Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

The date modified of a deleted file in a disk image is having a later date than the last system Log On date

I am analyzing a disk image for a forensic investigation and I see deleted files having a later date for last modified date than the last system log on date. Does this means someone has created a raw ...
1
vote
1answer
97 views

How to analyze cause of postfix server sending spam

A client of mine has a server hosting postfix as well as nginx with several websites, including an nginx installation with several subdomains / websites. Since a couple of days the /var/spool/postfix ...
0
votes
0answers
29 views

Debugging OOM (core dump?) [duplicate]

I'm working on a piece of server software. Usually it runs with RSS ~250 megabytes, but occasionally gets killed by the OOM, and looking at kernel log, it happens when the RSS grows to about 700 ...
0
votes
1answer
24 views

Does azure VM disk contain information about the subscription?

I'm creating Azure VM with a single drive (IS drive) and creating an image (EO1) of the drive for some testing I am doing. I need to share the image with the client. Will the image contain any ...
0
votes
1answer
47 views

azure attach read only disk

i am running forensic experiment on azure and need to use one machine for the experiment and a different machine for the looking at the content. the experiments rely on registry and other elements and ...
0
votes
1answer
123 views

cloning NTFS disk

I need to clone a failing 2TB disk that contains a NTFS partition, using Debian GNU/Linux. The disk has a number of non-relocatable bad sectors, so I know that part of the data is already lost; ...
4
votes
2answers
361 views

Virtual machine memory space forensics

in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either ...
0
votes
1answer
91 views

Can I find username login log in Active directory server?

I join computer into active directory(AD) domian. User in AD can login to computer by using username, password in AD. Computer was install deep freeze so it can not keep anything after restart. I ...
0
votes
1answer
53 views

Examine contents of unused space on the HDD

When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical ...
2
votes
2answers
760 views

Sending ESXi Snapshot to 3rd party forensics team

We recently had a couple security events occur and we immediately took a snapshot of the VM as we wanted to preserve as much of the data as we could. Now we would like to send it to a 3rd party ...
0
votes
2answers
754 views

Partition-table on one disk from RAID always equal to partition-table configured for RAID?

Are partition-tables from hard-drives, that are part of a RAID (no matter of what kind of RAID) always equal to the partition-table configured for the RAID? What is clear: A machine has a RAID 1 with ...
2
votes
1answer
1k views

Recover ZFS deleted file names [closed]

I have to work on server with ZFS file system to recover deleted file names or recover actual files. I have very basic knowledge about ZFS and couldn't find easy way to achieve this. I just wonder if ...
0
votes
1answer
175 views

Extract list of installed drivers using a linux live disk

I have a quit old PC that was running Windows 2000 but the system crashed some days ago. Now I need to know which drivers have been installed on that specific pc but the system isn't booting anymore ...
10
votes
4answers
3k views

How to perform remotely a kill-switch on Windows 7?

I need to remotely perform a kill-switch on a Windows 7 Enterprise computer connected to an AD. Specifically, I need to remotely access the machine without visible user interaction (I have a domain ...
3
votes
1answer
626 views

How to disable automatic garbage collection on an SSD?

Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered automatically by the drive via a TRIM command sent by the OS Is there ...
-1
votes
1answer
24 views

Retrieving the search keywords from a search result entry (Google)

Is it possible to go back to the actual google query string given one or more URL results? for example, if I do a search using the keyword "pippo" I get this first entry: http://www.google.it/url?sa=...
1
vote
1answer
1k views

Finding email read times on exchange server

I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open ...
0
votes
2answers
164 views

Forensics on tons of file changes [closed]

It has come to my attention that my CentOS 5.6 5.11 VPS has over 16,000 files with a timestamp during a 3-day period in September this year. I can't figure out why that is, as I did not log in via SSH ...
0
votes
0answers
162 views

Trace IP traffic to physical machine under Linux

In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine ...
5
votes
2answers
3k views

rsnapshot diff between snapshots

I am using rsnapshot to manage incremental backups of some GNU/Linux servers. Although rsnapshot is delivered with a tool called rsnapshot-diff it just provide disk space statistics. The question is ...
0
votes
1answer
566 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
12
votes
1answer
45k views

Administrator view ALL mapped drives

In my understanding of security, an administrator should be able to view all connections to and from a computer - just as they can view all processes/owner, network connections/owning process. ...
0
votes
2answers
533 views

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:...
0
votes
2answers
7k views

FTK Image to VMDK

It seems that most of the posts I can find show me how to take a VMDK and convert it to an FTK Image for processing. I'd like to go the other way, and get a bootable VMWare image. I've found the ...
1
vote
2answers
3k views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
2
votes
1answer
231 views

Forensics on Virtual Private servers [closed]

So these days with talks about having hacked machines being used for malware spreading and botnet C&C, the one issue that is not clear to me is what do the law enforcement agencies do once they ...
0
votes
2answers
4k views

Network shares that a Computer has connected to

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ? According to : Forensic Focus, it should be under ...
56
votes
2answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
2
votes
3answers
17k views

How to calculate the starting address of a partition from MBR

Given a MBR and the structure of MBR/partition table, how can you calculate the size and starting address of each partition? For clarification let's say I was given this- Answer: There are three ...
9
votes
2answers
11k views

How to determine which file/inode occupies a given sector

I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3): [ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code [...
0
votes
2answers
831 views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...
6
votes
3answers
11k views

Foremost custom file type not accepted by -t argument

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
6
votes
3answers
7k views

Find IP address of a device?

Open question: How to find the IP address of a device? As I understand, there are no guaranteed methods that work always, but there's a hundred approaches that work in specific situations, and I'd ...
2
votes
1answer
2k views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
10
votes
3answers
2k views

Website defaced, what can I do?

My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong? I mean what to look out for among all those ...
7
votes
1answer
2k views

Forensic Analysis of the OOM-Killer

Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others. I've managed to learn what the OOM Killer is, and about its "badness" ...
2
votes
3answers
497 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
1k views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
1
vote
8answers
195 views

Learn as much as possible about the setup behind a website

Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model. Is there a way to determine a bit the kind ...