The forensics tag has no wiki summary.
1
vote
1answer
76 views
Accessing hidden partitions [closed]
I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
8
votes
2answers
2k views
How to investigate cause of total hang?
My Arch machine sometimes hangs, suddenly not responding in any way to the mouse or the keyboard. The cursor is frozen. Ctrl-Alt-Backsp won't stop X11, and ctrl-alt-del does exactly nothing. The ...
9
votes
5answers
698 views
Monitoring activity on my computer.
So recently I found that someone has been using my computer without consent, browsing folders, etc....
I could change all my passwords straight away, but I'm curious as the what the intruding party ...
2
votes
3answers
186 views
How to make data-recovery very-very hard or impossible for Unix -computer before reselling?
I resell my Thinkpad and I want to make sure its old content in the harddrive is not readable. The Thinkpad has now Debian -installed but I sell it as-is so no OS needed. How can I can rewrite the ...
6
votes
2answers
476 views
UID of a deleted account
How can an administrator find the UID of a user that's been deleted with the userdel command?
3
votes
1answer
846 views
See if file has been copied to USB
Is there a way to see if a file has been copied to an USB drive?
(Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the ...
5
votes
2answers
754 views
How to find the cause of an ssh-scan exploit?
One customer emailed my about their provider about to shut down a server because ssh attacks.
I logged in to the server and found a lot of ssh-scan processes, and some strange files in /tmp.
I had ...
6
votes
2answers
271 views
How to find tty from which a particular cmd “scp” is executed
How can I find out who executed a particular command and which terminal was used to run it?
Original:
how can i know particular cmd is executed by whom and to know about my terminal
3
votes
1answer
331 views
Capture and log GDB backtraces without stopping the process
First, a brief description of the situation: a computer sits hidden near a display in a gallery of some sort, acting as the silent workhorse for a piece. Despite its programmer's best intentions the ...
2
votes
3answers
627 views
Is there any chance that some of these processes are malicious?
My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers.
There were a ...
