The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
3answers
16k views

How to recover unsaved PSD file on MacOSX

Adobe Photoshop creates temporary *.psb files for emergency recovery at this path: ~/Library/Application Support/Adobe/Adobe Photoshop CS6/AutoRecover The files created have names like ...
0
votes
2answers
45 views

How can I tell whether I was BCCed to a MIME message?

In a MIME message, if my address is in the TO or CC fields, I know it was addressed to me in one of those ways. But what about BCC? Can I tell - from the copy of the message as I receive it from the ...
3
votes
1answer
319 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
1
vote
1answer
106 views

.ddd file - Verity Documentum?

I work in computer forensics - one of the data sets that I have recently been asked to analyse contains a number of .ddd files that I have so far been unable to open. Reading through these files in a ...
1
vote
1answer
31 views

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
1
vote
1answer
72 views

Information flow in Linux - how to tell who is currently active and typing?

I'm currently playing a mafia/werewolves game with my cyber-security class. The basic idea is: on one machine, the moderator starts a server program all the players ssh into the machine and launch ...
0
votes
1answer
43 views

Where can I get name of the person who registered Windows and his organization?

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
0
votes
1answer
3k views

How to Recover Google Chrome User Settings

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting ...
0
votes
1answer
66 views

Do the Bitlocker Keys Clear from Physical Memory after Shutdown?

It is claimed that Passware Kit Forensic can recover passwords or keys of drives encrypted by Bitlocker. This needs an image of the encrypted drive plus a so-called Physical Memory image of the target ...
2
votes
0answers
91 views

Extracting blocks from a corrupt VDI snapshot in logical order

I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the ...
2
votes
0answers
210 views

How can I know which blocks/sectors were last written to on an NTFS volume?

Is there a tool that would enable me to identify which blocks of data were last (most recently) written to an NTFS volume? Perhaps the NTFS volume's "$Journal" file might have information that can be ...
1
vote
0answers
149 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
1
vote
0answers
56 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
0
votes
0answers
62 views

Finding Windows rootkits from a Linux live DVD

I'm looking to set up a procedure for ferreting out possible Windows rootkit infestations from a Linux live DVD. Especially preferable are steps I can automate by shell script. I already know you can ...
0
votes
0answers
39 views

how to created rule for foremost?

this is file config, I need a rule for recovery files "py" and "js" /etc/foremost.conf CONFIGURATION FILE The configuration file is used to control what types of files ...
0
votes
0answers
39 views

Hard drive not powering

I've got a SATA hard drive attached to a forensic write blocker (Tableau e35u), but the drive will not be recognized. This is because I can't power the write blocker when the drive is attached. The ...
0
votes
0answers
99 views

Where can I find evidence of changes in the amount of RAM installed on a windows machine?

My relative recently had his motherboard replaced at a repair lab. He currently has 2GB RAM installed and if my memory serves me right he had 4GB before the 'repair'. I want to go to the shop with ...
0
votes
0answers
220 views

Recover Files from Verizon LG EnV3 (VX9200) Phone?

I am running into trouble trying to recover files from my Verizon LG EnV3 VX9200 phone. My computer, running Windows 7, will only read the phone as a Windows Portable Device and will not assign the ...
0
votes
0answers
43 views

Why can't my forensics live cd mount windows share

I am having a rather aggravating issue. I want to output Dcfldd to a Windows share on another machine but I cannot mount the share, I have tried on Backtrack and Sans SIFT both in forensics mode and ...