Questions tagged [forensics]
Forensics is about examining digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information. Forensics is not the same as [data recovery] although recovery of data can part of the forensic process.
132
questions
3
votes
1
answer
461
views
How to restore damaged (mp3?) file
I have been given a file at https://drive.google.com/file/d/10Fqr6Ipu2J8yKU_m3-EMzsVj7XeSYEdV/view?usp=sharing. Opening it from https://hexed.it/ shows that it is likely a mp3 file (based on the ID3 ...
- 33
14
votes
1
answer
2k
views
Do Blu-ray drives have an RID?
CDs and DVDs have a unique number identifying the drive that writes them named a RID (Recorder IDentification).
Does a Blu-ray, a newer form of optic-media, also have an RID?
This is a follow up to ...
- 9,158
1
vote
1
answer
492
views
How to find last user added in Linux?
We had an attack on some of our Linux servers and we need to find if new users where added to the OS, I checked /etc/passwd and it doesn't seem to be something strange, but it doesn't show when each ...
- 274
0
votes
1
answer
459
views
How to obtain a lost version of an edited notepad [.txt] file on a Windows 10 hard drive using a SATA SSD to USB dongle
About 1 year ago I had saved some code on a notepad text file (.txt) I was building using a Windows 10 computer. However, I deleted a portion of the code and saved the text file with a new c++ code ...
LilWhiteHatHacker
0
votes
0
answers
519
views
How to install The Sleuth Kit if "configure" file is missing?
I tried installing from source on macOS. The repo does not have a configure file, so I cannot run
$ ./configure
as mentioned in the installation instructions.
The repo has a configure.ac, so ...
- 2,039
0
votes
1
answer
494
views
How can i dump the contents of a file that was opened with nano in a running process? (Linux)
I have run the command ps -ef and found the following :
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 12:30 ? 00:00:00 socat tcp-l:1024,reuseaddr,f
root ...
0
votes
1
answer
111
views
What happens to the free space of HDD2 if dd is used to write the smaller device HDD1, to HDD2?
What happens to the space left on sdb in this case? I assume dd will write the data at the beginning, replace the partition table, and the free space will be untouched (not usable).
sda = 10 GB
sdb = ...
10
votes
4
answers
5k
views
Recover a file after shred command
Let's say I have some sensitive files in my computer and I want to completely delete them so that no one can ever retrieve them.
For that, I can use the rm command, but it's still easily recoverable. ...
- 121
0
votes
2
answers
339
views
Does Bitlocker securely erase the blocks where the first and last partition will go?
I have a question regarding bitlocker. Suppose I have any operating system installed on an unencrypted disk (windows for example) and I have confidential data on it. Then, someone formats the disk and ...
- 413
0
votes
0
answers
69
views
Recovery of deleted data from a modern disk
I have the opposite problem of this question's OP: What can be recovered? Securely deleted files
I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then ...
vallum
2
votes
1
answer
2k
views
Data recovery on partition encrypted with Veracrypt - Input/Output error - Possible disk failure
I am trying to recover some data from my backup drive which is encrypted with Veracrypt as I recently encountered input/output error messages when I attempted to copy some of the files from it. This ...
2
votes
0
answers
3k
views
Winlogon Event ID 811/812 event tags
In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
- 21
0
votes
1
answer
2k
views
Can you tell if a document has had its metadata altered?
I'm dealing with a situation in which the other party has fabricated logs. These logs are presumably in docx or doc formats.
A large part of the issue is that the logs are not contemporaneous - they ...
0
votes
1
answer
542
views
Is there a way to demonstrate a message has been edited using Outlook's "Edit Message" (or its subject)?
Is there any way (complicated or no) to demonstrate that an Outlook message has been edited using the 'Edit Message' function, or that the subject was edited on its own?
For purposes of this answer, I ...
0
votes
0
answers
2k
views
How to identify hidden processes with volatility using psxview?
I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes.
The assignment was,
It's fairly common for malware to attempt to hide itself and the
process ...
- 47
0
votes
1
answer
842
views
Windows Event Viewer: can't find user-started programs
My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
1
vote
1
answer
62
views
How to donate a computer without jeopardizing personal information?
I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user1270193
2
votes
0
answers
12
views
What can make unmounted volumes SHA512 hashes differ while mounted volumes content SHA512 hashes are identical?
I am trying to configure Raspberry Pi OS to be read-only.
In theory, both / and /boot are read-only. That being said, I am experiencing a strange discrepancy and can’t figure out what is happening.
I ...
- 1,010
-3
votes
1
answer
5k
views
How to navigate to recycle bin through system level powershell
I'm having difficulty navegating to the recycle bin on windows 10 machines through powershell.
I'm able to get &Recycle.Bin listed by using the force option on ls, but I can't change my directory ...
1
vote
1
answer
88
views
Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them? [duplicate]
I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user1270193
5
votes
3
answers
3k
views
How can I access the Windows search database in order to learn about files on a broken hard drive?
I have a Windows 10 PC and one of my hard discs broke completely (as in not recognized by the BIOS, makes funny noises and cannot be used). It was not the system disc but contained mostly private data....
0
votes
0
answers
40
views
Recover formatted HDD while mounting the drive
I had Windows Server installed on a SSD and a 1TB HDD with all the photos and files.
I decided to use Ubuntu Server instead and i installed it in my SSD.
Once installed I looked for my 1TB HDD but I ...
- 101
2
votes
4
answers
4k
views
How does writing zeroes to a drive remove data from it?
I know a fair bit about the process of securely wiping drives, including that one wipe is usually sufficient and that no-one has yet (publicly) been able to recover a bit of data from one pass of ...
- 13.2k
1
vote
1
answer
163
views
How to dump Verity .ddd file to a text file?
I found this very helpful information about Verity database structure .ddd file - Verity Documentum?
Now I want to migrate an old Verity database to a new application, therefore I'd like to dump ...
- 21
0
votes
0
answers
68
views
MS Word Metadata
This semester my CS 1501 final was replaced with a take-home exam in the form of a word document to be edited and uploaded by the due date. Something went wrong on my end where the file did not upload,...
1
vote
1
answer
855
views
Does AWS support the TRIM command for EBS volumes that are SSD-backed?
I've gone over Amazon's documentation and it seems that the TRIM command is only implemented for some instance types that have internal SSDs (specifically, the C5d, G4, I3, I3en, F1, M5ad, M5d, p3dn....
- 3,441
0
votes
2
answers
17k
views
Find hostname of an Windows image
How to find a hostname of a windows image? I've read about looking at the regback files, but also using C:/Windows/Debug/NetSetup.LOG
When navigating to C:/Windows/Debug/NetSetup.LOG it shows several ...
- 105
3
votes
1
answer
8k
views
How to convert dd partition image to virtualbox virtual disk?
I created a backup from /dev/sda1 and /dev/sda4 partitions using dd. but i did not create a backup from /dev/sda2 and /dev/sda3. How can I convert these 2 backup files from /dev/sda1 and /dev/sda4 ...
- 162
1
vote
1
answer
348
views
Recovering a JPEG image with broken sections
Some files were corrupted while being recovered from a disk drive, including portions of videos and images. They all seem to share the trait of having sections of data replaced with repeating bytes (...
- 148
0
votes
0
answers
2k
views
Mount Android 10 dd image of /sda internal memory
Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (...
- 101
4
votes
3
answers
3k
views
Delete 0x00 bytes at the end of files
I have rescued some files (Python, Shell scripts etc., so just text files) from a Linux SD card using FTK Imager Lite. The files are ok, but they now contain a lot of 0x00 bytes at the end.
How could ...
- 6,195
-1
votes
1
answer
771
views
How do I tell if a CD disc was burned 3 days ago or 3 months ago by physical inspection? [duplicate]
Is there a way to tell when a disk has been burned by inspecting the disc for its physical features?
- 7
0
votes
1
answer
457
views
Windows System and DNS Client - constant querries for unknown local host
I noticed today that there was significant traffic on all my connected network interfaces (loopback, 2 VMWare network adapters, ethernet and wifi).
Wireshark home page showing traffic graphs. The ...
- 3
0
votes
0
answers
899
views
Rekall Tool : SSL Error - Certificate_verify_failed (_ssl.c:1076)
I have a problem with SSL certificate. I would like to explain my problem.
I'm trying to install Rekall tool and it's memory forensic framework. I installed Python 3.7 then I created new virtualenv ...
- 1
0
votes
1
answer
705
views
Does the filesystem windows is installed on have an effect on the time zone settings of timestamps within windows registry hives?
This question does not refer to the filesystem timestamps of the registry files themself.
As far as I know timestamps within the Windows Registry are stored as UTC timestamps when Windows is ...
- 59
1
vote
1
answer
132
views
Determine what file a local leafpad instance has open
I'm running a leafpad text editor instance on a certain computer, which has a certain file open, whose name and location I have forgotten (it's actually more complicated but this is a simplified ...
- 9,974
0
votes
0
answers
661
views
Compare two whole HDD's contents, sector-level
While analysing two 4TB HDDs, which were in some kind of RAID 1 configuration, and thus have the same contents in terms of files / folders (they have been reformatted but R-Studio lists the same file ...
- 875
1
vote
1
answer
267
views
Where i can find CCleaner InstallDate? (forensics)
I have tried in
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
without finding anything
any suggestions?
- 11
0
votes
1
answer
2k
views
Created date timestamp of the C:\Windows\ folder is older than the "original install date" of the Windows 7 OS, why?
Created date of my C:\Windows\ folder in a Windows 7 machine is "14 July 2009, 08:07:05", however, the "original install date" obtained from the "systeminfo" command in cmd is "27-6-2013, 11.33....
- 33
2
votes
1
answer
375
views
Which system file stores the information displayed by the "net user Administrator" command in Windows 7?
Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine.
Details of the command is ...
- 33
0
votes
1
answer
206
views
What does foremost do that is different from mount?
I was doing a challenge on picoCTF which involved getting a flag from a .dd file. The .dd file initially appears to be a FAT partition that contains some jpg files.
My idea was to mount the file ...
- 101
0
votes
0
answers
438
views
Fdisk doesn't recognize Macbook's file system
I need to mirror a MacBook, which was functioning properly. But when I ran fdisk -l, I got this:
Disk /dev/sda: 113 GiB, 121332826112 bytes, 236978176 sectors
Units: sectors of 1 * 512 = 512 bytes
...
2
votes
1
answer
469
views
How to import "RECYCLER" folders into Windows?
question:
If I connect a HDD to my PC, how can I import the RECYCLER folder into Windows XP?
In other words: How can I tell Windows XP to include the content of D:\RECYCLER\ in the recycle bin?
case ...
- 328
0
votes
1
answer
236
views
'nosuid,nodev,nofail,noauto' equivalent in Windows?
So I'm doing forensic tool validation with multiple tools and operating systems. I have started on Linux using dd and the other two tools I need to use are FTK Imager and ProDiscover; both windows ...
1
vote
0
answers
943
views
Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/
There are two great articles about how to aquire memory on Linux using linpmem:
SANS
holdmybeersecurity
Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
- 391
10
votes
1
answer
18k
views
How to mount an LVM volume from a dd/raw/vmdk image?
Input: RAW/DD Image of an HDD. fdisk -l shows partitions
fdisk -l image.dd
Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/...
- 391
3
votes
1
answer
2k
views
Find string packet in decrypted data with wireshark/tshark
I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame.
The point is that if ...
- 41
0
votes
0
answers
406
views
Broken external USB hard drive undetected by system
I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
- 1
2
votes
0
answers
2k
views
How to dump memory of virtual machine running in linux?
I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
- 47
0
votes
4
answers
11k
views
How to find the install date of Windows operating system without the Registry or command prompt?
I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system ...
- 157