The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
2answers
49 views

How to mount the dd image of a swap file

I have several dd images from a single drive. One of them is the swap. I mounted all of the images in Ubuntu just fine except for the image of the swap. This is how the dd images break down: hda8 is /,...
2
votes
1answer
82 views

How to disable automatic garbage collection on an SSD?

Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered automatically by the drive via a TRIM command sent by the OS Is ...
0
votes
0answers
57 views

pfsend does not send a pcap file at specified rate

I'm replaying traffic using pfsend application that comes from PF_RING. I'm using SMIA pcap file to evaluate Bro and Snort on a multi-core machine. Using pfsend, we can specify at which rate the pcap ...
1
vote
1answer
274 views

Finding email read times on exchange server

I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
1
vote
2answers
949 views

What are my options with a downloaded Rackspace cloud image?

I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local ...
10
votes
2answers
6k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory (...
0
votes
2answers
351 views

What logs should I check after a break-in?

I've asked this same question on superuser but I didn't have that much succes. I'd like to learn more about forensic analysis, and I'm doing the challenges from Project Honeynet. I need to check the ...
15
votes
8answers
3k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...