Questions tagged [forensics]
The forensics tag has no usage guidance.
40
questions
0
votes
0
answers
22
views
Server trying to connect to Spamhaus DROP networks
I have a small Ubuntu mail/web server running an outbound proxy server and also recently using the Spamhaus DROP lists to block connections from and to the networks listed in those.
I see almost as ...
1
vote
1
answer
76
views
Apache2 ForensicLog timestamp
I'm using apache2 with ForensicLog enabled by this directive below.
ForensicLog ${APACHE_LOG_DIR}/mysite.com.forensic.log
When I check the "mysite.com.forensic.log" file there is no ...
10
votes
2
answers
14k
views
How to determine which file/inode occupies a given sector
I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3):
[ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code
[...
8
votes
1
answer
3k
views
Forensic Analysis of the OOM-Killer
Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others.
I've managed to learn what the OOM Killer is, and about its "badness" ...
0
votes
0
answers
201
views
The date modified of a deleted file in a disk image is having a later date than the last system Log On date
I am analyzing a disk image for a forensic investigation and I see deleted files having a later date for last modified date than the last system log on date.
Does this means someone has created a raw ...
10
votes
4
answers
4k
views
How to perform remotely a kill-switch on Windows 7?
I need to remotely perform a kill-switch on a Windows 7 Enterprise computer connected to an AD. Specifically, I need to
remotely access the machine without visible user interaction (I have a domain ...
1
vote
1
answer
1k
views
How to analyze cause of postfix server sending spam
A client of mine has a server hosting postfix as well as nginx with several websites, including an nginx installation with several subdomains / websites.
Since a couple of days the /var/spool/postfix ...
0
votes
1
answer
396
views
cloning NTFS disk
I need to clone a failing 2TB disk that contains a NTFS partition, using Debian GNU/Linux. The disk has a number of non-relocatable bad sectors, so I know that part of the data is already lost; ...
0
votes
1
answer
562
views
azure attach read only disk
i am running forensic experiment on azure and need to use one machine for the experiment and a different machine for the looking at the content. the experiments rely on registry and other elements and ...
0
votes
1
answer
30
views
Does azure VM disk contain information about the subscription?
I'm creating Azure VM with a single drive (IS drive) and creating an image (EO1) of the drive for some testing I am doing. I need to share the image with the client. Will the image contain any ...
4
votes
1
answer
867
views
How to disable automatic garbage collection on an SSD?
Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered
automatically by the drive
via a TRIM command sent by the OS
Is there ...
4
votes
2
answers
989
views
Virtual machine memory space forensics
in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either ...
0
votes
1
answer
471
views
Can I find username login log in Active directory server?
I join computer into active directory(AD) domian. User in AD can login to computer by using username, password in AD. Computer was install deep freeze so it can not keep anything after restart. I ...
2
votes
2
answers
1k
views
Sending ESXi Snapshot to 3rd party forensics team
We recently had a couple security events occur and we immediately took a snapshot of the VM as we wanted to preserve as much of the data as we could. Now we would like to send it to a 3rd party ...
0
votes
1
answer
70
views
Examine contents of unused space on the HDD
When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical ...
0
votes
1
answer
357
views
Extract list of installed drivers using a linux live disk
I have a quit old PC that was running Windows 2000 but the system crashed some days ago. Now I need to know which drivers have been installed on that specific pc but the system isn't booting anymore ...
0
votes
2
answers
660
views
Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm
I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these
lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data
Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:...
0
votes
2
answers
1k
views
Partition-table on one disk from RAID always equal to partition-table configured for RAID?
Are partition-tables from hard-drives, that are part of a RAID (no matter of what kind of RAID) always equal to the partition-table configured for the RAID?
What is clear:
A machine has a RAID 1 with ...
3
votes
1
answer
2k
views
Recover ZFS deleted file names [closed]
I have to work on server with ZFS file system to recover deleted file names or recover actual files. I have very basic knowledge about ZFS and couldn't find easy way to achieve this. I just wonder if ...
6
votes
2
answers
4k
views
rsnapshot diff between snapshots
I am using rsnapshot to manage incremental backups of some GNU/Linux servers.
Although rsnapshot is delivered with a tool called rsnapshot-diff it just provide disk space statistics.
The question is ...
-1
votes
1
answer
36
views
Retrieving the search keywords from a search result entry (Google)
Is it possible to go back to the actual google query string given one or more URL results?
for example, if I do a search using the keyword "pippo" I get this first entry:
http://www.google.it/url?sa=...
1
vote
1
answer
1k
views
Finding email read times on exchange server
I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
0
votes
2
answers
195
views
Forensics on tons of file changes [closed]
It has come to my attention that my CentOS 5.6 5.11 VPS has over 16,000 files with a timestamp during a 3-day period in September this year. I can't figure out why that is, as I did not log in via SSH ...
0
votes
0
answers
166
views
Trace IP traffic to physical machine under Linux
In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine ...
0
votes
1
answer
620
views
Helpful linux command for do some forensic on compromised linux web server [duplicate]
What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
0
votes
2
answers
9k
views
FTK Image to VMDK
It seems that most of the posts I can find show me how to take a VMDK and convert it to an FTK Image for processing. I'd like to go the other way, and get a bootable VMWare image.
I've found the ...
12
votes
1
answer
51k
views
Administrator view ALL mapped drives
In my understanding of security, an administrator should be able to view all connections to and from a computer - just as they can view all processes/owner, network connections/owning process. ...
1
vote
2
answers
3k
views
Malware : Identifying & Cleaning Malware on a LAMP site
EDIT : Further information / investigation information contained in the comments to this post
Apologies for the vague title - had trouble summarising this one.
I have recently discovered that one of ...
6
votes
3
answers
13k
views
Foremost custom file type not accepted by -t argument
I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
2
votes
1
answer
277
views
Forensics on Virtual Private servers [closed]
So these days with talks about having hacked machines being used for malware spreading and botnet C&C, the one issue that is not clear to me is what do the law enforcement agencies do once they ...
0
votes
2
answers
6k
views
Network shares that a Computer has connected to
I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ?
According to : Forensic Focus, it should be under
...
56
votes
2
answers
3k
views
Mysterious visitor to hidden PHP page
On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
3
votes
3
answers
22k
views
How to calculate the starting address of a partition from MBR
Given a MBR and the structure of MBR/partition table, how can you calculate the size and starting address of each partition?
For clarification let's say I was given this-
Answer: There are three ...
2
votes
1
answer
2k
views
Find the source of malware?
I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
2
answers
1k
views
Strange Items in Hosts File and Netstat
I ran a netstat -a on a computer and there were a number of strange items:
Proto Local Address Foreign Address State
TCP netgym:epmap virusin:0 LISTENING
...
6
votes
3
answers
8k
views
Find IP address of a device?
Open question: How to find the IP address of a device?
As I understand, there are no guaranteed methods that work always, but there's a hundred approaches that work in specific situations, and I'd ...
1
vote
8
answers
201
views
Learn as much as possible about the setup behind a website
Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model.
Is there a way to determine a bit the kind ...
10
votes
3
answers
2k
views
Website defaced, what can I do?
My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong?
I mean what to look out for among all those ...
2
votes
3
answers
551
views
How to find out if my server is compromised?
I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4
answers
1k
views
Linux backdoors I should be wary of
I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...