The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
83 views

How to acquire image of disk on Linux computer?

Pertaining to computer forensics, if the suspect's computer (which cannot be removed from the scene), is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk ...
1
vote
1answer
29 views

How are files or chunks delimited on disk?

I'm trying to recover some lost files by grep-scanning a hard disk. (The OS is Darwin 11.4.2. The file system is HFS.) How can I determine where a file (or contiguous chunk thereof) begins and ends ...
3
votes
1answer
52 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
3
votes
2answers
477 views

Mounting Disk Image in Raw format [duplicate]

While Trying to mount a disk image in Raw(dd) format using the following command mount nps-2010-emails.dd /media/manu/ I get the following error message mount: you must specify the filesystem ...
1
vote
0answers
60 views

Conversion of disk image from Encase (E01) to Raw format [closed]

I am trying to convert from EnCase to Raw format using instructions given on this page. The following takes place: manu@ubuntu:~/Downloads$ ewfexport nps-2010-emails.E01 The program 'ewfexport' is ...
0
votes
1answer
32 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
6
votes
4answers
771 views

History of IP addresses that accesed a server via ssh

It has come to my attention that a server of mine has been hacked and infected with a known chinese botnet. It was a prototype/testing virtual machine with its own static IP(US address) so no harm ...
2
votes
1answer
2k views

How to dump memory image from linux system?

I know to dump memory images in Window. (eg-dumpit) But I don't know how to dump memory images in Linux. I wanna get memory images in Linux and from linux to linux with ssh connection or something. ...
1
vote
1answer
38 views

Different Kernel in /boot and the kernel built tree [closed]

I discovered after a binary comparision that my old kernel in /boot was different from the kernel that I had built and kept backed up in the kernel source tree. A while ago I also had a few ...
0
votes
2answers
30 views

Imaging a corrupted NTFS

I have an ext. drive with a corrupted NTFS (in the sense that NTFS-3G refuses to mount it). I really want to just take an image of the drive, stash that somewhere for later, and reformat the drive so ...
1
vote
0answers
38 views

Retrieve spanned archive from raw disk image

When I open the image in a hex editor, there is the header of a PK spanned archive (50 4B 07 08), then 4 more zip files following (50 4B). When copying the values and saving as a zip file, the ...
2
votes
1answer
129 views

Finding modified date and time of file from recovered disk image

Some jpeg files have been recovered from an image file of a floppy disk. Is there a way to get the modified, created and last accessed date and times of those files recovered, i.e. the time and date ...
3
votes
0answers
258 views

Foremost file naming - Recovery of file names from inodes

I'm hoping this is not a stupid question. (apologies if it is) I have been asked to recover some files from a corrupt Linux partition. The partition data is shot to pieces but i have been able to ...
1
vote
1answer
201 views

Accessing hidden partitions [closed]

I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
3
votes
3answers
581 views

How to make data-recovery very-very hard or impossible for Unix -computer before reselling?

I resell my Thinkpad and I want to make sure its old content in the harddrive is not readable. The Thinkpad has now Debian -installed but I sell it as-is so no OS needed. How can I can rewrite the ...
6
votes
2answers
1k views

UID of a deleted account

How can an administrator find the UID of a user that's been deleted with the userdel command?
3
votes
1answer
2k views

See if file has been copied to USB

Is there a way to see if a file has been copied to an USB drive? (Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the ...
5
votes
2answers
2k views

How to find the cause of an ssh-scan exploit?

One customer emailed my about their provider about to shut down a server because ssh attacks. I logged in to the server and found a lot of ssh-scan processes, and some strange files in /tmp. I had ...
3
votes
1answer
493 views

Capture and log GDB backtraces without stopping the process

First, a brief description of the situation: a computer sits hidden near a display in a gallery of some sort, acting as the silent workhorse for a piece. Despite its programmer's best intentions the ...
9
votes
2answers
5k views

How to investigate cause of total hang?

My Arch machine sometimes hangs, suddenly not responding in any way to the mouse or the keyboard. The cursor is frozen. Ctrl-Alt-Backsp won't stop X11, and ctrl-alt-del does exactly nothing. The ...
2
votes
3answers
969 views

Is there any chance that some of these processes are malicious?

My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers. There were a ...
10
votes
5answers
873 views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...
7
votes
2answers
557 views

How to find tty from which a particular cmd “scp” is executed

How can I find out who executed a particular command and which terminal was used to run it? Original: how can i know particular cmd is executed by whom and to know about my terminal