Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
13 views

Windows Event Viewer: can't find user-started programs

My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
0
votes
0answers
41 views

How to monitor a (remote) PC without logging on to it

I have a Windows 10 PC that may be infected with malware, possibly with a Trojan. Various scans with antivirus programs and extensive analysis have not yet delivered a conclusive result. I have pulled ...
0
votes
0answers
49 views

how to recover a laptop which has been formatted and a new windows is installed on it? [duplicate]

My mistakenly without getting a backup installed a new windows on it and actually I have formatted the disk during windows installation as well, is there a live bootable tool to recover my files in my ...
1
vote
1answer
49 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
2
votes
0answers
5 views

What can make unmounted volumes SHA512 hashes differ while mounted volumes content SHA512 hashes are identical?

I am trying to configure Raspberry Pi OS to be read-only. In theory, both / and /boot are read-only. That being said, I am experiencing a strange discrepancy and can’t figure out what is happening. I ...
-3
votes
1answer
31 views

How to navigate to recycle bin through system level powershell

I'm having difficulty navegating to the recycle bin on windows 10 machines through powershell. I'm able to get &Recycle.Bin listed by using the force option on ls, but I can't change my directory ...
1
vote
1answer
38 views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them? [duplicate]

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
3
votes
3answers
366 views

How can I access the Windows search database in order to learn about files on a broken hard drive?

I have a Windows 10 PC and one of my hard discs broke completely (as in not recognized by the BIOS, makes funny noises and cannot be used). It was not the system disc but contained mostly private data....
0
votes
0answers
24 views

Recover formatted HDD while mounting the drive

I had Windows Server installed on a SSD and a 1TB HDD with all the photos and files. I decided to use Ubuntu Server instead and i installed it in my SSD. Once installed I looked for my 1TB HDD but I ...
0
votes
4answers
246 views

How does writing zeroes to a drive remove data from it?

I know a fair bit about the process of securely wiping drives, including that one wipe is usually sufficient and that no-one has yet (publicly) been able to recover a bit of data from one pass of ...
1
vote
1answer
42 views

How to dump Verity .ddd file to a text file?

I found this very helpful information about Verity database structure .ddd file - Verity Documentum? Now I want to migrate an old Verity database to a new application, therefore I'd like to dump ...
0
votes
0answers
30 views

MS Word Metadata

This semester my CS 1501 final was replaced with a take-home exam in the form of a word document to be edited and uploaded by the due date. Something went wrong on my end where the file did not upload,...
0
votes
0answers
200 views

Does AWS support the TRIM command for EBS volumes that are SSD-backed?

I've gone over Amazon's documentation and it seems that the TRIM command is only implemented for some instance types that have internal SSDs (specifically, the C5d, G4, I3, I3en, F1, M5ad, M5d, p3dn....
0
votes
2answers
1k views

Find hostname of an Windows image

How to find a hostname of a windows image? I've read about looking at the regback files, but also using C:/Windows/Debug/NetSetup.LOG When navigating to C:/Windows/Debug/NetSetup.LOG it shows several ...
1
vote
1answer
2k views

How to convert dd partition image to virtualbox virtual disk?

I created a backup from /dev/sda1 and /dev/sda4 partitions using dd. but i did not create a backup from /dev/sda2 and /dev/sda3. How can I convert these 2 backup files from /dev/sda1 and /dev/sda4 ...
1
vote
1answer
68 views

Recovering a JPEG image with broken sections

Some files were corrupted while being recovered from a disk drive, including portions of videos and images. They all seem to share the trait of having sections of data replaced with repeating bytes (...
0
votes
0answers
740 views

Mount Android 10 dd image of /sda internal memory

Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (...
4
votes
3answers
2k views

Delete 0x00 bytes at the end of files

I have rescued some files (Python, Shell scripts etc., so just text files) from a Linux SD card using FTK Imager Lite. The files are ok, but they now contain a lot of 0x00 bytes at the end. How could ...
-1
votes
1answer
71 views

How do I tell if a CD disc was burned 3 days ago or 3 months ago by physical inspection? [duplicate]

Is there a way to tell when a disk has been burned by inspecting the disc for its physical features?
0
votes
1answer
101 views

Windows System and DNS Client - constant querries for unknown local host

I noticed today that there was significant traffic on all my connected network interfaces (loopback, 2 VMWare network adapters, ethernet and wifi). Wireshark home page showing traffic graphs. The ...
0
votes
0answers
823 views

Rekall Tool : SSL Error - Certificate_verify_failed (_ssl.c:1076)

I have a problem with SSL certificate. I would like to explain my problem. I'm trying to install Rekall tool and it's memory forensic framework. I installed Python 3.7 then I created new virtualenv ...
0
votes
1answer
87 views

Does the filesystem windows is installed on have an effect on the time zone settings of timestamps within windows registry hives?

This question does not refer to the filesystem timestamps of the registry files themself. As far as I know timestamps within the Windows Registry are stored as UTC timestamps when Windows is ...
1
vote
1answer
61 views

Determine what file a local leafpad instance has open

I'm running a leafpad text editor instance on a certain computer, which has a certain file open, whose name and location I have forgotten (it's actually more complicated but this is a simplified ...
0
votes
0answers
237 views

Compare two whole HDD's contents, sector-level

While analysing two 4TB HDDs, which were in some kind of RAID 1 configuration, and thus have the same contents in terms of files / folders (they have been reformatted but R-Studio lists the same file ...
1
vote
1answer
109 views

Where i can find CCleaner InstallDate? (forensics)

I have tried in HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall without finding anything any suggestions?
0
votes
1answer
700 views

Created date timestamp of the C:\Windows\ folder is older than the "original install date" of the Windows 7 OS, why?

Created date of my C:\Windows\ folder in a Windows 7 machine is "‎14 ‎July ‎2009, ‏‎08:07:05", however, the "original install date" obtained from the "systeminfo" command in cmd is "27-6-2013, 11.33....
2
votes
1answer
120 views

Which system file stores the information displayed by the "net user Administrator" command in Windows 7?

Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine. Details of the command is ...
0
votes
1answer
57 views

What does foremost do that is different from mount?

I was doing a challenge on picoCTF which involved getting a flag from a .dd file. The .dd file initially appears to be a FAT partition that contains some jpg files. My idea was to mount the file ...
0
votes
0answers
153 views

Fdisk doesn't recognize Macbook's file system

I need to mirror a MacBook, which was functioning properly. But when I ran fdisk -l, I got this: Disk /dev/sda: 113 GiB, 121332826112 bytes, 236978176 sectors Units: sectors of 1 * 512 = 512 bytes ...
1
vote
1answer
113 views

How to import "RECYCLER" folders into Windows?

question: If I connect a HDD to my PC, how can I import the RECYCLER folder into Windows XP? In other words: How can I tell Windows XP to include the content of D:\RECYCLER\ in the recycle bin? case ...
0
votes
1answer
121 views

'nosuid,nodev,nofail,noauto' equivalent in Windows?

So I'm doing forensic tool validation with multiple tools and operating systems. I have started on Linux using dd and the other two tools I need to use are FTK Imager and ProDiscover; both windows ...
1
vote
0answers
605 views

Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

There are two great articles about how to aquire memory on Linux using linpmem: SANS holdmybeersecurity Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
5
votes
1answer
7k views

How to mount an LVM volume from a dd/raw/vmdk image?

Input: RAW/DD Image of an HDD. fdisk -l shows partitions fdisk -l image.dd Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/...
2
votes
1answer
1k views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
0
votes
0answers
276 views

Broken external USB hard drive undetected by system

I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
2
votes
0answers
992 views

How to dump memory of virtual machine running in linux?

I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
0
votes
4answers
7k views

How to find the install date of Windows operating system without the Registry or command prompt?

I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system ...
1
vote
1answer
1k views

Is it possible to get timestamp when is HDD formated?

I have wondering is it possible to determine when is HDD formated? It was formated with GParted from live linux. Previously, Windows was installed and filesystem was NTFS. Thanks
3
votes
4answers
5k views

How to identify a file type without extension in Windows?

I have a large file of 92.5GB with no file extension inside the C:// partition called “Free Space” and another sibling one of 260KB I wonder if I can identify this file extension or maybe its origin ...
3
votes
3answers
5k views

How is it possible to make a bit by bit copy of a hard drive while using it?

I learned in forensics you can deploy an agent to a remote computer and have it retrieve an exact copy of the remote hard drive, including unallocated space and swap, even while it is being used. This ...
0
votes
1answer
7k views

Convert hexdump to tar file

I have a hex dump as 1f8b 0800 3416 1259 0003 edcf 310e c230 0c85 61cf 9c22 1708 b2d3 909e a7a2 5d90 1028 7581 e353 d401 2660 a910 d2ff 2d6f f01b 9ec7 615f 07df facd 6535 3a2b 253f d2da 9dbe e622 ...
0
votes
0answers
43 views

Can Windows 10 Event Logs be used to determine which programs were installed on a machine and when?

I found an answer for the package manager logs Debian which can show you when and in what order packages have been installed or updated from Bash. Is there any sort of equivalent to this in Windows ...
3
votes
1answer
2k views

hdparm: what does --dco-restore really do?

I am following instructions on this other SuperUser post: Harddrive - wipe out "hidden areas" like HPA and DCO also after malware infection For the last few days I have been researching ...
0
votes
1answer
62 views

How do I tell if my laptop has been messed around with?

I just have my laptop to h local service people, but the thing is, I live in a bad neighborhood. I took a backup before giving it. But how will I be able to tell if they switched out any parts with ...
0
votes
3answers
960 views

Linux server just as RAMdisk

I want to setup an anti-forensic Linux server to protect my users. My aim is to have the Linux distro and everything inside of it running from RAM, never storing anything permanently. It is possible ...
0
votes
0answers
177 views

Avoid undeleting corrupted/partially overwritten files

Recently I dealt with some computers infected by ransomware, with encrypted user files. My job was to either decrypt these files (if possible), or recover as much usable files as possible. That ...
0
votes
1answer
135 views

How to tell if a program or process tried to print or print info

I'm trying to work with third party support on a financial program called Mercury. The program says it has successfully printed a report through its "scheduler", but never physically prints anything. ...
0
votes
0answers
617 views

SIFT Workstation v3 Rollback on Ubuntu 14.04

I am a lawyer taking courses in Digital Forensics and also, quite new to Ubuntu (and Linux in general). I installed SIFT Workstation v3 on my Ubuntu 14.04 installation using the bash: wget --quiet -...
0
votes
0answers
441 views

Why is Encase disk image smaller than used space on source HDD?

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No ...
1
vote
0answers
67 views

Editing RAM in real time

Is it possible to edit ram in real time with hexdump or any other program? How? I read here http://linuxpoison.blogspot.pt/2011/04/how-to-read-content-from-ram-random.html that I can see the ...