Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Server trying to connect to Spamhaus DROP networks

I have a small Ubuntu mail/web server running an outbound proxy server and also recently using the Spamhaus DROP lists to block connections from and to the networks listed in those. I see almost as ...
TommyPeanuts's user avatar
1 vote
1 answer
79 views

Apache2 ForensicLog timestamp

I'm using apache2 with ForensicLog enabled by this directive below. ForensicLog ${APACHE_LOG_DIR}/mysite.com.forensic.log When I check the "mysite.com.forensic.log" file there is no ...
rasputin's user avatar
  • 135
0 votes
0 answers
202 views

The date modified of a deleted file in a disk image is having a later date than the last system Log On date

I am analyzing a disk image for a forensic investigation and I see deleted files having a later date for last modified date than the last system log on date. Does this means someone has created a raw ...
ragn3r's user avatar
  • 1
1 vote
1 answer
1k views

How to analyze cause of postfix server sending spam

A client of mine has a server hosting postfix as well as nginx with several websites, including an nginx installation with several subdomains / websites. Since a couple of days the /var/spool/postfix ...
user1192748's user avatar
0 votes
1 answer
30 views

Does azure VM disk contain information about the subscription?

I'm creating Azure VM with a single drive (IS drive) and creating an image (EO1) of the drive for some testing I am doing. I need to share the image with the client. Will the image contain any ...
Parsifal15's user avatar
0 votes
1 answer
569 views

azure attach read only disk

i am running forensic experiment on azure and need to use one machine for the experiment and a different machine for the looking at the content. the experiments rely on registry and other elements and ...
Parsifal15's user avatar
0 votes
1 answer
398 views

cloning NTFS disk

I need to clone a failing 2TB disk that contains a NTFS partition, using Debian GNU/Linux. The disk has a number of non-relocatable bad sectors, so I know that part of the data is already lost; ...
Lucio Crusca's user avatar
4 votes
2 answers
1k views

Virtual machine memory space forensics

in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either ...
bbanelli's user avatar
0 votes
1 answer
492 views

Can I find username login log in Active directory server?

I join computer into active directory(AD) domian. User in AD can login to computer by using username, password in AD. Computer was install deep freeze so it can not keep anything after restart. I ...
user572575's user avatar
0 votes
1 answer
71 views

Examine contents of unused space on the HDD

When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical ...
cnst's user avatar
  • 14.3k
2 votes
2 answers
1k views

Sending ESXi Snapshot to 3rd party forensics team

We recently had a couple security events occur and we immediately took a snapshot of the VM as we wanted to preserve as much of the data as we could. Now we would like to send it to a 3rd party ...
brittonballard's user avatar
0 votes
2 answers
1k views

Partition-table on one disk from RAID always equal to partition-table configured for RAID?

Are partition-tables from hard-drives, that are part of a RAID (no matter of what kind of RAID) always equal to the partition-table configured for the RAID? What is clear: A machine has a RAID 1 with ...
edi38's user avatar
  • 1
3 votes
1 answer
2k views

Recover ZFS deleted file names [closed]

I have to work on server with ZFS file system to recover deleted file names or recover actual files. I have very basic knowledge about ZFS and couldn't find easy way to achieve this. I just wonder if ...
Mariam S's user avatar
0 votes
1 answer
358 views

Extract list of installed drivers using a linux live disk

I have a quit old PC that was running Windows 2000 but the system crashed some days ago. Now I need to know which drivers have been installed on that specific pc but the system isn't booting anymore ...
davidb's user avatar
  • 246
10 votes
4 answers
4k views

How to perform remotely a kill-switch on Windows 7?

I need to remotely perform a kill-switch on a Windows 7 Enterprise computer connected to an AD. Specifically, I need to remotely access the machine without visible user interaction (I have a domain ...
dareils's user avatar
  • 119
4 votes
1 answer
870 views

How to disable automatic garbage collection on an SSD?

Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered automatically by the drive via a TRIM command sent by the OS Is there ...
WoJ's user avatar
  • 3,657
-1 votes
1 answer
37 views

Retrieving the search keywords from a search result entry (Google)

Is it possible to go back to the actual google query string given one or more URL results? for example, if I do a search using the keyword "pippo" I get this first entry: http://www.google.it/url?sa=...
Niugeo's user avatar
  • 1
1 vote
1 answer
1k views

Finding email read times on exchange server

I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
Shmuel Levine's user avatar
0 votes
2 answers
196 views

Forensics on tons of file changes [closed]

It has come to my attention that my CentOS 5.6 5.11 VPS has over 16,000 files with a timestamp during a 3-day period in September this year. I can't figure out why that is, as I did not log in via SSH ...
OsakaWebbie's user avatar
0 votes
0 answers
166 views

Trace IP traffic to physical machine under Linux

In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine ...
Lars Hanke's user avatar
6 votes
2 answers
4k views

rsnapshot diff between snapshots

I am using rsnapshot to manage incremental backups of some GNU/Linux servers. Although rsnapshot is delivered with a tool called rsnapshot-diff it just provide disk space statistics. The question is ...
Angus Macyver's user avatar
0 votes
1 answer
620 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
Yuda Prawira's user avatar
12 votes
1 answer
51k views

Administrator view ALL mapped drives

In my understanding of security, an administrator should be able to view all connections to and from a computer - just as they can view all processes/owner, network connections/owning process. ...
jeubank12's user avatar
  • 221
0 votes
2 answers
661 views

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:...
alfish's user avatar
  • 3,147
0 votes
2 answers
9k views

FTK Image to VMDK

It seems that most of the posts I can find show me how to take a VMDK and convert it to an FTK Image for processing. I'd like to go the other way, and get a bootable VMWare image. I've found the ...
omghai2u's user avatar
  • 315
1 vote
2 answers
3k views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
MrEyes's user avatar
  • 313
2 votes
1 answer
279 views

Forensics on Virtual Private servers [closed]

So these days with talks about having hacked machines being used for malware spreading and botnet C&C, the one issue that is not clear to me is what do the law enforcement agencies do once they ...
intiha's user avatar
  • 123
0 votes
2 answers
7k views

Network shares that a Computer has connected to

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ? According to : Forensic Focus, it should be under ...
thugzclub's user avatar
56 votes
2 answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
Bill's user avatar
  • 603
3 votes
3 answers
22k views

How to calculate the starting address of a partition from MBR

Given a MBR and the structure of MBR/partition table, how can you calculate the size and starting address of each partition? For clarification let's say I was given this- Answer: There are three ...
에이바's user avatar
  • 662
10 votes
2 answers
14k views

How to determine which file/inode occupies a given sector

I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3): [ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code [...
krlmlr's user avatar
  • 533
0 votes
2 answers
1k views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...
JMC's user avatar
  • 506
6 votes
3 answers
13k views

Foremost custom file type not accepted by -t argument

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
user avatar
6 votes
3 answers
8k views

Find IP address of a device?

Open question: How to find the IP address of a device? As I understand, there are no guaranteed methods that work always, but there's a hundred approaches that work in specific situations, and I'd ...
2 votes
1 answer
2k views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
jps's user avatar
  • 123
10 votes
3 answers
2k views

Website defaced, what can I do?

My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong? I mean what to look out for among all those ...
SteD's user avatar
  • 225
8 votes
1 answer
3k views

Forensic Analysis of the OOM-Killer

Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others. I've managed to learn what the OOM Killer is, and about its "badness" ...
Oddthinking's user avatar
2 votes
3 answers
552 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
user avatar
1 vote
4 answers
1k views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
Ben's user avatar
  • 3,880
1 vote
8 answers
202 views

Learn as much as possible about the setup behind a website

Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model. Is there a way to determine a bit the kind ...
carrier's user avatar
  • 292