OSXPmem version 2.0.1 will successfully dump to AFF4. However, we need RAW. I found references to a -format flag in various blogs but "-format" is not evident in the OSXPmem man page and entering the flag throws errors. OSXPmem is not really designed to dump to RAW but supposedly it is possible. I just can't get it to work.

My AFF4 dumps are around 12 GB. I attempted to convert these AFF4 dumps to RAW using this command:

bash# osxpmem.app/osxpmem -e /dev/pmem -o Memory_Captures/mem.raw Memory_Captures/mem.aff4

Multiple different copies of my AFF4 memcaps converted to new files sized at exactly 2.06 GB and then stalled with “Imaging failed with the error: -8”. Googling this error yields nothing.

There's very little documentation on OSXPmem and virtually zero support. It looks like you can only use OSXPmem dumps with Rekall. Any suggestions appreciated.

I have written a module in Delphi that enumerates all the files on a volume.
How do I get to know the files that were updated / deleted / created since my last backup ?
Noticed that the FileUSNReference number and the ParentFileUSNReference number change upon any update done to the file. If I have stored the file details during my previous backup and if I compare the numbers with the current Reference numbers I can get to know that the files have changed.
Just need to know if this is a reliable method as this is just my observation and I do not know if this is how it is supposed to be

Ok... I need some help clarifying details in an email header. Some one I know has been fished/whaled (which ever it is). I want to know how it was done.
A genuine email was sent from Seller@realdomain.co.uk to Client with genuine bank details for a transfer. This was followed up with a scam email requesting a change of bank details. BUT the scam email came from Seller@realdomain.co.uk... (I am trying to find out if the seller@realdomain.co.uk was hacked)

Both seller and client domains are on 365 and have SPF records setup. So I would expect spoofing emails to be rejected.

Anyway, below is the header... I would like to understand what it says, these are some of the questions I want answered:
1. is it a spoof email or was it sent through 365 servers (there is no trace in the seller sent items, but could have been deleted)
2. It looks like the email "return" address has been setup as "seller@fakedomain.com.uk" to ensure replies do not reach "seller@realdomain.co.uk" and alert the seller of the scam. I didn't think it was possible with 365 to modify the return address?
3. Can we tell if this was sent through a microsoft portal or outlook?
4. I can see an SPF fail on the header... does this mean the email failed its SPF check but was still allowed through?
5. What other information can be gained?

Header
Received: from DM2PR0401MB0973.namprd04.prod.outlook.com (10.160.98.139) by
 BN1PR0401MB0961.namprd04.prod.outlook.com (10.160.79.12) with Microsoft SMTP
 Server…

i was wondering if anyone might be able to tell me how to read the logs I've gotten from Network Miner. My system has been compromised and I'm trying to get information on the people that have done it. I see MACS that are not any of my devices in the logs & are these for sure the possible hackers? Also im wondering what are all of the other base folders in their system folder:
all-words.txt
oui.txt
tcp.xml
Changelog
dhcp.xml
etter.finger.os
p0f.fp
p0f.fp.netsa

can someone tell me what these logs tell me??

are there any tools on windows, which for any user activity show which files/registry info on the system is being updated as a result of the user activity. I am sure there used to be something whereby any user activity, e.g. launch an application, insert external USB drive, etc would show which files/registry keys that user action had updated on the system, in real time, which was useful to see if user activity evidence for specific actions may be retrievable from certain hidden files/logs/keys. I just cant recall the name of the utility. We are trying to see if any action in a specific client/server application is updating any files on the client side which may prove user activity, in a system that otherwise has no audit logging enabled (server/database side of the application).

We recently had an IPS event and have hit a dead end on the logs, can I have some suggestion(s) for network based forensic tools that would give us better insight into what happened?

does anyone know if hp laserjet printers have any sort of audit log of what jobs were sent to the printer by whom.

And aside from pulling the drive out the device and taking a forensics copy for analysis, how this log would be accessed (management console of sorts?) over the network? I have no experience managing such devices.

for info it is a hp laserjet 11/11/2016 and is installed on a windows server

are there any forensics tools that can take a replica copy of how a website looked at a particular point in time, e.g. users facebook profile. How can you actually prove that is how the website looked at that point in time, for cases such as facebook - considering content can change almost instantly. if you were challenged how could you prove that was how the site looked at that specific point in time.

Hi, I'm looking for software or hardware that can run and allows for wiping USB drives.

I currently use dban but I'm looking for something a little more plug and erase.

Thanks in advance.