The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
1answer
150 views

Digital Photograph Forensics Software for Linux

Is there any forensics software that can handle digital Photograph for linux ? An opensource software is preferable
1
vote
1answer
150 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
0
votes
1answer
61 views

How to determine kernel version from linux vm snapshot

I am having trouble figuring out how to determine the linux kernel version by analyzing a memory snapshot from a linux VM. I have used hexdump to examine the binary but can't find anything that would ...
3
votes
0answers
625 views

Foremost file naming - Recovery of file names from inodes

I'm hoping this is not a stupid question. (apologies if it is) I have been asked to recover some files from a corrupt Linux partition. The partition data is shot to pieces but i have been able to ...
1
vote
0answers
386 views

Forensics on ipad .img wont mount in Kali

I am attempting to do some forensics on my iPad. I am following along with this article from sans.. on page 13 is the start of the Jailbreaking section...I would like to mount the image and then find ...
1
vote
0answers
56 views

Retrieve spanned archive from raw disk image

When I open the image in a hex editor, there is the header of a PK spanned archive (50 4B 07 08), then 4 more zip files following (50 4B). When copying the values and saving as a zip file, the ...
0
votes
0answers
39 views

FORENSIC PURPOSE - Acquire Android image using flash drive OTG

In Linux, the dd command is used to pull the image from the smartphone to computer. And of course, the smartphone need to be rooted before the dd command launched.From the research i do and multi hand ...
0
votes
0answers
169 views

Dump XEN guest memory image

I am new into memory forensics thing and I am trying to dump a memory image from a XEN guest (Ubuntu 12.04 x64 - domU) in order to analyze it on dom0 (Ubuntu server 12.04 x64) with volatility . For ...