted data from a modern disk

I have the opposite problem of this question's OP: What can be recovered? Securely deleted files I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then ...
user avatar
2 votes
1 answer
1k views

Data recovery on partition encrypted with Veracrypt - Input/Output error - Possible disk failure

I am trying to recover some data from my backup drive which is encrypted with Veracrypt as I recently encountered input/output error messages when I attempted to copy some of the files from it. This ...
Nicolai Prebensen's user avatar
1 vote
0 answers
2k views

Winlogon Event ID 811/812 event tags

In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
dash1234's user avatar
0 votes
1 answer
1k views

Can you tell if a document has had its metadata altered?

I'm dealing with a situation in which the other party has fabricated logs. These logs are presumably in docx or doc formats. A large part of the issue is that the logs are not contemporaneous - they ...
yepItsMeYourLookingFor's user avatar
0 votes
1 answer
312 views

Is there a way to demonstrate a message has been edited using Outlook's "Edit Message" (or its subject)?

Is there any way (complicated or no) to demonstrate that an Outlook message has been edited using the 'Edit Message' function, or that the subject was edited on its own? For purposes of this answer, I ...
MHarris1319's user avatar
0 votes
0 answers
2k views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
randomSapien's user avatar
0 votes
1 answer
684 views

Windows Event Viewer: can't find user-started programs

My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
Néstor Llop's user avatar
1 vote
1 answer
56 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user avatar
2 votes
0 answers
12 views

What can make unmounted volumes SHA512 hashes differ while mounted volumes content SHA512 hashes are identical?

I am trying to configure Raspberry Pi OS to be read-only. In theory, both / and /boot are read-only. That being said, I am experiencing a strange discrepancy and can’t figure out what is happening. I ...
sunknudsen's user avatar
-3 votes
1 answer
3k views

How to navigate to recycle bin through system level powershell

I'm having difficulty navegating to the recycle bin on windows 10 machines through powershell. I'm able to get &Recycle.Bin listed by using the force option on ls, but I can't change my directory ...
solumnant's user avatar
1 vote
1 answer
64 views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them? [duplicate]

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
5 votes
3 answers
2k views

How can I access the Windows search database in order to learn about files on a broken hard drive?

I have a Windows 10 PC and one of my hard discs broke completely (as in not recognized by the BIOS, makes funny noises and cannot be used). It was not the system disc but contained mostly private data....
NoDataDumpNoContribution's user avatar
0 votes
0 answers
36 views

Recover formatted HDD while mounting the drive

I had Windows Server installed on a SSD and a 1TB HDD with all the photos and files. I decided to use Ubuntu Server instead and i installed it in my SSD. Once installed I looked for my 1TB HDD but I ...
Francesco Dorati's user avatar
2 votes
4 answers
3k views

How does writing zeroes to a drive remove data from it?

I know a fair bit about the process of securely wiping drives, including that one wipe is usually sufficient and that no-one has yet (publicly) been able to recover a bit of data from one pass of ...
Hashim Aziz's user avatar
  • 12.7k
1 vote
1 answer
132 views

How to dump Verity .ddd file to a text file?

I found this very helpful information about Verity database structure .ddd file - Verity Documentum? Now I want to migrate an old Verity database to a new application, therefore I'd like to dump ...
Scorp's user avatar
  • 21
0 votes
0 answers
51 views

MS Word Metadata

This semester my CS 1501 final was replaced with a take-home exam in the form of a word document to be edited and uploaded by the due date. Something went wrong on my end where the file did not upload,...
Aaron Kaplan's user avatar
1 vote
1 answer
708 views

Does AWS support the TRIM command for EBS volumes that are SSD-backed?

I've gone over Amazon's documentation and it seems that the TRIM command is only implemented for some instance types that have internal SSDs (specifically, the C5d, G4, I3, I3en, F1, M5ad, M5d, p3dn....
vy32's user avatar
  • 3,361
0 votes
2 answers
13k views

Find hostname of an Windows image

How to find a hostname of a windows image? I've read about looking at the regback files, but also using C:/Windows/Debug/NetSetup.LOG When navigating to C:/Windows/Debug/NetSetup.LOG it shows several ...
The_Bear's user avatar
  • 105
3 votes
1 answer
7k views

How to convert dd partition image to virtualbox virtual disk?

I created a backup from /dev/sda1 and /dev/sda4 partitions using dd. but i did not create a backup from /dev/sda2 and /dev/sda3. How can I convert these 2 backup files from /dev/sda1 and /dev/sda4 ...
Rembo's user avatar
  • 162
1 vote
1 answer
290 views

Recovering a JPEG image with broken sections

Some files were corrupted while being recovered from a disk drive, including portions of videos and images. They all seem to share the trait of having sections of data replaced with repeating bytes (...
Vilius Povilaika's user avatar
0 votes
0 answers
1k views

Mount Android 10 dd image of /sda internal memory

Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (...
Vladmir's user avatar
  • 101
4 votes
3 answers
3k views

Delete 0x00 bytes at the end of files

I have rescued some files (Python, Shell scripts etc., so just text files) from a Linux SD card using FTK Imager Lite. The files are ok, but they now contain a lot of 0x00 bytes at the end. How could ...
Thomas Weller's user avatar
-1 votes
1 answer
743 views

How do I tell if a CD disc was burned 3 days ago or 3 months ago by physical inspection? [duplicate]

Is there a way to tell when a disk has been burned by inspecting the disc for its physical features?
Yugos's user avatar
  • 7
0 votes
1 answer
406 views

Windows System and DNS Client - constant querries for unknown local host

I noticed today that there was significant traffic on all my connected network interfaces (loopback, 2 VMWare network adapters, ethernet and wifi). Wireshark home page showing traffic graphs. The ...
jovonho's user avatar
0 votes
0 answers
894 views

Rekall Tool : SSL Error - Certificate_verify_failed (_ssl.c:1076)

I have a problem with SSL certificate. I would like to explain my problem. I'm trying to install Rekall tool and it's memory forensic framework. I installed Python 3.7 then I created new virtualenv ...
Yavuz's user avatar
  • 1
0 votes
1 answer
631 views

Does the filesystem windows is installed on have an effect on the time zone settings of timestamps within windows registry hives?

This question does not refer to the filesystem timestamps of the registry files themself. As far as I know timestamps within the Windows Registry are stored as UTC timestamps when Windows is ...
jalu's user avatar
  • 59
1 vote
1 answer
123 views

Determine what file a local leafpad instance has open

I'm running a leafpad text editor instance on a certain computer, which has a certain file open, whose name and location I have forgotten (it's actually more complicated but this is a simplified ...
einpoklum's user avatar
  • 9,393
0 votes
0 answers
608 views

Compare two whole HDD's contents, sector-level

While analysing two 4TB HDDs, which were in some kind of RAID 1 configuration, and thus have the same contents in terms of files / folders (they have been reformatted but R-Studio lists the same file ...
GabrielB's user avatar
  • 855
1 vote
1 answer
241 views

Where i can find CCleaner InstallDate? (forensics)

I have tried in HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall without finding anything any suggestions?
merio's user avatar
  • 11
0 votes
1 answer
2k views

Created date timestamp of the C:\Windows\ folder is older than the "original install date" of the Windows 7 OS, why?

Created date of my C:\Windows\ folder in a Windows 7 machine is "‎14 ‎July ‎2009, ‏‎08:07:05", however, the "original install date" obtained from the "systeminfo" command in cmd is "27-6-2013, 11.33....
Gradient's user avatar
2 votes
1 answer
318 views

Which system file stores the information displayed by the "net user Administrator" command in Windows 7?

Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine. Details of the command is ...
Gradient's user avatar
0 votes
1 answer
168 views

What does foremost do that is different from mount?

I was doing a challenge on picoCTF which involved getting a flag from a .dd file. The .dd file initially appears to be a FAT partition that contains some jpg files. My idea was to mount the file ...
Primusa's user avatar
  • 101
0 votes
0 answers
413 views

Fdisk doesn't recognize Macbook's file system

I need to mirror a MacBook, which was functioning properly. But when I ran fdisk -l, I got this: Disk /dev/sda: 113 GiB, 121332826112 bytes, 236978176 sectors Units: sectors of 1 * 512 = 512 bytes ...
André Cesarino's user avatar
2 votes
1 answer
421 views

How to import "RECYCLER" folders into Windows?

question: If I connect a HDD to my PC, how can I import the RECYCLER folder into Windows XP? In other words: How can I tell Windows XP to include the content of D:\RECYCLER\ in the recycle bin? case ...
summerrain's user avatar
0 votes
1 answer
224 views

'nosuid,nodev,nofail,noauto' equivalent in Windows?

So I'm doing forensic tool validation with multiple tools and operating systems. I have started on Linux using dd and the other two tools I need to use are FTK Imager and ProDiscover; both windows ...
Andrew Polemeni's user avatar
1 vote
0 answers
912 views

Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

There are two great articles about how to aquire memory on Linux using linpmem: SANS holdmybeersecurity Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
gies0r's user avatar
  • 381
9 votes
1 answer
17k views

How to mount an LVM volume from a dd/raw/vmdk image?

Input: RAW/DD Image of an HDD. fdisk -l shows partitions fdisk -l image.dd Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/...
gies0r's user avatar
  • 381
3 votes
1 answer
2k views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
crato's user avatar
  • 41
0 votes
0 answers
384 views

Broken external USB hard drive undetected by system

I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
Félicien's user avatar
2 votes
0 answers
1k views

How to dump memory of virtual machine running in linux?

I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
shubham0d's user avatar