Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Total number of registry hives?

If I have 2 users. Then will the total registry files be 4 (system hives) + 2 (one user hive for each). Total 6 hives right?
0 votes
0 answers
25 views

Recovery of deleted data from a modern disk

I have the opposite problem of this question's OP: What can be recovered? Securely deleted files I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then ...
user avatar
1 vote
1 answer
283 views

Data recovery on partition encrypted with Veracrypt - Input/Output error - Possible disk failure

I am trying to recover some data from my backup drive which is encrypted with Veracrypt as I recently encountered input/output error messages when I attempted to copy some of the files from it. This ...
0 votes
0 answers
319 views

Winlogon Event ID 811/812 event tags

In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
0 votes
0 answers
53 views

How to create an 1:1 image of an unencrypted mounted partition?

I am currently doing a forensic research on android. I am interested in the userdata partition, which is usually encrypted (i did not found a way to disable the file-based encryption on Android 10/11 ...
  • 1
0 votes
1 answer
322 views

Can you tell if a document has had its metadata altered?

I'm dealing with a situation in which the other party has fabricated logs. These logs are presumably in docx or doc formats. A large part of the issue is that the logs are not contemporaneous - they ...
0 votes
1 answer
38 views

Is there a way to demonstrate a message has been edited using Outlook's "Edit Message" (or its subject)?

Is there any way (complicated or no) to demonstrate that an Outlook message has been edited using the 'Edit Message' function, or that the subject was edited on its own? For purposes of this answer, I ...
0 votes
1 answer
99 views

Is the sector size showed by winhex just an emulation from advanced format?

The info below is from a hard drive, given these two lines; Bytes Per Sector : 512 and Bytes Per Physical Sector : 4096 i conclude that it has an advanced format emulating a sector size of 512 bytes ...
0 votes
0 answers
758 views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
0 votes
1 answer
108 views

Windows Event Viewer: can't find user-started programs

My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
1 vote
1 answer
51 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user avatar
2 votes
0 answers
7 views

What can make unmounted volumes SHA512 hashes differ while mounted volumes content SHA512 hashes are identical?

I am trying to configure Raspberry Pi OS to be read-only. In theory, both / and /boot are read-only. That being said, I am experiencing a strange discrepancy and can’t figure out what is happening. I ...
-3 votes
1 answer
106 views

How to navigate to recycle bin through system level powershell

I'm having difficulty navegating to the recycle bin on windows 10 machines through powershell. I'm able to get &Recycle.Bin listed by using the force option on ls, but I can't change my directory ...
1 vote
1 answer
43 views

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them? [duplicate]

I have two sticks of RAM in my computer that I would like to sell or donate. From what I understand some RAM is volatile, losing all its contents when power is gone for a few minutes, and some is non-...
user avatar
3 votes
3 answers
930 views

How can I access the Windows search database in order to learn about files on a broken hard drive?

I have a Windows 10 PC and one of my hard discs broke completely (as in not recognized by the BIOS, makes funny noises and cannot be used). It was not the system disc but contained mostly private data....
  • 155
0 votes
0 answers
32 views

Recover formatted HDD while mounting the drive

I had Windows Server installed on a SSD and a 1TB HDD with all the photos and files. I decided to use Ubuntu Server instead and i installed it in my SSD. Once installed I looked for my 1TB HDD but I ...
0 votes
4 answers
906 views

How does writing zeroes to a drive remove data from it?

I know a fair bit about the process of securely wiping drives, including that one wipe is usually sufficient and that no-one has yet (publicly) been able to recover a bit of data from one pass of ...
  • 10.7k
1 vote
1 answer
57 views

How to dump Verity .ddd file to a text file?

I found this very helpful information about Verity database structure .ddd file - Verity Documentum? Now I want to migrate an old Verity database to a new application, therefore I'd like to dump ...
  • 21
0 votes
0 answers
39 views

MS Word Metadata

This semester my CS 1501 final was replaced with a take-home exam in the form of a word document to be edited and uploaded by the due date. Something went wrong on my end where the file did not upload,...
0 votes
0 answers
349 views

Does AWS support the TRIM command for EBS volumes that are SSD-backed?

I've gone over Amazon's documentation and it seems that the TRIM command is only implemented for some instance types that have internal SSDs (specifically, the C5d, G4, I3, I3en, F1, M5ad, M5d, p3dn....
  • 3,173
0 votes
2 answers
5k views

Find hostname of an Windows image

How to find a hostname of a windows image? I've read about looking at the regback files, but also using C:/Windows/Debug/NetSetup.LOG When navigating to C:/Windows/Debug/NetSetup.LOG it shows several ...
  • 105
2 votes
1 answer
4k views

How to convert dd partition image to virtualbox virtual disk?

I created a backup from /dev/sda1 and /dev/sda4 partitions using dd. but i did not create a backup from /dev/sda2 and /dev/sda3. How can I convert these 2 backup files from /dev/sda1 and /dev/sda4 ...
  • 142
1 vote
1 answer
109 views

Recovering a JPEG image with broken sections

Some files were corrupted while being recovered from a disk drive, including portions of videos and images. They all seem to share the trait of having sections of data replaced with repeating bytes (...
0 votes
0 answers
989 views

Mount Android 10 dd image of /sda internal memory

Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (...
  • 101
4 votes
3 answers
2k views

Delete 0x00 bytes at the end of files

I have rescued some files (Python, Shell scripts etc., so just text files) from a Linux SD card using FTK Imager Lite. The files are ok, but they now contain a lot of 0x00 bytes at the end. How could ...
-1 votes
1 answer
332 views

How do I tell if a CD disc was burned 3 days ago or 3 months ago by physical inspection? [duplicate]

Is there a way to tell when a disk has been burned by inspecting the disc for its physical features?
  • 7
0 votes
1 answer
181 views

Windows System and DNS Client - constant querries for unknown local host

I noticed today that there was significant traffic on all my connected network interfaces (loopback, 2 VMWare network adapters, ethernet and wifi). Wireshark home page showing traffic graphs. The ...
0 votes
0 answers
878 views

Rekall Tool : SSL Error - Certificate_verify_failed (_ssl.c:1076)

I have a problem with SSL certificate. I would like to explain my problem. I'm trying to install Rekall tool and it's memory forensic framework. I installed Python 3.7 then I created new virtualenv ...
  • 1
0 votes
1 answer
256 views

Does the filesystem windows is installed on have an effect on the time zone settings of timestamps within windows registry hives?

This question does not refer to the filesystem timestamps of the registry files themself. As far as I know timestamps within the Windows Registry are stored as UTC timestamps when Windows is ...
  • 59
1 vote
1 answer
85 views

Determine what file a local leafpad instance has open

I'm running a leafpad text editor instance on a certain computer, which has a certain file open, whose name and location I have forgotten (it's actually more complicated but this is a simplified ...
  • 7,792
0 votes
0 answers
368 views

Compare two whole HDD's contents, sector-level

While analysing two 4TB HDDs, which were in some kind of RAID 1 configuration, and thus have the same contents in terms of files / folders (they have been reformatted but R-Studio lists the same file ...
  • 827
1 vote
1 answer
172 views

Where i can find CCleaner InstallDate? (forensics)

I have tried in HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall without finding anything any suggestions?
  • 11
0 votes
1 answer
1k views

Created date timestamp of the C:\Windows\ folder is older than the "original install date" of the Windows 7 OS, why?

Created date of my C:\Windows\ folder in a Windows 7 machine is "‎14 ‎July ‎2009, ‏‎08:07:05", however, the "original install date" obtained from the "systeminfo" command in cmd is "27-6-2013, 11.33....
2 votes
1 answer
162 views

Which system file stores the information displayed by the "net user Administrator" command in Windows 7?

Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine. Details of the command is ...
0 votes
1 answer
84 views

What does foremost do that is different from mount?

I was doing a challenge on picoCTF which involved getting a flag from a .dd file. The .dd file initially appears to be a FAT partition that contains some jpg files. My idea was to mount the file ...
  • 101
0 votes
0 answers
218 views

Fdisk doesn't recognize Macbook's file system

I need to mirror a MacBook, which was functioning properly. But when I ran fdisk -l, I got this: Disk /dev/sda: 113 GiB, 121332826112 bytes, 236978176 sectors Units: sectors of 1 * 512 = 512 bytes ...
1 vote
1 answer
181 views

How to import "RECYCLER" folders into Windows?

question: If I connect a HDD to my PC, how can I import the RECYCLER folder into Windows XP? In other words: How can I tell Windows XP to include the content of D:\RECYCLER\ in the recycle bin? case ...
0 votes
1 answer
157 views

'nosuid,nodev,nofail,noauto' equivalent in Windows?

So I'm doing forensic tool validation with multiple tools and operating systems. I have started on Linux using dd and the other two tools I need to use are FTK Imager and ProDiscover; both windows ...
1 vote
0 answers
698 views

Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

There are two great articles about how to aquire memory on Linux using linpmem: SANS holdmybeersecurity Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
  • 291
7 votes
1 answer
11k views

How to mount an LVM volume from a dd/raw/vmdk image?

Input: RAW/DD Image of an HDD. fdisk -l shows partitions fdisk -l image.dd Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/...
  • 291
2 votes
1 answer
1k views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
  • 31
0 votes
0 answers
311 views

Broken external USB hard drive undetected by system

I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
2 votes
0 answers
1k views

How to dump memory of virtual machine running in linux?

I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
0 votes
4 answers
8k views

How to find the install date of Windows operating system without the Registry or command prompt?

I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system ...
  • 147
1 vote
1 answer
2k views

Is it possible to get timestamp when is HDD formated?

I have wondering is it possible to determine when is HDD formated? It was formated with GParted from live linux. Previously, Windows was installed and filesystem was NTFS. Thanks
user avatar
3 votes
4 answers
5k views

How to identify a file type without extension in Windows?

I have a large file of 92.5GB with no file extension inside the C:// partition called “Free Space” and another sibling one of 260KB I wonder if I can identify this file extension or maybe its origin ...
3 votes
3 answers
5k views

How is it possible to make a bit by bit copy of a hard drive while using it?

I learned in forensics you can deploy an agent to a remote computer and have it retrieve an exact copy of the remote hard drive, including unallocated space and swap, even while it is being used. This ...
  • 463
0 votes
1 answer
8k views

Convert hexdump to tar file

I have a hex dump as 1f8b 0800 3416 1259 0003 edcf 310e c230 0c85 61cf 9c22 1708 b2d3 909e a7a2 5d90 1028 7581 e353 d401 2660 a910 d2ff 2d6f f01b 9ec7 615f 07df facd 6535 3a2b 253f d2da 9dbe e622 ...
0 votes
0 answers
46 views

Can Windows 10 Event Logs be used to determine which programs were installed on a machine and when?

I found an answer for the package manager logs Debian which can show you when and in what order packages have been installed or updated from Bash. Is there any sort of equivalent to this in Windows ...
  • 20.1k
3 votes
1 answer
2k views

hdparm: what does --dco-restore really do?

I am following instructions on this other SuperUser post: Harddrive - wipe out "hidden areas" like HPA and DCO also after malware infection For the last few days I have been researching ...