The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
50 views

Recover deleted commands from history?

If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?
1
vote
1answer
67 views

How to recover a shell script I deleted from a specific folder in Debian 7?

So in a merry mood last night, I deleted an important shell script from my system. I mistook it for something else and figured it wasn't needed. I am trying to recover it. I have tried 'scalpel' and ...
3
votes
1answer
75 views

Digital Photograph Forensics Software for Linux

Is there any forensics software that can handle digital Photograph for linux ? An opensource software is preferable
1
vote
0answers
219 views

Forensics on ipad .img wont mount in Kali

I am attempting to do some forensics on my iPad. I am following along with this article from sans.. on page 13 is the start of the Jailbreaking section...I would like to mount the image and then find ...
1
vote
2answers
392 views

How to acquire image of disk on Linux computer?

Pertaining to computer forensics, if the suspect's computer (which cannot be removed from the scene), is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk ...
1
vote
1answer
36 views

How are files or chunks delimited on disk?

I'm trying to recover some lost files by grep-scanning a hard disk. (The OS is Darwin 11.4.2. The file system is HFS.) How can I determine where a file (or contiguous chunk thereof) begins and ends ...
3
votes
1answer
55 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
4
votes
2answers
3k views

Mounting Disk Image in Raw format [duplicate]

While Trying to mount a disk image in Raw(dd) format using the following command mount nps-2010-emails.dd /media/manu/ I get the following error message mount: you must specify the filesystem ...
0
votes
1answer
60 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
10
votes
4answers
15k views

History of IP addresses that accesed a server via ssh

It has come to my attention that a server of mine has been hacked and infected with a known chinese botnet. It was a prototype/testing virtual machine with its own static IP(US address) so no harm ...
3
votes
1answer
9k views

How to dump memory image from linux system?

I know to dump memory images in Window. (eg-dumpit) But I don't know how to dump memory images in Linux. I wanna get memory images in Linux and from linux to linux with ssh connection or something. ...
1
vote
1answer
41 views

Different Kernel in /boot and the kernel built tree [closed]

I discovered after a binary comparision that my old kernel in /boot was different from the kernel that I had built and kept backed up in the kernel source tree. A while ago I also had a few ...
0
votes
2answers
39 views

Imaging a corrupted NTFS

I have an ext. drive with a corrupted NTFS (in the sense that NTFS-3G refuses to mount it). I really want to just take an image of the drive, stash that somewhere for later, and reformat the drive so ...
1
vote
0answers
41 views

Retrieve spanned archive from raw disk image

When I open the image in a hex editor, there is the header of a PK spanned archive (50 4B 07 08), then 4 more zip files following (50 4B). When copying the values and saving as a zip file, the ...
2
votes
1answer
256 views

Finding modified date and time of file from recovered disk image

Some jpeg files have been recovered from an image file of a floppy disk. Is there a way to get the modified, created and last accessed date and times of those files recovered, i.e. the time and date ...
3
votes
0answers
392 views

Foremost file naming - Recovery of file names from inodes

I'm hoping this is not a stupid question. (apologies if it is) I have been asked to recover some files from a corrupt Linux partition. The partition data is shot to pieces but i have been able to ...
1
vote
1answer
261 views

Accessing hidden partitions [closed]

I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
3
votes
3answers
775 views

How to make data-recovery very-very hard or impossible for Unix -computer before reselling?

I resell my Thinkpad and I want to make sure its old content in the harddrive is not readable. The Thinkpad has now Debian -installed but I sell it as-is so no OS needed. How can I can rewrite the ...
6
votes
2answers
1k views

UID of a deleted account

How can an administrator find the UID of a user that's been deleted with the userdel command?
3
votes
1answer
2k views

See if file has been copied to USB

Is there a way to see if a file has been copied to an USB drive? (Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the ...
5
votes
2answers
3k views

How to find the cause of an ssh-scan exploit?

One customer emailed my about their provider about to shut down a server because ssh attacks. I logged in to the server and found a lot of ssh-scan processes, and some strange files in /tmp. I had ...
3
votes
1answer
543 views

Capture and log GDB backtraces without stopping the process

First, a brief description of the situation: a computer sits hidden near a display in a gallery of some sort, acting as the silent workhorse for a piece. Despite its programmer's best intentions the ...
11
votes
2answers
7k views

How to investigate cause of total hang?

My Arch machine sometimes hangs, suddenly not responding in any way to the mouse or the keyboard. The cursor is frozen. Ctrl-Alt-Backsp won't stop X11, and ctrl-alt-del does exactly nothing. The ...
2
votes
3answers
1k views

Is there any chance that some of these processes are malicious?

My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers. There were a ...
11
votes
5answers
979 views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...
7
votes
2answers
744 views

How to find tty from which a particular cmd “scp” is executed

How can I find out who executed a particular command and which terminal was used to run it? Original: how can i know particular cmd is executed by whom and to know about my terminal