Questions tagged [forensic-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
2answers
44 views

Virtual machine memory space forensics

in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either ...
0
votes
1answer
47 views

Examine contents of unused space on the HDD

When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical ...
2
votes
2answers
322 views

Sending ESXi Snapshot to 3rd party forensics team

We recently had a couple security events occur and we immediately took a snapshot of the VM as we wanted to preserve as much of the data as we could. Now we would like to send it to a 3rd party ...
0
votes
2answers
106 views

How can I analyze an encrypted HDD?

I have a HDD which I encrypted few years ago but I can't remember the tool I used. How can I find out if I have used TrueCrypt or VeraCrypt to encrypt my hard drive? Thanks.
0
votes
3answers
933 views

How to mount the dd image of a swap file

I have several dd images from a single drive. One of them is the swap. I mounted all of the images in Ubuntu just fine except for the image of the swap. This is how the dd images break down: hda8 is /,...
3
votes
1answer
561 views

How to disable automatic garbage collection on an SSD?

Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered automatically by the drive via a TRIM command sent by the OS Is there ...
1
vote
1answer
1k views

Finding email read times on exchange server

I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
1
vote
2answers
1k views

What are my options with a downloaded Rackspace cloud image?

I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local ...
11
votes
2answers
7k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory (...
0
votes
2answers
377 views

What logs should I check after a break-in?

I've asked this same question on superuser but I didn't have that much succes. I'd like to learn more about forensic analysis, and I'm doing the challenges from Project Honeynet. I need to check the ...
15
votes
8answers
5k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...