The tag has no wiki summary.

learn more… | top users | synonyms

24
votes
17answers
4k views

How can I physically destroy data from a failed HDD?

I have a broken HDD that contains sensitive data. Since no software can access the disk, I can't wipe it using any of the tools generally suggested. Breaking the disk physically into very small ...
14
votes
1answer
3k views

Where is the serial number of the DVD/CD writer stored on the CD?

I was reading the Wikileaks FAQ (archived here), it says: Many CD and DVD writers will include the serial number of the DVD or CD writer onto the CD/DVDs they write. If the post is ...
11
votes
2answers
3k views

How to find out when a disc (DVD) has been written/burned?

Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it ...
8
votes
3answers
2k views

Police found & returned my stolen laptop reformatted by thief. Can installation logs help locate the thief?

Three weeks ago my laptop was stolen from campus. I immediately reported it to police and on manufacturer's website. A couple of days ago a man called the manufacturer and said he bought a second-hand ...
6
votes
2answers
2k views

Is it possible to confirm CD was burned on a particular machine?

Is it possible to determine whether a CD was burned by a particular CD/DVD burner? Is there any identifier of that burner that is always written to any disc it burns? This is something I'd like to ...
5
votes
1answer
272 views

How to identify which editor was used to make/edit an image?

I saw this the other day This behavior is not uniform.The same does not happen if I use MS Paint or any other editor though. Question: Are there methods to discover which editor was used to ...
5
votes
1answer
715 views

Image forensics software

I'm not really sure if this question belongs here, however I didn't find it fitting well into photography nor stackapps. I'm looking for a software I've seen some long time ago on Discovery channel. ...
3
votes
1answer
297 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
2
votes
2answers
234 views

Windows Application Analyzer

I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including: File System changes Registry changes ...
2
votes
5answers
342 views

Looking for a way to image an entire harddrive to an external usb drive

I have a 100GB NTFS-formatted drive, and a 250GB external USb disk. I am thinking of using a live disk, as is described here, except that I will skip the gzip part. ...
2
votes
0answers
40 views

Extracting blocks from a corrupt VDI snapshot in logical order

I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the ...
2
votes
0answers
188 views

How can I know which blocks/sectors were last written to on an NTFS volume?

Is there a tool that would enable me to identify which blocks of data were last (most recently) written to an NTFS volume? Perhaps the NTFS volume's "$Journal" file might have information that can be ...
1
vote
2answers
148 views

How to find the extension of a file once it has been removed or changed? [duplicate]

Say you are given a file whose extension has been removed or changed (file.tar.gz --> file.blah). This file is decompressed and its contents are used by an application. But you don't have access to ...
1
vote
2answers
2k views

Is there any full disk encryption out there that does not have any forensic traces? Any effective method?

I've been testing quite a number of full disk encryptions but still new in computer forensic stuffs. I'm fully aware of decoy/hidden OS and cold boot attack though. Even Truecrypt and Bestcrypt ...
1
vote
2answers
426 views

Forensics - scan guest OS (WinXP) and files from host OS (Win7 64) using VMWare Player or VirtualBox

I have a Windows XP laptop that was infected with a virus; the virus was removed but network connectivity was jacked up. I boot to Ubuntu from a USB key to move files between the system and the ...
1
vote
1answer
298 views

What is the best way to undelete some photos on Linux? Is there any way to use foremost to only recover files that only contain some text?

I accidentaly deleted some digital photos I had recently taken, and I wanted to undelete them. I found out about Foremost, and it allows me to recover jpg files, but will fo that with all of the ...
1
vote
1answer
175 views

Recovering Images from Formatted HFS+ Hard Drive

Is it possible to recover JPEG images using a low level scan of a hard drive? The hard drive we originally formatted in HFS+ and has since been reformatted. OS X has also been reinstalled.
1
vote
2answers
802 views

hard drive forensics tool for linux

I am looking for an application I used in 2001. It was a curses application that displayed devices or files in hexadecimal format, and allowed searching through them and other functionality. I can't ...
1
vote
1answer
161 views

Find Windows Registry Key Modify Date

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt. Is there any way to pull this information from a mounted windows ...
1
vote
1answer
68 views

Information flow in Linux - how to tell who is currently active and typing?

I'm currently playing a mafia/werewolves game with my cyber-security class. The basic idea is: on one machine, the moderator starts a server program all the players ssh into the machine and launch ...
0
votes
3answers
147 views

What's the best way to copy data without leaving a trace? [closed]

I was wondering if uploading data from system disk onto a file sharing online service, but it seems like the system logs these and they could be traced by the cookies of that website. Is it the same ...
0
votes
1answer
209 views

In Windows, when does a shutdown protect the data?

I have a Windows 7 computer and I am doing some tests: instead of shutting down it properly through the menu shutdown command I switch off the power supply. At the next boot Windows shows the message: ...
0
votes
2answers
499 views

How do I find the sectors that populate a hard drive track?

How do I determine the sectors that are occupying a drive track? I am interested in locating "the last 512 bytes of the first logical drive track" in order to determine if a drive is encrypted with ...
0
votes
2answers
134 views

Where can I find a complete list of all the logs in the system?

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I ...
0
votes
2answers
457 views

Trying to recover a deleted .bash_history file

It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config. I mounted the image as read-only, and found ...
0
votes
1answer
106 views

amr files properties - recording date viewer

I used my old Nokia phone to record some conversations. I copied the files to my computer. Files are in amr format. The problem is I don't remember when did I record those files. Is there a property ...
0
votes
1answer
89 views

How to find if a user has connected another HD via SATA or IDE?

I need to find a registry place that can give me the necessary information to know if someone has connected another (in addition to the current one) HD (SATA or IDE) to the computer. Is there a ...
0
votes
0answers
16 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
0
votes
1answer
19 views

Do the Bitlocker Keys Clear from Physical Memory after Shutdown?

It is claimed that Passware Kit Forensic can recover passwords or keys of drives encrypted by Bitlocker. This needs an image of the encrypted drive plus a so-called Physical Memory image of the target ...
0
votes
0answers
5 views

how to created rule for foremost?

this is file config, I need a rule for recovery files "py" and "js" /etc/foremost.conf CONFIGURATION FILE The configuration file is used to control what types of files ...
0
votes
0answers
23 views

Hard drive not powering

I've got a SATA hard drive attached to a forensic write blocker (Tableau e35u), but the drive will not be recognized. This is because I can't power the write blocker when the drive is attached. The ...
0
votes
0answers
67 views

Where can I find evidence of changes in the amount of RAM installed on a windows machine?

My relative recently had his motherboard replaced at a repair lab. He currently has 2GB RAM installed and if my memory serves me right he had 4GB before the 'repair'. I want to go to the shop with ...
0
votes
0answers
36 views

Modified times of folders

How does the inheritance and propagation of modified times happen? In order to better put my question, I am going to list three examples: A folder has three files. One file gets modified (by any ...
0
votes
0answers
122 views

Recover Files from Verizon LG EnV3 (VX9200) Phone?

I am running into trouble trying to recover files from my Verizon LG EnV3 VX9200 phone. My computer, running Windows 7, will only read the phone as a Windows Portable Device and will not assign the ...
0
votes
2answers
5k views

How to recover unsaved PSD file on MacOSX

Adobe Photoshop creates temporary *.psb files for emergency recovery at this path: ~/Library/Application Support/Adobe/Adobe Photoshop CS6/AutoRecover The files created have names like ...
0
votes
0answers
34 views

Why can't my forensics live cd mount windows share

I am having a rather aggravating issue. I want to output Dcfldd to a Windows share on another machine but I cannot mount the share, I have tried on Backtrack and Sans SIFT both in forensics mode and ...
-2
votes
2answers
871 views

Getting data off a flaky WD external drive

I have a Western Digital 1TB MyBook with some photos that I would like to offload and access. A PC seems to see the drive; a Mac doesn't see it over Firewire or USB. Between Windows 7, Windows XP, ...
-2
votes
1answer
4k views

What does dd conv=sync,noerror do?

So what is the case when adding conv=sync,noerror makes a difference when backing up an entire hard disk onto an image file? Is conv=sync,noerror a requirement when doing forensic stuff? If so, why is ...
-2
votes
2answers
251 views

Is there a Windows utility to delete contents of RAM left by an application? [closed]

Ideally, this utility would know where in physical RAM an application was and completely clear its contents when it's closed. Does anyone know of such a utility?