The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
185 views

Recovering Images from Formatted HFS+ Hard Drive

Is it possible to recover JPEG images using a low level scan of a hard drive? The hard drive we originally formatted in HFS+ and has since been reformatted. OS X has also been reinstalled.
0
votes
1answer
363 views

Ext4 forensic analysis

I'm doing a thesis about forensic analysis and I'd like to format a disk with an ext4 file system without zeroing it, to analyze the possibility to recover deleted files. This is a problem, because ...
2
votes
0answers
225 views

How can I know which blocks/sectors were last written to on an NTFS volume?

Is there a tool that would enable me to identify which blocks of data were last (most recently) written to an NTFS volume? Perhaps the NTFS volume's "$Journal" file might have information that can be ...
-2
votes
2answers
1k views

Getting data off a flaky WD external drive

I have a Western Digital 1TB MyBook with some photos that I would like to offload and access. A PC seems to see the drive; a Mac doesn't see it over Firewire or USB. Between Windows 7, Windows XP, ...
0
votes
1answer
93 views

How to find if a user has connected another HD via SATA or IDE?

I need to find a registry place that can give me the necessary information to know if someone has connected another (in addition to the current one) HD (SATA or IDE) to the computer. Is there a ...
2
votes
2answers
414 views

Windows Application Analyzer

I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including: File System changes Registry changes ...
8
votes
3answers
3k views

Police found & returned my stolen laptop reformatted by thief. Can installation logs help locate the thief?

Three weeks ago my laptop was stolen from campus. I immediately reported it to police and on manufacturer's website. A couple of days ago a man called the manufacturer and said he bought a second-hand ...
7
votes
1answer
6k views

dd_rescue vs dcfldd vs dd

What are the main differences between dd_rescue, dcfldd, and dd? In what situations would you use one over the other? Why are there three different yet simliar programs?
3
votes
0answers
348 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
25
votes
17answers
6k views

How can I physically destroy data from a failed HDD?

I have a broken HDD that contains sensitive data. Since no software can access the disk, I can't wipe it using any of the tools generally suggested. Breaking the disk physically into very small ...
1
vote
2answers
2k views

Is there any full disk encryption out there that does not have any forensic traces? Any effective method?

I've been testing quite a number of full disk encryptions but still new in computer forensic stuffs. I'm fully aware of decoy/hidden OS and cold boot attack though. Even Truecrypt and Bestcrypt ...
5
votes
1answer
366 views

How to identify which editor was used to make/edit an image?

I saw this the other day This behavior is not uniform.The same does not happen if I use MS Paint or any other editor though. Question: Are there methods to discover which editor was used to ...
1
vote
2answers
587 views

Forensics - scan guest OS (WinXP) and files from host OS (Win7 64) using VMWare Player or VirtualBox

I have a Windows XP laptop that was infected with a virus; the virus was removed but network connectivity was jacked up. I boot to Ubuntu from a USB key to move files between the system and the ...
14
votes
1answer
4k views

Where is the serial number of the DVD/CD writer stored on the CD?

I was reading the Wikileaks FAQ (archived here), it says: Many CD and DVD writers will include the serial number of the DVD or CD writer onto the CD/DVDs they write. If the post is ...
1
vote
1answer
347 views

What is the best way to undelete some photos on Linux? Is there any way to use foremost to only recover files that only contain some text?

I accidentaly deleted some digital photos I had recently taken, and I wanted to undelete them. I found out about Foremost, and it allows me to recover jpg files, but will fo that with all of the ...
1
vote
2answers
856 views

hard drive forensics tool for linux

I am looking for an application I used in 2001. It was a curses application that displayed devices or files in hexadecimal format, and allowed searching through them and other functionality. I can't ...
2
votes
5answers
351 views

Looking for a way to image an entire harddrive to an external usb drive

I have a 100GB NTFS-formatted drive, and a 250GB external USb disk. I am thinking of using a live disk, as is described here, except that I will skip the gzip part. ...
6
votes
2answers
2k views

Is it possible to confirm CD was burned on a particular machine?

Is it possible to determine whether a CD was burned by a particular CD/DVD burner? Is there any identifier of that burner that is always written to any disc it burns? This is something I'd like to ...
0
votes
2answers
140 views

Where can I find a complete list of all the logs in the system?

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I ...