Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

MS Word Metadata

This semester my CS 1501 final was replaced with a take-home exam in the form of a word document to be edited and uploaded by the due date. Something went wrong on my end where the file did not upload,...
0
votes
0answers
39 views

Does AWS support the TRIM command for EBS volumes that are SSD-backed?

I've gone over Amazon's documentation and it seems that the TRIM command is only implemented for some instance types that have internal SSDs (specifically, the C5d, G4, I3, I3en, F1, M5ad, M5d, p3dn....
0
votes
1answer
34 views

Find hostname of an Windows image

How to find a hostname of a windows image? I've read about looking at the regback files, but also using C:/Windows/Debug/NetSetup.LOG When navigating to C:/Windows/Debug/NetSetup.LOG it shows several ...
1
vote
1answer
79 views

How to convert dd partition image to virtualbox virtual disk?

I created a backup from /dev/sda1 and /dev/sda4 partitions using dd. but i did not create a backup from /dev/sda2 and /dev/sda3. How can I convert these 2 backup files from /dev/sda1 and /dev/sda4 ...
1
vote
1answer
48 views

Recovering a JPEG image with broken sections

Some files were corrupted while being recovered from a disk drive, including portions of videos and images. They all seem to share the trait of having sections of data replaced with repeating bytes (...
0
votes
0answers
15 views

Can file Modified be greater than file Accessed date?

Is it possible for a file to have such metadata? Note that Modified > Accessed in nanoseconds precision. Created: 2016-Jan-07 15:10:57.143202 UTC Modified: 2016-Jan-07 15:10:57.863803 UTC Accessed: ...
0
votes
0answers
299 views

Mount Android 10 dd image of /sda internal memory

Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (...
0
votes
0answers
30 views

Data-Recovery - no results with foremost and magicrescue - Any other options?

I had Linux on my notebook with 2 primary partitions, system and data, both ext4. Then I had to switch to Windows and changed the second partition to a logical FAT32-partition. I also booted Windows ...
2
votes
2answers
237 views

Delete 0x00 bytes at the end of files

I have rescued some files (Python, Shell scripts etc., so just text files) from a Linux SD card using FTK Imager Lite. The files are ok, but they now contain a lot of 0x00 bytes at the end. How could ...
0
votes
0answers
18 views

Is it possible to correct corrupt HDD partition, while there are all files yet?

I used Dist Partition tool, and happened an unexpected error during "partition resize" operation, and on partition files become corrupt. Now I see that many .TXT files show part of content of another ...
-1
votes
1answer
54 views

How do I tell if a CD disc was burned 3 days ago or 3 months ago by physical inspection? [duplicate]

Is there a way to tell when a disk has been burned by inspecting the disc for its physical features?
0
votes
1answer
47 views

Windows System and DNS Client - constant querries for unknown local host

I noticed today that there was significant traffic on all my connected network interfaces (loopback, 2 VMWare network adapters, ethernet and wifi). Wireshark home page showing traffic graphs. The ...
0
votes
0answers
770 views

Rekall Tool : SSL Error - Certificate_verify_failed (_ssl.c:1076)

I have a problem with SSL certificate. I would like to explain my problem. I'm trying to install Rekall tool and it's memory forensic framework. I installed Python 3.7 then I created new virtualenv ...
0
votes
1answer
45 views

Does the filesystem windows is installed on have an effect on the time zone settings of timestamps within windows registry hives?

This question does not refer to the filesystem timestamps of the registry files themself. As far as I know timestamps within the Windows Registry are stored as UTC timestamps when Windows is ...
1
vote
1answer
40 views

Determine what file a local leafpad instance has open

I'm running a leafpad text editor instance on a certain computer, which has a certain file open, whose name and location I have forgotten (it's actually more complicated but this is a simplified ...
0
votes
0answers
63 views

Compare two whole HDD's contents, sector-level

While analysing two 4TB HDDs, which were in some kind of RAID 1 configuration, and thus have the same contents in terms of files / folders (they have been reformatted but R-Studio lists the same file ...
1
vote
1answer
72 views

Where i can find CCleaner InstallDate? (forensics)

I have tried in HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall without finding anything any suggestions?
0
votes
1answer
321 views

Created date timestamp of the C:\Windows\ folder is older than the “original install date” of the Windows 7 OS, why?

Created date of my C:\Windows\ folder in a Windows 7 machine is "‎14 ‎July ‎2009, ‏‎08:07:05", however, the "original install date" obtained from the "systeminfo" command in cmd is "27-6-2013, 11.33....
2
votes
1answer
77 views

Which system file stores the information displayed by the “net user Administrator” command in Windows 7?

Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine. Details of the command is ...
0
votes
1answer
42 views

What does foremost do that is different from mount?

I was doing a challenge on picoCTF which involved getting a flag from a .dd file. The .dd file initially appears to be a FAT partition that contains some jpg files. My idea was to mount the file ...
0
votes
0answers
131 views

Fdisk doesn't recognize Macbook's file system

I need to mirror a MacBook, which was functioning properly. But when I ran fdisk -l, I got this: Disk /dev/sda: 113 GiB, 121332826112 bytes, 236978176 sectors Units: sectors of 1 * 512 = 512 bytes ...
1
vote
1answer
72 views

How to import “RECYCLER” folders into Windows?

question: If I connect a HDD to my PC, how can I import the RECYCLER folder into Windows XP? In other words: How can I tell Windows XP to include the content of D:\RECYCLER\ in the recycle bin? case ...
0
votes
1answer
92 views

'nosuid,nodev,nofail,noauto' equivalent in Windows?

So I'm doing forensic tool validation with multiple tools and operating systems. I have started on Linux using dd and the other two tools I need to use are FTK Imager and ProDiscover; both windows ...
0
votes
0answers
83 views

Forensics on a single CD-Rom Disc

Is there a way to find out information as to what device created the data on a CD-Rom in addition to when the disk was formatted and burned? I have a friend facing criminal charges based solely on a ...
1
vote
0answers
434 views

Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

There are two great articles about how to aquire memory on Linux using linpmem: SANS holdmybeersecurity Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be ...
3
votes
1answer
3k views

How to mount an LVM volume from a dd/raw/vmdk image?

Input: RAW/DD Image of an HDD. fdisk -l shows partitions sudo fdisk -l image.dd Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/...
1
vote
1answer
704 views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
0
votes
0answers
266 views

Broken external USB hard drive undetected by system

I have an external 1TB Intenso® USB hard drive, which stopped working after a small crash on the case. When I plug it into any computer, the light comes on and it makes noise (you can feel the disk ...
2
votes
0answers
672 views

How to dump memory of virtual machine running in linux?

I have a windows virtual machine installed using qemu. I want to know how can I dump the entire ram memory of guest system from host system like bin2dmp do in windows. I have read here that it is ...
0
votes
4answers
5k views

How to find the install date of Windows operating system without the Registry or command prompt?

I am looking at the dumped files of a Windows XP computer. I do not have access to the Registry, just all of the files from the computer itself. I want to figure out on what date the operating system ...
1
vote
1answer
627 views

Is it possible to get timestamp when is HDD formated?

I have wondering is it possible to determine when is HDD formated? It was formated with GParted from live linux. Previously, Windows was installed and filesystem was NTFS. Thanks
3
votes
4answers
3k views

How to identify a file type without extension in Windows?

I have a large file of 92.5GB with no file extension inside the C:// partition called “Free Space” and another sibling one of 260KB I wonder if I can identify this file extension or maybe its origin ...
3
votes
3answers
3k views

How is it possible to make a bit by bit copy of a hard drive while using it?

I learned in forensics you can deploy an agent to a remote computer and have it retrieve an exact copy of the remote hard drive, including unallocated space and swap, even while it is being used. This ...
0
votes
1answer
6k views

Convert hexdump to tar file

I have a hex dump as 1f8b 0800 3416 1259 0003 edcf 310e c230 0c85 61cf 9c22 1708 b2d3 909e a7a2 5d90 1028 7581 e353 d401 2660 a910 d2ff 2d6f f01b 9ec7 615f 07df facd 6535 3a2b 253f d2da 9dbe e622 ...
0
votes
0answers
41 views

Can Windows 10 Event Logs be used to determine which programs were installed on a machine and when?

I found an answer for the package manager logs Debian which can show you when and in what order packages have been installed or updated from Bash. Is there any sort of equivalent to this in Windows ...
0
votes
0answers
87 views

Possibility of recovering previous data after format and reinstalling os (windows7)?

I am asking for some piece of advice on possibility of recovering the previous data after several formats & os installations because there was some important data I needed to keep but forgot to ...
3
votes
1answer
1k views

hdparm: what does --dco-restore really do?

I am following instructions on this other SuperUser post: Harddrive - wipe out "hidden areas" like HPA and DCO also after malware infection For the last few days I have been researching ...
0
votes
1answer
60 views

How do I tell if my laptop has been messed around with?

I just have my laptop to h local service people, but the thing is, I live in a bad neighborhood. I took a backup before giving it. But how will I be able to tell if they switched out any parts with ...
0
votes
3answers
797 views

Linux server just as RAMdisk

I want to setup an anti-forensic Linux server to protect my users. My aim is to have the Linux distro and everything inside of it running from RAM, never storing anything permanently. It is possible ...
0
votes
0answers
161 views

Avoid undeleting corrupted/partially overwritten files

Recently I dealt with some computers infected by ransomware, with encrypted user files. My job was to either decrypt these files (if possible), or recover as much usable files as possible. That ...
0
votes
1answer
89 views

How to tell if a program or process tried to print or print info

I'm trying to work with third party support on a financial program called Mercury. The program says it has successfully printed a report through its "scheduler", but never physically prints anything. ...
0
votes
0answers
597 views

SIFT Workstation v3 Rollback on Ubuntu 14.04

I am a lawyer taking courses in Digital Forensics and also, quite new to Ubuntu (and Linux in general). I installed SIFT Workstation v3 on my Ubuntu 14.04 installation using the bash: wget --quiet -...
0
votes
0answers
365 views

Why is Encase disk image smaller than used space on source HDD?

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No ...
1
vote
0answers
60 views

Editing RAM in real time

Is it possible to edit ram in real time with hexdump or any other program? How? I read here http://linuxpoison.blogspot.pt/2011/04/how-to-read-content-from-ram-random.html that I can see the ...
0
votes
1answer
282 views

Wiping a Hard Disk while leaving a message behind

I wanted to know if there was a method to wipe a hard disk, so that if someone tried to recover data, they would be greeted by a message that the wiper chooses. For instance, in this video the wiper ...
-1
votes
1answer
4k views

How to get complete memory dump in Windows 10?

It is possible to get information like process ID, process type, physical & virtual address from a memory dump in Windows 10?
4
votes
1answer
3k views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
1answer
642 views

6 year old Mac Hard Drive “date created” and “date modified” changed to 2 weeks ago

Edit: deleted because I made a mistake in providing the original situation / scenario. The "hard drive" dates were not changed ... I was mistakenly looking at the child "volume" "Alias" which always ...
0
votes
2answers
90 views

Checking for changes on Linux live OS's

I am a novice to the terminal of linux live OS's (eg Kali Linux). Please advise what 1) in built programs (e.g. Syslog...), 2) Commands in the Terminal (eg ls, ps, md5sum, ...) one can use for ...
1
vote
1answer
628 views

Raw reading USB mass storage or SCSI

Wife's USB HDD has a slight issue where a folder refuses to open (NTFS filesystem). I have been able to image the drive with Linux but for one sector (sectors are 4096 bytes). Reading that sector ...