Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [forensics]

The tag has no usage guidance.

0
votes
0answers
28 views

Reconstruct changes to the crontab and a directory over 5 Months

Is there any way to show who moved/deleted/restored files at a specific point in time on a linux server and who changed the crontab? Given the case described below, somebody or something either ...
0
votes
0answers
21 views

how i can make a custom command for selective copy for certain file type?

I want to write a command that allows me to copy certain file type (ex:*.PDF or *.doc) from unknown destination in the Hdd and paste them to a destination i choose it. Also could i copy the "path" of ...
1
vote
0answers
56 views

How to know the profile of a Linux memory dump with Volatility? [closed]

I have a Linux memory dump which I need to analyze in order to discover a suspicious PID, however I don't have a profile or anything outside the dump file and using volatility imageinfo doesn't work. ...
0
votes
1answer
356 views

extundelete - How to solve 'Block bitmap checksum does not match bitmap when trying to examine filesystem'?

The OS is Ubuntu 17.10 and I've been trying to recover(undelete) with extundelete. (The File System is ext4.) This didn't work. So, I tried with extundelete /dev/mapper/ubuntu--vg-root --restore-...
2
votes
0answers
362 views

Extract a running ELF from a memory dump

Our teacher gave us as homework a memory dump from a VBox (Ubuntu 16.04.9) and said that the message we need to get is printed by an ELF currently running in the VM. This is my what I get after ...
2
votes
0answers
23 views

Rescue image for PowerPC

I have a iMac G4 that doesn't boot, so I'd like to check the HDD for faulty sectors. Is there a PowerPC Linux image that features forensics tools like smartmontools and badblocks? There are plenty of ...
1
vote
2answers
83 views

Visualizing raw bits of disk

Is there a command that allows me to "see" the raw bits of a disk? In other words, to ignore the filesystem and output the "big picture" of the literal zeros and ones as per the disk. (Ideally not ...
2
votes
0answers
604 views

How to undelete a file on a btrfs filesystem

Which software and commands are required, to undelete a file on a btrfs filesystem?
1
vote
5answers
1k views

Legal alternative to Kali Linux for forensics [closed]

I would like to have a bootable USB drive to perform digital forensics (carving, undeleting etc.) in case I accidentally delete files from my personal computer. I know Kali Linux comes with an ...
1
vote
0answers
402 views

What is the difference between dd_rescue and ddrescue, when to prefer which one?

There are two similar tools for a dd on bad hardware: Kurt Garloff's dd_rescue GNU ddrescue What is the difference between dd_rescue and ddrescue, when to prefer which one?
-1
votes
1answer
138 views

DFF - Digital Forensic Framework console mode [closed]

I have a question about DFF - Digital Forensic Framework. More precisely, about its console mode. I know, that there is GUI mode, but i need console mode for using it via php in my web-application. ...
0
votes
1answer
41 views

Figuring out what caused a system hang

Over the past several hours I've had my Mint 18.2 system hang on me - twice during a Skype (64-bit) conversation, and a third time. Screen locks up, audio repeats a short pattern, no response to ...
11
votes
3answers
2k views

Who renamed a directory?

I couldn't find the answer to this anywhere. How can I know who renamed a directory? ls -al shows only the name of user who created that dirctory.
2
votes
2answers
789 views

Recovery of damaged DVD yielding “no medium found” error

I have a very strange case of DVD reading failure. It's a video DVD recorded a couple of years ago on a DVD-R disc. Two weeks ago our video DVD player would start having trouble reading parts of it. ...
0
votes
1answer
54 views

data recovery on image following https://help.ubuntu.com/community/DataRecovery

I made an image of an usb stick which was mistakenly made into a live usb with xubuntu in it. The unit is 8GB, the xubuntu.iso 1.3GB. I only want to work with the image and I think each command I try ...
1
vote
0answers
77 views

Question regarding hacked machine and special characters in filename

I'm doing a little bit of forensics on a machine that has apparently been hacked. (Thanks, systemd and your resolv buffer overflow thing. That was awesome. :/ ) Anyhow, I have a pair of 0-length ...
0
votes
1answer
148 views

Unix - way to see all files that recently got permissions changed

What is a way to see all files in a current directory that got recently permissions changed? Or, another approach to my problem is, what is a way to see how many times a file got permissions changed?...
3
votes
1answer
136 views

How to create a consistent forensic image from a live RHEL system?

In our environment we have RHEL7 systems that need to be always up and running. I know the preferred method of acquiring a forensic image is to take the system offline, but in case of a live image, ...
1
vote
2answers
808 views

How to get info on a dead process that was listening on a particular port?

There is a process that I know was listening on a certain port that is no longer running. I would like to know when it stopped running, if it crashed, or any other info about that process. Is there ...
1
vote
1answer
81 views

Forensic - How to get a docker image without “export” command

For the purpose of a forensic mission, we must get a docker image without using the famous export from a docker command. Does copy and paste of the folder /var/lib/docker/containers in another server ...
1
vote
1answer
446 views

How to scan a hard disk at low level to recover files in partially overwritten partition?

We had a human accident at home and an external hard disk was copied a SD 32gb image card by mistake. The copy should be done to a SD image. I guess 32gb of the external drive were overwritten, but ...
3
votes
0answers
129 views

ddrescue a drive

Background: I have attempted to rescue a drive which seems to have corruptions using the following commands: ddrescue --no-split /dev/hda1 imagefile logfile ddrescue --direct --retry-passes=3 /dev/...
1
vote
1answer
388 views

How to view process history to analyse the memory bottleneck?

Yesterday my billing db got crashed due to high memory usage. Now would like to see what are all the processes running when the db got crashed. Is there any way to look into this ? Please help..
1
vote
3answers
109 views

What is happening when I read a corrupt optical media with dd and it's really slow?

I have a DVD that I can't rip or copy using regular commands. If I try to copy it it will first copy at normal speed, but then slow down and take a very long while to do seemingly nothing. Right now ...
1
vote
1answer
655 views

Accessing /dev/mem freezes Ubuntu

I am using the latest Ubuntu Linux with a custom kernel (4.2.0-36-generic), in which I have disabled the CONFIG_STRICT_DEVNEM, because I need to dump and search some terms in memory during a project. ...
0
votes
0answers
91 views

Restore deleted file after formating disk and change the partition type

I have a hd 1tb that was installed ubuntu. I had to install windows 10 but the partition was gpt. And the windows only supports MBR. So I made the ubuntu backup, turned the disk MBR in the diskpart ...
1
vote
0answers
1k views

Recover overwritten CCTV footage from hard drive

I am trying to recover deleted footage from a DVR. I pulled the hdd(Toshiba DT01ABA100v) from the DVR to look at the data in the drive and run carving tools(foremost and scalpel). My problem is that I ...
0
votes
1answer
540 views

How to determine kernel version from linux vm snapshot

I am having trouble figuring out how to determine the linux kernel version by analyzing a memory snapshot from a linux VM. I have used hexdump to examine the binary but can't find anything that would ...
3
votes
3answers
620 views

How can I see which process hangs my Banana-pi for few seconds every couple of minutes?

Answer I fixed my "freezes" by turning autoneg of (ethtool -s eth0 duplex full autoneg off). How I found this Every time after a freeze, monitoring disk I/O with the help of the post below, I saw ...
1
vote
1answer
4k views

Recover deleted commands from history?

If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?
2
votes
1answer
983 views

How to recover a shell script I deleted from a specific folder in Debian 7?

So in a merry mood last night, I deleted an important shell script from my system. I mistook it for something else and figured it wasn't needed. I am trying to recover it. I have tried 'scalpel' and '...
3
votes
2answers
711 views

Digital Photograph Forensics Software for Linux [closed]

Is there any forensics software that can handle digital Photograph for linux ? An opensource software is preferable
1
vote
2answers
770 views

Forensics on ipad .img wont mount in Kali

I am attempting to do some forensics on my iPad. I am following along with this article from sans.. on page 13 is the start of the Jailbreaking section...I would like to mount the image and then find ...
2
votes
2answers
2k views

How to acquire image of disk on Linux computer?

Pertaining to computer forensics, if the suspect's computer (which cannot be removed from the scene), is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk ...
1
vote
1answer
93 views

How are files or chunks delimited on disk?

I'm trying to recover some lost files by grep-scanning a hard disk. (The OS is Darwin 11.4.2. The file system is HFS.) How can I determine where a file (or contiguous chunk thereof) begins and ends ...
3
votes
1answer
67 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
4
votes
2answers
12k views

Mounting Disk Image in Raw format [duplicate]

While Trying to mount a disk image in Raw(dd) format using the following command mount nps-2010-emails.dd /media/manu/ I get the following error message mount: you must specify the filesystem ...
1
vote
1answer
414 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
33
votes
6answers
148k views

History of IP addresses that accesed a server via ssh

It has come to my attention that a server of mine has been hacked and infected with a known chinese botnet. It was a prototype/testing virtual machine with its own static IP(US address) so no harm ...
16
votes
3answers
58k views

How to dump memory image from linux system?

I know to dump memory images in Windows. (eg-dumpit) But I don't know how to dump memory images in Linux. I want to get memory images in Linux and from Linux to Linux with ssh connection or something....
0
votes
2answers
138 views

Imaging a corrupted NTFS

I have an ext. drive with a corrupted NTFS (in the sense that NTFS-3G refuses to mount it). I really want to just take an image of the drive, stash that somewhere for later, and reformat the drive so ...
2
votes
1answer
935 views

Finding modified date and time of file from recovered disk image

Some jpeg files have been recovered from an image file of a floppy disk. Is there a way to get the modified, created and last accessed date and times of those files recovered, i.e. the time and date ...
3
votes
0answers
1k views

Foremost file naming - Recovery of file names from inodes

I have been asked to recover some files from a corrupt Linux partition. The partition data is shot to pieces but i have been able to locate the file names and the associated Inode number. Using ...
4
votes
3answers
1k views

How to make data-recovery very-very hard or impossible for Unix -computer before reselling?

I resell my Thinkpad and I want to make sure its old content in the harddrive is not readable. The Thinkpad has now Debian -installed but I sell it as-is so no OS needed. How can I can rewrite the ...
6
votes
2answers
4k views

UID of a deleted account

How can an administrator find the UID of a user that's been deleted with the userdel command?
3
votes
1answer
3k views

See if file has been copied to USB

Is there a way to see if a file has been copied to an USB drive? (Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the ...
6
votes
2answers
5k views

How to find the cause of an ssh-scan exploit?

One customer emailed my about their provider about to shut down a server because ssh attacks. I logged in to the server and found a lot of ssh-scan processes, and some strange files in /tmp. I had ...
5
votes
1answer
835 views

Capture and log GDB backtraces without stopping the process

First, a brief description of the situation: a computer sits hidden near a display in a gallery of some sort, acting as the silent workhorse for a piece. Despite its programmer's best intentions the ...
17
votes
2answers
16k views

How to investigate cause of total hang?

My Arch machine sometimes hangs, suddenly not responding in any way to the mouse or the keyboard. The cursor is frozen. Ctrl-Alt-Backsp won't stop X11, and ctrl-alt-del does exactly nothing. The ...
3
votes
3answers
3k views

Is there any chance that some of these processes are malicious?

My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers. There were a ...