The forensics tag has no wiki summary.
46
votes
2answers
3k views
Mysterious visitor to hidden PHP page
On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
10
votes
3answers
807 views
Website defaced, what can I do?
My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong?
I mean what to look out for among all those ...
4
votes
3answers
2k views
Find IP address of a device?
Open question: How to find the IP address of a device?
As I understand, there are no guaranteed methods that work always, but there's a hundred approaches that work in specific situations, and I'd ...
4
votes
2answers
1k views
How to determine which file/inode occupies a given sector
I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3):
[ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code
...
3
votes
0answers
1k views
Forensic Analysis of the OOM-Killer
Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others.
I've managed to learn what the OOM Killer is, and about its "badness" ...
2
votes
1answer
496 views
Find the source of malware?
I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
2
votes
1answer
69 views
Forensics on Virtual Private servers [closed]
So these days with talks about having hacked machines being used for malware spreading and botnet C&C, the one issue that is not clear to me is what do the law enforcement agencies do once they ...
2
votes
3answers
1k views
Foremost custom file type not accepted by -t argument
I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
2
votes
3answers
403 views
How to find out if my server is compromised?
I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
8answers
183 views
Learn as much as possible about the setup behind a website
Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model.
Is there a way to determine a bit the kind ...
1
vote
4answers
721 views
Linux backdoors I should be wary of
I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
1
vote
2answers
131 views
Malware : Identifying & Cleaning Malware on a LAMP site
EDIT : Further information / investigation information contained in the comments to this post
Apologies for the vague title - had trouble summarising this one.
I have recently discovered that one of ...
0
votes
2answers
88 views
Network shares that a Computer has connected to
I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ?
According to : Forensic Focus, it should be under
...
0
votes
3answers
1k views
How to calculate the starting address of a partition from MBR
Given a MBR and the structure of MBR/partition table, how can you calculate the size and starting address of each partition?
For clarification let's say I was given this-
Answer: There are ...
0
votes
2answers
252 views
Strange Items in Hosts File and Netstat
I ran a netstat -a on a computer and there were a number of strange items:
Proto Local Address Foreign Address State
TCP netgym:epmap virusin:0 LISTENING
...
0
votes
0answers
25 views
In Windows, when does a shutdown protect the data? [migrated]
I have a Windows 7 computer and I am doing some tests: instead of shutting down it properly through the menu shutdown command I switch off the power supply. At the next boot Windows shows the message:
...
0
votes
2answers
249 views
GREP REGEX Date for EnCase
I'm looking for a GREP REGEX for EnCase
03/03/02 @ 10:00:00
The point is looking for files that were created on that date.
