Questions tagged [forensic-analysis]
The forensic-analysis tag has no usage guidance.
12
questions
0
votes
1
answer
599
views
Is there a (forensic) way to list past events/actions of a certain *.exe malware program (PUP-Proxygate, possibly a Trojan)?
There is a folder with suspicious *.exe files on a Win 10 PC, and there are (external) protocols of potentially unlawful actions coming from that PC at a certain time in the past. The first suspicious ...
4
votes
1
answer
872
views
How to disable automatic garbage collection on an SSD?
Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered
automatically by the drive
via a TRIM command sent by the OS
Is there ...
4
votes
2
answers
1k
views
Virtual machine memory space forensics
in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either ...
2
votes
2
answers
1k
views
Sending ESXi Snapshot to 3rd party forensics team
We recently had a couple security events occur and we immediately took a snapshot of the VM as we wanted to preserve as much of the data as we could. Now we would like to send it to a 3rd party ...
0
votes
1
answer
71
views
Examine contents of unused space on the HDD
When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical ...
0
votes
2
answers
479
views
How can I analyze an encrypted HDD?
I have a HDD which I encrypted few years ago but I can't remember the tool I used. How can I find out if I have used TrueCrypt or VeraCrypt to encrypt my hard drive?
Thanks.
0
votes
3
answers
2k
views
How to mount the dd image of a swap file
I have several dd images from a single drive. One of them is the swap. I mounted all of the images in Ubuntu just fine except for the image of the swap. This is how the dd images break down: hda8 is /,...
1
vote
1
answer
1k
views
Finding email read times on exchange server
I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
1
vote
2
answers
1k
views
What are my options with a downloaded Rackspace cloud image?
I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local ...
15
votes
8
answers
6k
views
What are main steps doing forensic analysis of linux box after it was hacked?
What are main steps doing forensic analysis of linux box after it was hacked?
Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
10
votes
2
answers
8k
views
My linux server was hacked. How do I find out how and when it was done?
I have a home server running a desktop ubuntu distribution. I found this in my crontab
* * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1
and when looking in that directory (...
0
votes
2
answers
459
views
What logs should I check after a break-in?
I've asked this same question on superuser but I didn't have that much succes. I'd like to learn more about forensic analysis, and I'm doing the challenges from Project Honeynet. I need to check the ...