Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [forensics]

The tag has no usage guidance.

0
votes
0answers
28 views

Folder created automatically on newly bought USB stick

I have bought a brand new USB Stick of the same type I often buy (Intenso Slim Line). Usually these USB sticks are empty, so it's not pre-loaded with software or something. However, this time, when I ...
1
vote
0answers
38 views

Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

There are two great articles about how to aquire memory on Linux using linpmem: SANS holdmybeersecurity Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
3
votes
1answer
121 views

How to mount an LVM volume from a dd/raw/vmdk image?

Input: RAW/DD Image of an HDD. fdisk -l shows partitions sudo fdisk -l image.dd Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/...
0
votes
1answer
118 views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
0
votes
0answers
84 views

Broken external USB hard drive undetected by system

I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
2
votes
0answers
264 views

How to dump memory of virtual machine running in linux?

I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
0
votes
3answers
1k views

How to find the install date of Windows operating system without the Registry or command prompt?

I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system ...
0
votes
0answers
101 views

How does FAT32 allow locating deleted files without needing to scan?

In data recovery tools such as IsBuster, there is a list of deleted files on FAT file systems, which shows up instantly without any need for scan, even older file/directory names after renaming and ...
1
vote
1answer
186 views

Is it possible to get timestamp when is HDD formated?

I have wondering is it possible to determine when is HDD formated? It was formated with GParted from live linux. Previously, Windows was installed and filesystem was NTFS. Thanks
0
votes
0answers
341 views

Clipboard history or cache recoverable ? Forensic access

I have a situation where a very sensitive piece of data was copied and pasted from a webpage to another webpage. A few other things were then copy/pasted and then the computer was left idle. I am ...
0
votes
0answers
785 views

Where can I find a list of installed programs on a Windows 7 system, as well as their installation dates?

I am carrying out a Forensic Investigation on a hard drive image of Windows 7 system. So far I've gone through the Windows Registry and found these keys: F:\[root]\Windows\System32\config\SOFTWARE: ...
3
votes
4answers
1k views

How to identify a file type without extension in Windows?

I have a large file of 92.5GB with no file extension inside the C:// partition called “Free Space” and another sibling one of 260KB I wonder if I can identify this file extension or maybe its origin ...
3
votes
3answers
750 views

How is it possible to make a bit by bit copy of a hard drive while using it?

I learned in forensics you can deploy an agent to a remote computer and have it retrieve an exact copy of the remote hard drive, including unallocated space and swap, even while it is being used. This ...
-1
votes
1answer
2k views

Convert hexdump to tar file

I have a hex dump as 1f8b 0800 3416 1259 0003 edcf 310e c230 0c85 61cf 9c22 1708 b2d3 909e a7a2 5d90 1028 7581 e353 d401 2660 a910 d2ff 2d6f f01b 9ec7 615f 07df facd 6535 3a2b 253f d2da 9dbe e622 ...
0
votes
0answers
36 views

Can Windows 10 Event Logs be used to determine which programs were installed on a machine and when?

I found an answer for the package manager logs Debian which can show you when and in what order packages have been installed or updated from Bash. Is there any sort of equivalent to this in Windows ...
0
votes
0answers
86 views

Possibility of recovering previous data after format and reinstalling os (windows7)?

I am asking for some piece of advice on possibility of recovering the previous data after several formats & os installations because there was some important data I needed to keep but forgot to ...
2
votes
0answers
571 views

hdparm: what does --dco-restore really do?

I am following instructions at: Harddrive - wipe out "hidden areas" like HPA and DCO also after malware infection For the last few days I have been researching hidden areas of a HDD and ...
0
votes
1answer
57 views

How do I tell if my laptop has been messed around with?

I just have my laptop to h local service people, but the thing is, I live in a bad neighborhood. I took a backup before giving it. But how will I be able to tell if they switched out any parts with ...
0
votes
3answers
477 views

Linux server just as RAMdisk

I want to setup an anti-forensic Linux server to protect my users. My aim is to have the Linux distro and everything inside of it running from RAM, never storing anything permanently. It is possible ...
0
votes
0answers
113 views

Avoid undeleting corrupted/partially overwritten files

Recently I dealt with some computers infected by ransomware, with encrypted user files. My job was to either decrypt these files (if possible), or recover as much usable files as possible. That ...
0
votes
1answer
67 views

How to tell if a program or process tried to print or print info

I'm trying to work with third party support on a financial program called Mercury. The program says it has successfully printed a report through its "scheduler", but never physically prints anything. ...
0
votes
0answers
475 views

SIFT Workstation v3 Rollback on Ubuntu 14.04

I am a lawyer taking courses in Digital Forensics and also, quite new to Ubuntu (and Linux in general). I installed SIFT Workstation v3 on my Ubuntu 14.04 installation using the bash: wget --quiet -...
0
votes
0answers
242 views

Why is Encase disk image smaller than used space on source HDD?

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No ...
1
vote
0answers
53 views

Editing RAM in real time

Is it possible to edit ram in real time with hexdump or any other program? How? I read here http://linuxpoison.blogspot.pt/2011/04/how-to-read-content-from-ram-random.html that I can see the ...
0
votes
1answer
145 views

Wiping a Hard Disk while leaving a message behind

I wanted to know if there was a method to wipe a hard disk, so that if someone tried to recover data, they would be greeted by a message that the wiper chooses. For instance, in this video the wiper ...
0
votes
1answer
2k views

How to get complete memory dump in Windows 10?

It is possible to get information like process ID, process type, physical & virtual address from a memory dump in Windows 10?
3
votes
1answer
1k views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
1answer
429 views

6 year old Mac Hard Drive “date created” and “date modified” changed to 2 weeks ago

Edit: deleted because I made a mistake in providing the original situation / scenario. The "hard drive" dates were not changed ... I was mistakenly looking at the child "volume" "Alias" which always ...
0
votes
2answers
85 views

Checking for changes on Linux live OS's

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
1
vote
1answer
515 views

Raw reading USB mass storage or SCSI

Wife's USB HDD has a slight issue where a folder refuses to open (NTFS filesystem). I have been able to image the drive with Linux but for one sector (sectors are 4096 bytes). Reading that sector ...
1
vote
0answers
51 views

How can I convert a domain controller account to local account for forensic analysis?

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
3
votes
0answers
441 views

How can I view an “EA Record” (presumably part of the MFT in NTFS)?

I recently ran into a situation where a failing USB hub caused an external hard drive to not "safely disconnect." In the process of repairing the drive to avoid having Windows see it as a RAW ...
1
vote
1answer
308 views

strace to discover sudo password persistence location

strace/dtrace/ltrace ... useful for lots of things, from finding hidden access violations to network socket tracing, but maybe it can't see all. I haven't been able to figure out using strace (it ...
1
vote
1answer
194 views

Forensic DVD-R data

Forensically speaking, is there a way to read metadata, user profile, computer, or burning info on a DVD-R? I need to discover more about who made an illegal copy of a movie... Is this something ...
2
votes
0answers
249 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
1
vote
2answers
4k views

basic: adding a profile in Volatility

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the /Volatility/...
2
votes
2answers
359 views

File Recovery No Signatures(Magic Numbers)

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
0
votes
1answer
128 views

How to check for certain USB disk activities on windows?

I used FTK images to take image of the documents and registry files for a PC. I want to check for certain USB disk , when the last time it was used and when it was unplugged and activities during that ...
0
votes
0answers
79 views

How to display a fragment of an image file using Scalpel

I am working on a demonstration using Scalpel and its abilities to carve out image files. I took a small thumb drive and filled it with many small sized files until it was full. I then went and ...
0
votes
1answer
1k views

How to locate deleted data from recycle bin in Windows 7 and Windows 8.1?

I'm using Windows 7, but I tested Windows 8.1 with the same results. From what I understand deleted files in recycle bin are stored as $R or $I format, however nothing is visible when I search command ...
1
vote
2answers
880 views

NTFS MAC Times in Hexadecimal

I am using EnCase and a Hex Editor to analyse a virtual drive. EnCase says that the this hexadecimal: 5FBF60C54F2CCF01 is the date/time (mm/dd/yy): 02/17/14 09:18:54 (PM) I have worked out date/...
1
vote
0answers
85 views

How to mount a HDD for forensics?

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?
1
vote
3answers
2k views

Can you reuse a SSD after applying a Zero-Fill software?

I am returning my laptop to the retailer but I have had it for 1 month, In this time I have stored some confidential information, Because of this I am planning to zero fill my SSD using http://cmrr....
11
votes
2answers
9k views

Find the service creation date in Windows?

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the ...
5
votes
1answer
9k views

Location of Event logs in Windows

I have found that Windows logs every event such as system login/out, USB connection's history, etc. This all can be viewed in Event viewer. But my question is Where on the filesystem are the event ...
0
votes
1answer
591 views

Where can I get name of the person who registered Windows and his organization?

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
0
votes
3answers
9k views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...
0
votes
2answers
160 views

How can I tell whether I was BCCed to a MIME message?

In a MIME message, if my address is in the TO or CC fields, I know it was addressed to me in one of those ways. But what about BCC? Can I tell - from the copy of the message as I receive it from the ...
4
votes
1answer
794 views

What is this character-set corruption? (ISO-2022?)

I have a text file from a legacy source which contains corrupted characters. At first I thought the corruption was just gobbledygook, but it appears upon closer examination that some of the corrupted ...
1
vote
1answer
306 views

.ddd file - Verity Documentum?

I work in computer forensics - one of the data sets that I have recently been asked to analyse contains a number of .ddd files that I have so far been unable to open. Reading through these files in a ...