Digital Forensics

911

Solutions

8

Content

i
The collection of articles, videos, and posts on this topic.

1K

Contributors

Digital forensics encompasses the recovery and investigation of material found in digital devices, often in relation to computer crime. Digital forensics investigations have a variety of applications. The most common is to support or refute a hypothesis before criminal or civil (as part of the electronic discovery process) courts. The technical aspect of an investigation is divided into several sub-branches, relating to the type of digital devices involved; computer forensics, network forensics, forensic data analysis and mobile device forensics. The typical forensic process encompasses the seizure, forensic imaging (acquisition) and analysis of digital media and the production of a report into collected evidence.

Share tech news, updates, or what's on your mind.

Sign up to Post

HyperV Audit

I Can notice that the event viewer shows most of the administrative tasks completed in a Hyper-V Server, but it does not specify the user performing the action. (i.e. Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ Hyper-V-*)

Considering a default installation (No additional software added, no settings modified to the default debugging level). How can I track which one of my administrators performed specific administrative actions in Hyper-V?
0
1 Comment
WEBINAR: 10 Easy Ways to Lose a Password
LVL 1
WEBINAR: 10 Easy Ways to Lose a Password

Join us on June 27th at 8 am PDT to learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees. We'll cover the importance of multi-factor authentication and how these solutions can better protect your business!

Register Today!
An Incident response plan is an organized approach to addressing and managing an incident. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.
2
0 Comments
Hello,
1. I have an msg file which is digitally signed and not encrypted, I could see 2 attachments from the email one is .P7M and the other one is .P7S. Can this happen ? I mean it should be either a .P7m file or a .P7s file right?
2. Can .P7s file support encryption and digital sign both?
3. Can you explain in detail the difference between .P7m and .p7S files?
0
2 Comments
Would facebook provide any evidence under any circumstances if copies of a users posts etc were required, and to whom would they release this information, e.g. only law enforcement?

Also if a user deleted a post - would FB be able to prove a post ever existed?
0
7 Comments
aside from the standard history sql lit db for chrome, and WebCacheV01.dat for IE history files, where else on a windows machine could give clues if a user has accessed a certain webmail service and logged in using a specific email account? I suspect either gmail or hotmail. Just want to rule out any other areas such evidence may reside apart from the obvious browser history locations.
0
2 Comments
does anyone know of a free tool which can pass the internet explorer history stored in WebCacheV01.dat and WebCacheV24.dat files to see which sites a user has visited? there were loads of tools for older IE releases, with the index.dat format, but not found much for the newer ESE databases
0
2 Comments
The Tech or Treat contest winner has been chosen! Congratulations to expert Thomas Zucker-Scharff, our champion, who submitted an article on a suspected hack into his work device that, to this day, has never been solved.
3
1 Comment
 
LVL 4

Expert Comment

by:Juana Villa
giphy.gif
1
It all started with a phone call. The then acting director of the Office of Research Computing, called to ask me to remotely shutdown my computer, it was Yom Kippur, Wednesday October 12, 2016.
1
0 Comments
Hi there,
Please can you help me? On my Android Samsung Galxy S6 are stored files under /userdata/data/com.microsoft.office.word/app-EmailAttachments.. So, I know what this files are but I don`t know how the names of the files are generated.
i.e. /app_EmailAttachmentseaa8ac15-baaf-4675-9f6a-9698e54f0108. This file name belongs to a pdf i have sent. What does the string "eaa8ac15-baaf-4675-9f6a-9698e54f0108" in the file name mean?
Thx
0
3 Comments
if you used one of the digital forensics imaging tools, such as FTK imager of a live system that hosted a database, be that an exchange mailbox database, or sql server database - will the imaging process work, and actually give you a copy of the database that can be interrogated in your forensics search tools? My thoughts were that even backups have to follow a specific purpose which stops processes before they can be backed up - so trying to take an image of a running database is similar to try and copy and paste it - in that it will result in errors and you wont get a clean copy/copy at all?
0
1 Comment
Cloud Class® Course: CompTIA Healthcare IT Tech
LVL 12
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

Start This Course
Greeting Experts,

I need help locating a software that is able to take a snapshot of a remote computers H/D without the end user knowing it. I have been searching the internet and have not found anything so far. Can somebody recommend software that is able to do this type of function?
0
7 Comments
I'm writing a program that displays a time stamp or large number in a datagrideview. I'm loading the data using a SQLite engine.

In order to convert the number (time stamp) I need to take only the first 11 characters or numbers from the value.

Is their a way to loop through all cells in a column and trim it down to say 11 characters?
0
12 Comments
And now the "Original Author of Petya Ransomware" wants to help !!
http://thehackernews.com/2017/06/petya-ransomware-decryption-key.html
Original Author of Petya Ransomware is Back & He Wants to Help NotPetya VictimsThe Original Author of Petya Ransomware is Back & He Wants to Help NotPetya Victims
3
0 Comments
Breaking News: The Latest New Petya isn't Ransomware. It's actually a destructive wiper malware.
http://thehackernews.com/2017/06/petya-ransomware-wiper-malware.html
Turns Out New Petya is Not a Ransomware, It’s a Destructive Wiper MalwareSecurity researcher finds Petya is not a ransomware malware, instead it’s a destructive Wiper Malware
4
1 Comment
 
LVL 4

Expert Comment

by:Juana Villa
Can people user their intelligence to help others? or ... at least not hurt them in any way?
1
are there any free tools which could scan a drive on a file server for potential inappropriate images, based on a nudity type calculation. I know these things exist in forensics communities but I have yet to see anything that is free. we need to do a quick scan to ensure one of our employees has not stored any inappropriate material on one of our file servers.
1
2 Comments
And now UK Parliament becomes a victim of cyber terrorism !!
http://bit.ly/2taexPI
UK Parliament Hit by Cyberattack, Up to 90 MPs' E-mail Accounts HackedA Cyberattack has hit the email system of UK Houses of Parliament that compromised at least 90 emails accounts
1
0 Comments
I need to analyze a large number of hard drives to see what files were created by a particular user.  What is the best forensic software out there to do this with?
0
5 Comments
OSXPmem version 2.0.1 will successfully dump to AFF4. However, we need RAW. I found references to a -format flag in various blogs but "-format" is not evident in the OSXPmem man page and entering the flag throws errors. OSXPmem is not really designed to dump to RAW but supposedly it is possible. I just can't get it to work.

My AFF4 dumps are around 12 GB. I attempted to convert these AFF4 dumps to RAW using this command:

bash# osxpmem.app/osxpmem -e /dev/pmem -o Memory_Captures/mem.raw Memory_Captures/mem.aff4

Multiple different copies of my AFF4 memcaps converted to new files sized at exactly 2.06 GB and then stalled with “Imaging failed with the error: -8”. Googling this error yields nothing.

There's very little documentation on OSXPmem and virtually zero support. It looks like you can only use OSXPmem dumps with Rekall. Any suggestions appreciated.
0
0 Comments
We've downloaded Paladin 7.02 to a USB stick and we have successfully booted a MacBook Air.

Attached to the Air via USB is a Mac OS X drive in an enclosure called "Macintosh HD." Also attached is a Windows FAT32-formatted drive, "Image."

We need to E01 image Macintosh HD to the Image target drive.

We see that Paladin has provided 3 "Imaging Tools" that launch Linux terminal sessions. However, we can't find any documentation for how to actually render the E01 image. All suggestions welcome.
0
3 Comments
Protect Your Employees from Wi-Fi Threats
LVL 1
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

Download the kit!
Let's say there's malware running on the Mac in OS 10.9. This malware launches whenever the computer is booted and/or connected to the Internet. Will upgrading the operating system to 10.11 have any effect on the malware, that is, will the upgrade force the removal of the malware?

If there's no other change to the system other than the OS installation, will the malware continue to launch on boot after the upgrade is installed?
0
4 Comments
We need to do some RAM dumps from a Mac. Is there a functioning free tool out there?

We found a tool called Rekall. However, the documentation is limited. We are not UNIX / Python experts and we really need step-by-step installation instructions.

We know that we can pay $1,695 for Paladin but we'd rather not at this time.
0
3 Comments
Ok... I need some help clarifying details in an email header. Some one I know has been fished/whaled (which ever it is). I want to know how it was done.
A genuine email was sent from Seller@realdomain.co.uk to Client with genuine bank details for a transfer. This was followed up with a scam email requesting a change of bank details. BUT the scam email came from Seller@realdomain.co.uk... (I am trying to find out if the seller@realdomain.co.uk was hacked)

Both seller and client domains are on 365 and have SPF records setup. So I would expect spoofing emails to be rejected.

Anyway, below is the header... I would like to understand what it says, these are some of the questions I want answered:
1. is it a spoof email or was it sent through 365 servers (there is no trace in the seller sent items, but could have been deleted)
2. It looks like the email "return" address has been setup as "seller@fakedomain.com.uk" to ensure replies do not reach "seller@realdomain.co.uk" and alert the seller of the scam. I didn't think it was possible with 365 to modify the return address?
3. Can we tell if this was sent through a microsoft portal or outlook?
4. I can see an SPF fail on the header... does this mean the email failed its SPF check but was still allowed through?
5. What other information can be gained?

Header
Received: from DM2PR0401MB0973.namprd04.prod.outlook.com (10.160.98.139) by
 BN1PR0401MB0961.namprd04.prod.outlook.com (10.160.79.12) with Microsoft SMTP
 Server…
0
4 Comments
Given the scenario of a simple text file on file server share and a user opens the file on the remote share from their desktop and someone was to capture the SMB traffic and look at the pcap file, could you see the some of the file contents in the capture?  This assumes that smbv3 with encryption is not used.
0
4 Comments
i was wondering if anyone might be able to tell me how to read the logs I've gotten from Network Miner. My system has been compromised and I'm trying to get information on the people that have done it. I see MACS that are not any of my devices in the logs & are these for sure the possible hackers? Also im wondering what are all of the other base folders in their system folder:
all-words.txt
oui.txt
tcp.xml
Changelog
dhcp.xml
etter.finger.os
p0f.fp
p0f.fp.netsa

can someone tell me what these logs tell me??
0
2 Comments
We need to prove if a user has accessed a corporate business system from a specific machine. the audit trails in the system itself frustratingly do not log user access/record access, I am unsure at this stage what language the app was developed, but I do know the system installs some client software on each users machine which is used to connect to the app server and provide a front end etc. This isn't opened in a browser, but I was thinking whether you could use pre-fetch to at least show the last time the applications (client) was launched. Are there any other common areas we could use to identify application access from the client side? Pre-fetch was the only obvious thing i could think of but after some inspiration if there may be anything else (windows 7 device).
0
5 Comments

Digital Forensics

911

Solutions

8

Content

i
The collection of articles, videos, and posts on this topic.

1K

Contributors

Digital forensics encompasses the recovery and investigation of material found in digital devices, often in relation to computer crime. Digital forensics investigations have a variety of applications. The most common is to support or refute a hypothesis before criminal or civil (as part of the electronic discovery process) courts. The technical aspect of an investigation is divided into several sub-branches, relating to the type of digital devices involved; computer forensics, network forensics, forensic data analysis and mobile device forensics. The typical forensic process encompasses the seizure, forensic imaging (acquisition) and analysis of digital media and the production of a report into collected evidence.

Advertise Here
Top Experts In
Digital Forensics
<
Monthly
>
Hall of FameAnnual Expert Awards
Advertise Here