The tag has no usage guidance.

learn more… | top users | synonyms

27
votes
17answers
8k views

How can I physically destroy data from a failed HDD?

I have a broken HDD that contains sensitive data. Since no software can access the disk, I can't wipe it using any of the tools generally suggested. Breaking the disk physically into very small ...
14
votes
1answer
5k views

Where is the serial number of the DVD/CD writer stored on the CD?

I was reading the Wikileaks FAQ (archived here), it says: Many CD and DVD writers will include the serial number of the DVD or CD writer onto the CD/DVDs they write. If the post is ...
11
votes
2answers
10k views

How to find out when a disc (DVD) has been written/burned?

Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it ...
8
votes
2answers
1k views

Find the service creation date in Windows?

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the ...
8
votes
3answers
4k views

Police found & returned my stolen laptop reformatted by thief. Can installation logs help locate the thief?

Three weeks ago my laptop was stolen from campus. I immediately reported it to police and on manufacturer's website. A couple of days ago a man called the manufacturer and said he bought a second-hand ...
7
votes
1answer
8k views

dd_rescue vs dcfldd vs dd

What are the main differences between dd_rescue, dcfldd, and dd? In what situations would you use one over the other? Why are there three different yet simliar programs?
6
votes
1answer
25k views

What does dd conv=sync,noerror do?

So what is the case when adding conv=sync,noerror makes a difference when backing up an entire hard disk onto an image file? Is conv=sync,noerror a requirement when doing forensic stuff? If so, why is ...
6
votes
2answers
2k views

Is it possible to confirm CD was burned on a particular machine?

Is it possible to determine whether a CD was burned by a particular CD/DVD burner? Is there any identifier of that burner that is always written to any disc it burns? This is something I'd like to ...
5
votes
1answer
436 views

How to identify which editor was used to make/edit an image?

I saw this the other day This behavior is not uniform.The same does not happen if I use MS Paint or any other editor though. Question: Are there methods to discover which editor was used to ...
3
votes
1answer
318 views

What is this character-set corruption? (ISO-2022?)

I have a text file from a legacy source which contains corrupted characters. At first I thought the corruption was just gobbledygook, but it appears upon closer examination that some of the corrupted ...
3
votes
0answers
366 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
2
votes
2answers
515 views

Windows Application Analyzer

I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including: File System changes Registry changes ...
2
votes
5answers
354 views

Looking for a way to image an entire harddrive to an external usb drive

I have a 100GB NTFS-formatted drive, and a 250GB external USb disk. I am thinking of using a live disk, as is described here, except that I will skip the gzip part. ...
2
votes
1answer
305 views

Location of Event logs in Windows

I have found that Windows logs every event such as system login/out, USB connection's history, etc. This all can be viewed in Event viewer. But my question is Where on the filesystem are the event ...
2
votes
1answer
29k views

How to Recover Google Chrome User Settings

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting ...
2
votes
2answers
2k views

Read (repair) data from broken floppy disc on a linux system

How can i read an old floppy disk under Linux that has some problematic sectors? In times of DOS people used magic tools like Norton Disk Doctor and others. Some of these tools read the broken part ...
2
votes
2answers
99 views

File Recovery No Signatures(Magic Numbers)

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
2
votes
0answers
41 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
2
votes
0answers
60 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
2
votes
0answers
198 views

Extracting blocks from a corrupt VDI snapshot in logical order

I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the ...
2
votes
0answers
249 views

How can I know which blocks/sectors were last written to on an NTFS volume?

Is there a tool that would enable me to identify which blocks of data were last (most recently) written to an NTFS volume? Perhaps the NTFS volume's "$Journal" file might have information that can be ...
1
vote
3answers
534 views

Can you reuse a SSD after applying a Zero-Fill software?

I am returning my laptop to the retailer but I have had it for 1 month, In this time I have stored some confidential information, Because of this I am planning to zero fill my SSD using ...
1
vote
2answers
199 views

How to find the extension of a file once it has been removed or changed? [duplicate]

Say you are given a file whose extension has been removed or changed (file.tar.gz --> file.blah). This file is decompressed and its contents are used by an application. But you don't have access to ...
1
vote
2answers
2k views

Is there any full disk encryption out there that does not have any forensic traces? Any effective method?

I've been testing quite a number of full disk encryptions but still new in computer forensic stuffs. I'm fully aware of decoy/hidden OS and cold boot attack though. Even Truecrypt and Bestcrypt ...
1
vote
1answer
170 views

strace to discover sudo password persistence location

strace/dtrace/ltrace ... useful for lots of things, from finding hidden access violations to network socket tracing, but maybe it can't see all. I haven't been able to figure out using strace (it ...
1
vote
1answer
80 views

Forensic DVD-R data

Forensically speaking, is there a way to read metadata, user profile, computer, or burning info on a DVD-R? I need to discover more about who made an illegal copy of a movie... Is this something ...
1
vote
2answers
696 views

Forensics - scan guest OS (WinXP) and files from host OS (Win7 64) using VMWare Player or VirtualBox

I have a Windows XP laptop that was infected with a virus; the virus was removed but network connectivity was jacked up. I boot to Ubuntu from a USB key to move files between the system and the ...
1
vote
1answer
358 views

What is the best way to undelete some photos on Linux? Is there any way to use foremost to only recover files that only contain some text?

I accidentaly deleted some digital photos I had recently taken, and I wanted to undelete them. I found out about Foremost, and it allows me to recover jpg files, but will fo that with all of the ...
1
vote
1answer
194 views

Raw reading USB mass storage or SCSI

Wife's USB HDD has a slight issue where a folder refuses to open (NTFS filesystem). I have been able to image the drive with Linux but for one sector (sectors are 4096 bytes). Reading that sector ...
1
vote
1answer
3k views

Find Windows Registry Key Modify Date

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt. Is there any way to pull this information from a mounted windows ...
1
vote
1answer
188 views

Recovering Images from Formatted HFS+ Hard Drive

Is it possible to recover JPEG images using a low level scan of a hard drive? The hard drive we originally formatted in HFS+ and has since been reformatted. OS X has also been reinstalled.
1
vote
2answers
865 views

hard drive forensics tool for linux

I am looking for an application I used in 2001. It was a curses application that displayed devices or files in hexadecimal format, and allowed searching through them and other functionality. I can't ...
1
vote
0answers
46 views

How can I convert a domain controller account to local account for forensic analysis?

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
1
vote
0answers
80 views

How can I view an “EA Record” (presumably part of the MFT in NTFS)?

I recently ran into a situation where a failing USB hub caused an external hard drive to not "safely disconnect." In the process of repairing the drive to avoid having Windows see it as a RAW ...
1
vote
2answers
203 views

NTFS MAC Times in Hexadecimal

I am using EnCase and a Hex Editor to analyse a virtual drive. EnCase says that the this hexadecimal: 5FBF60C54F2CCF01 is the date/time (mm/dd/yy): 02/17/14 09:18:54 (PM) I have worked out ...
1
vote
0answers
40 views

How to mount a HDD for forensics?

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?
1
vote
1answer
197 views

.ddd file - Verity Documentum?

I work in computer forensics - one of the data sets that I have recently been asked to analyse contains a number of .ddd files that I have so far been unable to open. Reading through these files in a ...
1
vote
1answer
37 views

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
1
vote
0answers
446 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
1
vote
0answers
75 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
1
vote
1answer
77 views

Information flow in Linux - how to tell who is currently active and typing?

I'm currently playing a mafia/werewolves game with my cyber-security class. The basic idea is: on one machine, the moderator starts a server program all the players ssh into the machine and launch ...
0
votes
2answers
3k views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...
0
votes
3answers
6k views

What's the best way to copy data without leaving a trace? [closed]

I was wondering if uploading data from system disk onto a file sharing online service, but it seems like the system logs these and they could be traced by the cookies of that website. Is it the same ...
0
votes
1answer
670 views

In Windows, when does a shutdown protect the data?

I have a Windows 7 computer and I am doing some tests: instead of shutting down it properly through the menu shutdown command I switch off the power supply. At the next boot Windows shows the message: ...
0
votes
2answers
834 views

How do I find the sectors that populate a hard drive track?

How do I determine the sectors that are occupying a drive track? I am interested in locating "the last 512 bytes of the first logical drive track" in order to determine if a drive is encrypted with ...
0
votes
2answers
143 views

Where can I find a complete list of all the logs in the system?

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I ...
0
votes
1answer
414 views

How do I erase a Samsung Magician encrypted solid-state drive (SSD)?

I need to securely wipe a Samsung 840 solid-state drive (SSD) of a co-worker that's leaving the company. My colleague ran into a problem he can't find the answer to. The drive is encrypted with ...
0
votes
2answers
75 views

Retain information by an IP address [closed]

What information can I get only by having an IP address ? For example: Computer name, domain name, dns servers (if it's a server) etc. Thank you.
0
votes
1answer
165 views

Is SSD safer than hard drive in terms of data not been stolen?

With hard drives, even after you delete its content permanently (not just moving it into trash), there is a specific magnetic techinique that can be used to recover data. From the point of view of ...
0
votes
2answers
2k views

Trying to recover a deleted .bash_history file

It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config. I mounted the image as read-only, and found ...