The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
4answers
45k views

How to recover unsaved PSD file on MacOSX

Adobe Photoshop creates temporary *.psb files for emergency recovery at this path: ~/Library/Application Support/Adobe/Adobe Photoshop CS6/AutoRecover The files created have names like _Untitled-...
0
votes
1answer
62 views

Wiping a Hard Disk while leaving a message behind

I wanted to know if there was a method to wipe a hard disk, so that if someone tried to recover data, they would be greeted by a message that the wiper chooses. For instance, in this video the wiper ...
2
votes
1answer
51 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
1answer
48 views

How do I tell if my laptop has been messed around with?

I just have my laptop to h local service people, but the thing is, I live in a bad neighborhood. I took a backup before giving it. But how will I be able to tell if they switched out any parts with ...
9
votes
2answers
28k views

What does dd conv=sync,noerror do?

So what is the case when adding conv=sync,noerror makes a difference when backing up an entire hard disk onto an image file? Is conv=sync,noerror a requirement when doing forensic stuff? If so, why is ...
0
votes
3answers
49 views

Linux server just as RAMdisk

I want to setup an anti-forensic Linux server to protect my users. My aim is to have the Linux distro and everything inside of it running from RAM, never storing anything permanently. It is possible ...
1
vote
0answers
46 views

Avoid undeleting corrupted/partially overwritten files

Recently I dealt with some computers infected by ransomware, with encrypted user files. My job was to either decrypt these files (if possible), or recover as much usable files as possible. That ...
0
votes
1answer
41 views

How to tell if a program or process tried to print or print info

I'm trying to work with third party support on a financial program called Mercury. The program says it has successfully printed a report through its "scheduler", but never physically prints anything. ...
2
votes
0answers
63 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
0answers
28 views

SIFT Workstation v3 Rollback on Ubuntu 14.04

I am a lawyer taking courses in Digital Forensics and also, quite new to Ubuntu (and Linux in general). I installed SIFT Workstation v3 on my Ubuntu 14.04 installation using the bash: wget --quiet ...
0
votes
0answers
53 views

Why is Encase disk image smaller than used space on source HDD?

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No ...
-1
votes
1answer
39 views

Writing directly to the hard drive

Is there any command/program in Linux that allows me to write directly to the hard drive, like memory cleaning programs do when they overwrite unallocated space with zeros? Also, how do you tell ...
0
votes
0answers
20 views

Editing RAM in real time

Is it possible to edit ram in real time with hexdump or any other program? How? I read here http://linuxpoison.blogspot.pt/2011/04/how-to-read-content-from-ram-random.html that I can see the ...
0
votes
0answers
55 views

How can we get past records of paging file sizes in Windows? [closed]

A drive can be allocated an "initial size" and a "maximum size" for the paging file using "System Properties → Advanced → (Performance) Settings → Advanced (tab) → (Virtual Memory) ...
0
votes
1answer
263 views

How to get complete memory dump in Windows 10?

It is possible to get information like process ID, process type, physical & virtual address from a memory dump in Windows 10?
0
votes
0answers
23 views

How do I retrieve a Thunderbird profile's stored passwords - without Thunderbird?

Same question as here: How do I retrieve the stored password from Thunderbird? But I can't run Thunderbird, or can't run it and have it look at the profile directory. I only have read access to that ...
2
votes
2answers
530 views

Windows Application Analyzer

I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including: File System changes Registry changes ...
0
votes
0answers
30 views

Software tool to extract original embedded images from PDFs?

Does anyone know a simple (possibly free) extractor for PDFs for Windows? I'd like to extract original images from PDF as they were embedded (preserving image meta info), so I can do some forensics ...
0
votes
0answers
42 views

File Time Stamp Change Detection

I am doing some forensic exercises and am uncertain about detecting timestamp tampering/forgery. The files were created on an SD card on a mobile device(android) so I assume it's a FAT 32 file system. ...
0
votes
2answers
3k views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...
1
vote
2answers
710 views

Forensics - scan guest OS (WinXP) and files from host OS (Win7 64) using VMWare Player or VirtualBox

I have a Windows XP laptop that was infected with a virus; the virus was removed but network connectivity was jacked up. I boot to Ubuntu from a USB key to move files between the system and the ...
0
votes
1answer
149 views

6 year old Mac Hard Drive “date created” and “date modified” changed to 2 weeks ago

Edit: deleted because I made a mistake in providing the original situation / scenario. The "hard drive" dates were not changed ... I was mistakenly looking at the child "volume" "Alias" which always ...
1
vote
1answer
4k views

Find Windows Registry Key Modify Date

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt. Is there any way to pull this information from a mounted windows hard-...
2
votes
1answer
33k views

How to Recover Google Chrome User Settings

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting ...
1
vote
1answer
218 views

Raw reading USB mass storage or SCSI

Wife's USB HDD has a slight issue where a folder refuses to open (NTFS filesystem). I have been able to image the drive with Linux but for one sector (sectors are 4096 bytes). Reading that sector ...
0
votes
2answers
46 views

Checking for changes on Linux live OS's

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
1
vote
0answers
46 views

How can I convert a domain controller account to local account for forensic analysis?

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
1
vote
0answers
88 views

How can I view an “EA Record” (presumably part of the MFT in NTFS)?

I recently ran into a situation where a failing USB hub caused an external hard drive to not "safely disconnect." In the process of repairing the drive to avoid having Windows see it as a RAW ...
1
vote
1answer
201 views

strace to discover sudo password persistence location

strace/dtrace/ltrace ... useful for lots of things, from finding hidden access violations to network socket tracing, but maybe it can't see all. I haven't been able to figure out using strace (it ...
1
vote
1answer
90 views

Forensic DVD-R data

Forensically speaking, is there a way to read metadata, user profile, computer, or burning info on a DVD-R? I need to discover more about who made an illegal copy of a movie... Is this something ...
0
votes
1answer
118 views

basic: adding a profile in Volatility

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the /Volatility/...
2
votes
2answers
124 views

File Recovery No Signatures(Magic Numbers)

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
0
votes
1answer
96 views

How to check for certain USB disk activities on windows?

I used FTK images to take image of the documents and registry files for a PC. I want to check for certain USB disk , when the last time it was used and when it was unplugged and activities during that ...
0
votes
0answers
46 views

How to display a fragment of an image file using Scalpel

I am working on a demonstration using Scalpel and its abilities to carve out image files. I took a small thumb drive and filled it with many small sized files until it was full. I then went and ...
0
votes
1answer
719 views

How to locate deleted data from recycle bin in Windows 7 and Windows 8.1?

I'm using Windows 7, but I tested Windows 8.1 with the same results. From what I understand deleted files in recycle bin are stored as $R or $I format, however nothing is visible when I search command ...
1
vote
2answers
224 views

NTFS MAC Times in Hexadecimal

I am using EnCase and a Hex Editor to analyse a virtual drive. EnCase says that the this hexadecimal: 5FBF60C54F2CCF01 is the date/time (mm/dd/yy): 02/17/14 09:18:54 (PM) I have worked out date/...
1
vote
0answers
43 views

How to mount a HDD for forensics?

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?
3
votes
0answers
372 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
1
vote
3answers
611 views

Can you reuse a SSD after applying a Zero-Fill software?

I am returning my laptop to the retailer but I have had it for 1 month, In this time I have stored some confidential information, Because of this I am planning to zero fill my SSD using http://cmrr....
2
votes
1answer
350 views

Location of Event logs in Windows

I have found that Windows logs every event such as system login/out, USB connection's history, etc. This all can be viewed in Event viewer. But my question is Where on the filesystem are the event ...
8
votes
2answers
2k views

Find the service creation date in Windows?

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the ...
2
votes
2answers
2k views

Read (repair) data from broken floppy disc on a linux system

How can i read an old floppy disk under Linux that has some problematic sectors? In times of DOS people used magic tools like Norton Disk Doctor and others. Some of these tools read the broken part ...
0
votes
1answer
94 views

Where can I get name of the person who registered Windows and his organization?

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
6
votes
2answers
2k views

Is it possible to confirm CD was burned on a particular machine?

Is it possible to determine whether a CD was burned by a particular CD/DVD burner? Is there any identifier of that burner that is always written to any disc it burns? This is something I'd like to ...
3
votes
1answer
346 views

What is this character-set corruption? (ISO-2022?)

I have a text file from a legacy source which contains corrupted characters. At first I thought the corruption was just gobbledygook, but it appears upon closer examination that some of the corrupted ...
-2
votes
2answers
1k views

Getting data off a flaky WD external drive

I have a Western Digital 1TB MyBook with some photos that I would like to offload and access. A PC seems to see the drive; a Mac doesn't see it over Firewire or USB. Between Windows 7, Windows XP, ...
1
vote
1answer
37 views

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
0
votes
2answers
61 views

How can I tell whether I was BCCed to a MIME message?

In a MIME message, if my address is in the TO or CC fields, I know it was addressed to me in one of those ways. But what about BCC? Can I tell - from the copy of the message as I receive it from the ...
1
vote
0answers
77 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
12
votes
2answers
11k views

How to find out when a disc (DVD) has been written/burned?

Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it ...