The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
4answers
41k views

How to recover unsaved PSD file on MacOSX

Adobe Photoshop creates temporary *.psb files for emergency recovery at this path: ~/Library/Application Support/Adobe/Adobe Photoshop CS6/AutoRecover The files created have names like ...
0
votes
2answers
42 views

Checking for changes on Linux live OS's

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
0
votes
2answers
59 views

How can I tell whether I was BCCed to a MIME message?

In a MIME message, if my address is in the TO or CC fields, I know it was addressed to me in one of those ways. But what about BCC? Can I tell - from the copy of the message as I receive it from the ...
1
vote
1answer
196 views

.ddd file - Verity Documentum?

I work in computer forensics - one of the data sets that I have recently been asked to analyse contains a number of .ddd files that I have so far been unable to open. Reading through these files in a ...
1
vote
1answer
37 views

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
1
vote
1answer
77 views

Information flow in Linux - how to tell who is currently active and typing?

I'm currently playing a mafia/werewolves game with my cyber-security class. The basic idea is: on one machine, the moderator starts a server program all the players ssh into the machine and launch ...
0
votes
1answer
31 views

How to tell if a program or process tried to print or print info

I'm trying to work with third party support on a financial program called Mercury. The program says it has successfully printed a report through its "scheduler", but never physically prints anything. ...
0
votes
1answer
78 views

basic: adding a profile in Volatility

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the ...
0
votes
1answer
94 views

How to check for certain USB disk activities on windows?

I used FTK images to take image of the documents and registry files for a PC. I want to check for certain USB disk , when the last time it was used and when it was unplugged and activities during that ...
0
votes
1answer
81 views

Where can I get name of the person who registered Windows and his organization?

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
0
votes
1answer
143 views

Do the Bitlocker Keys Clear from Physical Memory after Shutdown?

It is claimed that Passware Kit Forensic can recover passwords or keys of drives encrypted by Bitlocker. This needs an image of the encrypted drive plus a so-called Physical Memory image of the target ...
-1
votes
1answer
36 views

Writing directly to the hard drive

Is there any command/program in Linux that allows me to write directly to the hard drive, like memory cleaning programs do when they overwrite unallocated space with zeros? Also, how do you tell ...
3
votes
0answers
365 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
2
votes
0answers
40 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
2
votes
0answers
60 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
2
votes
0answers
198 views

Extracting blocks from a corrupt VDI snapshot in logical order

I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the ...
2
votes
0answers
248 views

How can I know which blocks/sectors were last written to on an NTFS volume?

Is there a tool that would enable me to identify which blocks of data were last (most recently) written to an NTFS volume? Perhaps the NTFS volume's "$Journal" file might have information that can be ...
1
vote
0answers
45 views

How can I convert a domain controller account to local account for forensic analysis?

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
1
vote
0answers
80 views

How can I view an “EA Record” (presumably part of the MFT in NTFS)?

I recently ran into a situation where a failing USB hub caused an external hard drive to not "safely disconnect." In the process of repairing the drive to avoid having Windows see it as a RAW ...
1
vote
0answers
40 views

How to mount a HDD for forensics?

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?
1
vote
0answers
442 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
1
vote
0answers
75 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
0
votes
0answers
21 views

SIFT Workstation v3 Rollback on Ubuntu 14.04

I am a lawyer taking courses in Digital Forensics and also, quite new to Ubuntu (and Linux in general). I installed SIFT Workstation v3 on my Ubuntu 14.04 installation using the bash: wget --quiet ...
0
votes
0answers
50 views

Why is Encase disk image smaller than used space on source HDD?

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No ...
0
votes
0answers
16 views

Editing RAM in real time

Is it possible to edit ram in real time with hexdump or any other program? How? I read here http://linuxpoison.blogspot.pt/2011/04/how-to-read-content-from-ram-random.html that I can see the ...
0
votes
0answers
32 views

Wiping a Hard Disk while leaving a message behind

I wanted to know if there was a method to wipe a hard disk, so that if someone tried to recover data, they would be greeted by a message that the wiper chooses. For instance, in this video the wiper ...
0
votes
0answers
18 views

How do I retrieve a Thunderbird profile's stored passwords - without Thunderbird?

Same question as here: How do I retrieve the stored password from Thunderbird? But I can't run Thunderbird, or can't run it and have it look at the profile directory. I only have read access to that ...
0
votes
0answers
27 views

Software tool to extract original embedded images from PDFs?

Does anyone know a simple (possibly free) extractor for PDFs for Windows? I'd like to extract original images from PDF as they were embedded (preserving image meta info), so I can do some forensics ...
0
votes
0answers
36 views

File Time Stamp Change Detection

I am doing some forensic exercises and am uncertain about detecting timestamp tampering/forgery. The files were created on an SD card on a mobile device(android) so I assume it's a FAT 32 file system. ...
0
votes
0answers
43 views

How to display a fragment of an image file using Scalpel

I am working on a demonstration using Scalpel and its abilities to carve out image files. I took a small thumb drive and filled it with many small sized files until it was full. I then went and ...
0
votes
0answers
71 views

Hard drive not powering

I've got a SATA hard drive attached to a forensic write blocker (Tableau e35u), but the drive will not be recognized. This is because I can't power the write blocker when the drive is attached. The ...
0
votes
0answers
331 views

Where can I find evidence of changes in the amount of RAM installed on a windows machine?

My relative recently had his motherboard replaced at a repair lab. He currently has 2GB RAM installed and if my memory serves me right he had 4GB before the 'repair'. I want to go to the shop with ...
0
votes
0answers
376 views

Recover Files from Verizon LG EnV3 (VX9200) Phone?

I am running into trouble trying to recover files from my Verizon LG EnV3 VX9200 phone. My computer, running Windows 7, will only read the phone as a Windows Portable Device and will not assign the ...
0
votes
0answers
50 views

Why can't my forensics live cd mount windows share

I am having a rather aggravating issue. I want to output Dcfldd to a Windows share on another machine but I cannot mount the share, I have tried on Backtrack and Sans SIFT both in forensics mode and ...