Questions tagged [forensics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
228 views

Calculating the block offset

I need to overwrite certain files in a raw disk image without modifying the disk image too much. Ideally, only certain strings should be overwritten, but this will probably not be possible. That is ...
unrealwombat's user avatar
0 votes
0 answers
721 views

Searching strings in raw disk image

I am currently writing a tool that should scan a readonly raw disk image for a a given pattern. The task is to get the byte offset of the match. I am able to find simple text documents with grep -a -o ...
unrealwombat's user avatar
2 votes
1 answer
589 views

Tracing actions by user on a shared SSH key access

Imagine we have a shared ssh key/(username & password) between two users, We call them Bob and Alice. Bob has connected to the server and has executed some chain of commands that led to the ...
A.R.H's user avatar
  • 121
0 votes
1 answer
113 views

RabbitMQ, SCP in Linux dropping connections

In GNU/Linux I have an issue with an application I have made. It works in my development environment, most of the components running in dockers or natively, but it randomly (often, but not always) ...
xCovelus's user avatar
  • 205
1 vote
1 answer
5k views

Fix/Repair Can't find a SQUASHFS superblock

I have an old filesystem backup that I made and compressed into a squashfs. It was stored on an ext4 filesystem, and I suspect it suffered from some bitrot. I don't have a backup of the file. Is there ...
Rucent88's user avatar
  • 1,870
0 votes
1 answer
110 views

Why does drive image show different start partition free size?

I made an image of /dev/sdc. The free space before the first partition isn't reporting the same byte sizes, but why? The start position is reported as 1024B on the drive and 16384B on the image? # ...
Rucent88's user avatar
  • 1,870
1 vote
1 answer
792 views

LUKS-LVM partition resize problems

I have a concerning adventure while trying to resize(shrink) my LUKS lvm partition. I wanted to shrink my partition so that I can easily copy my system to a new smaller sized drive. Before I started ...
VGe0rge's user avatar
  • 549
-1 votes
1 answer
895 views

How to recover accidently deleted files from RedHat file server

one of my friend accidently deleted all files (jpg and pdf) from file server by using rm -rf command .is there is a way to recover those files with actual file names? key points - there is no backups ...
KMS's user avatar
  • 1
1 vote
1 answer
475 views

full read-only mount setting for BTRFS

I need to mount a BTRFS partition in 100% read-only mode, i.e. no hidden writes onto the disk whatsoever. The "ro" setting is not enough. I tried some settings. The settings "ro,...
Yacov's user avatar
  • 11
0 votes
0 answers
468 views

Recover files from accidently formatted NTFS dd image by Magic Bytes?

I have an dd image of a partition that once had a Windows 10 NTFS filesystem and then got accidentally formatted (or so I assume) and now has a pretty empty NTFS with only an empty Windows directory ...
lathspell's user avatar
  • 745
0 votes
2 answers
361 views

If files are copied from a first volume to a second volume, will the files stay the same?

When I connect the external hard drives to my computer(with FreeBSD or other Unix systems) and copy files from the first external hard drive to the second hard drive, are the files on the second hard ...
johnf's user avatar
  • 1
3 votes
4 answers
785 views

Find pattern on multiple lines within BIG log files

To investigate within logs, I am trying to find the very first time a vulnerability in a workflow has been exploited. The pattern is on multiple lines. The pattern would be AAAAAAAAA BBBBBBBBB ...
Foopz's user avatar
  • 31
0 votes
0 answers
2k views

Detect Brute Force Attack in auth.log

I´m very new to linux forensics and I´m analyzing an infected linux image. Main question: How got the hacker access to the system? The auth.log file is full with automated brute force attack with ...
Maiwand's user avatar
1 vote
2 answers
2k views

What is the equivalent of autoruns tool in linux for finding suspicious startup executables?

In Windows, Autoruns tool is a really helpful tool for forensic investigators to help them find suspicious startup executables and filter the benign ones. but i couldn't anything good like this in ...
OneAndOnly's user avatar
0 votes
1 answer
1k views

Python Script To Identify Ext4 Inodes From Raw Data Of Partition

I'm trying to put together a python script that can read the raw data from the back-up image of an ext4 partition and recognize when it sees an ext4 inode structure so that particular file can be ...
Keenan's user avatar
  • 73
1 vote
0 answers
593 views

Find Inodes And Recover Binary Files From Raw Data

What command do I use to scan a hard drive that has corrupted superblocks to find inodes? Additionally, what command do I use to write the file data associated with that inode? My partition was ...
Keenan's user avatar
  • 73
0 votes
0 answers
101 views

Recover All Files On Lost Partition

I had a sdd with two partitions on it. The first was 32G and the second took up the remainder of the drive. The first was the root partition with Ubuntu installed on it. The second was a general ...
Keenan's user avatar
  • 73
1 vote
1 answer
183 views

Determine program responsible for periodic short-lived network connections

I am interested in learning the proper procedure to determine which Linux program / process is responsible for a given short-lived network connection which repeats periodically. Without making any ...
mojoa's user avatar
  • 153
1 vote
1 answer
201 views

how to remove dangerous stuff from old CVS commits?

Cleaning up after a former employee, I've found that they accidentally included 800MB of data files in a commit to CVS years ago. Several other commits to the same project were made afterwards. This ...
Medievalist's user avatar
0 votes
1 answer
37 views

data identification from NNTP

I've been on NNTP newsgroups and like to know how to identify the following NNTP header strings That is, what is the meaning and where/how do I find those: Injection-Info:logging-data="74569" ...
user2901196's user avatar
1 vote
2 answers
1k views

Recover overwritten LUKS partition

Is there a way to recover an overwritten LUKS partition? Consider the following case: I had a (external) hard drive (not SSD) which is completely LUKS encrypted containing an ext4 file system with ...
student's user avatar
  • 18.3k
7 votes
3 answers
2k views

Why does photorec keep finding files after I have filled the disk free space as root?

Before I lend my laptop for a while to my young and linux-savy nephew I want to make sure he's not able to carve into my personal data in the blank space of the drive. I have saturated the blank space ...
Mephisto's user avatar
  • 1,077
1 vote
1 answer
10k views

extundelete - How to solve 'Block bitmap checksum does not match bitmap when trying to examine filesystem'?

The OS is Ubuntu 17.10 and I've been trying to recover(undelete) with extundelete. (The File System is ext4.) This didn't work. So, I tried with extundelete /dev/mapper/ubuntu--vg-root --restore-...
Chanjung Kim's user avatar
2 votes
0 answers
1k views

Extract a running ELF from a memory dump

Our teacher gave us as homework a memory dump from a VBox (Ubuntu 16.04.9) and said that the message we need to get is printed by an ELF currently running in the VM. This is my what I get after ...
Teodor Vecerdi's user avatar
1 vote
2 answers
1k views

Visualizing raw bits of disk

Is there a command that allows me to "see" the raw bits of a disk? In other words, to ignore the filesystem and output the "big picture" of the literal zeros and ones as per the disk. (Ideally not ...
Pacerier's user avatar
  • 113
2 votes
1 answer
3k views

How to undelete a file on a btrfs filesystem

Which software and commands are required, to undelete a file on a btrfs filesystem?
Jonas Stein's user avatar
  • 4,068
1 vote
5 answers
2k views

Legal alternative to Kali Linux for forensics [closed]

I would like to have a bootable USB drive to perform digital forensics (carving, undeleting etc.) in case I accidentally delete files from my personal computer. I know Kali Linux comes with an ...
user32849's user avatar
  • 151
4 votes
1 answer
4k views

What is the difference between dd_rescue and ddrescue, when to prefer which one?

There are two similar tools for a dd on bad hardware: Kurt Garloff's dd_rescue GNU ddrescue What is the difference between dd_rescue and ddrescue, when to prefer which one?
Jonas Stein's user avatar
  • 4,068
-1 votes
1 answer
227 views

DFF - Digital Forensic Framework console mode [closed]

I have a question about DFF - Digital Forensic Framework. More precisely, about its console mode. I know, that there is GUI mode, but i need console mode for using it via php in my web-application. ...
Fgen's user avatar
  • 3
0 votes
1 answer
214 views

Figuring out what caused a system hang

Over the past several hours I've had my Mint 18.2 system hang on me - twice during a Skype (64-bit) conversation, and a third time. Screen locks up, audio repeats a short pattern, no response to ...
einpoklum's user avatar
  • 9,462
11 votes
3 answers
4k views

Who renamed a directory?

I couldn't find the answer to this anywhere. How can I know who renamed a directory? ls -al shows only the name of user who created that dirctory.
StupidKris's user avatar
3 votes
2 answers
3k views

Recovery of damaged DVD yielding "no medium found" error

I have a very strange case of DVD reading failure. It's a video DVD recorded a couple of years ago on a DVD-R disc. Two weeks ago our video DVD player would start having trouble reading parts of it. ...
jens's user avatar
  • 133
0 votes
1 answer
102 views

data recovery on image following https://help.ubuntu.com/community/DataRecovery

I made an image of an usb stick which was mistakenly made into a live usb with xubuntu in it. The unit is 8GB, the xubuntu.iso 1.3GB. I only want to work with the image and I think each command I try ...
green3's user avatar
  • 1
1 vote
0 answers
99 views

Question regarding hacked machine and special characters in filename

I'm doing a little bit of forensics on a machine that has apparently been hacked. (Thanks, systemd and your resolv buffer overflow thing. That was awesome. :/ ) Anyhow, I have a pair of 0-length ...
Chris Larson's user avatar
0 votes
1 answer
1k views

Unix - way to see all files that recently got permissions changed

What is a way to see all files in a current directory that got recently permissions changed? Or, another approach to my problem is, what is a way to see how many times a file got permissions changed?...
kektus's user avatar
  • 1
3 votes
1 answer
341 views

How to create a consistent forensic image from a live RHEL system?

In our environment we have RHEL7 systems that need to be always up and running. I know the preferred method of acquiring a forensic image is to take the system offline, but in case of a live image, ...
Stefan Broeder's user avatar
1 vote
2 answers
2k views

How to get info on a dead process that was listening on a particular port?

There is a process that I know was listening on a certain port that is no longer running. I would like to know when it stopped running, if it crashed, or any other info about that process. Is there ...
LINUX G33NYUS's user avatar
2 votes
2 answers
236 views

Forensic - How to get a docker image without "export" command

For the purpose of a forensic mission, we must get a docker image without using the famous export from a docker command. Does copy and paste of the folder /var/lib/docker/containers in another server ...
Duke Nukem's user avatar
1 vote
1 answer
2k views

How to scan a hard disk at low level to recover files in partially overwritten partition?

We had a human accident at home and an external hard disk was copied a SD 32gb image card by mistake. The copy should be done to a SD image. I guess 32gb of the external drive were overwritten, but ...
hertsmael's user avatar
2 votes
0 answers
256 views

ddrescue a drive

Background: I have attempted to rescue a drive which seems to have corruptions using the following commands: ddrescue --no-split /dev/hda1 imagefile logfile ddrescue --direct --retry-passes=3 /dev/...
oshirowanen's user avatar
  • 2,621
1 vote
1 answer
2k views

How to view process history to analyse the memory bottleneck?

Yesterday my billing db got crashed due to high memory usage. Now would like to see what are all the processes running when the db got crashed. Is there any way to look into this ? Please help..
ganesh.e's user avatar
1 vote
3 answers
555 views

What is happening when I read a corrupt optical media with dd and it's really slow?

I have a DVD that I can't rip or copy using regular commands. If I try to copy it it will first copy at normal speed, but then slow down and take a very long while to do seemingly nothing. Right now ...
PetaspeedBeaver's user avatar
1 vote
1 answer
2k views

Accessing /dev/mem freezes Ubuntu

I am using the latest Ubuntu Linux with a custom kernel (4.2.0-36-generic), in which I have disabled the CONFIG_STRICT_DEVNEM, because I need to dump and search some terms in memory during a project. ...
Alexander Lattas's user avatar
1 vote
1 answer
2k views

Recover overwritten CCTV footage from hard drive

I am trying to recover deleted footage from a DVR. I pulled the hdd(Toshiba DT01ABA100v) from the DVR to look at the data in the drive and run carving tools(foremost and scalpel). My problem is that I ...
banad's user avatar
  • 111
0 votes
1 answer
921 views

How to determine kernel version from linux vm snapshot

I am having trouble figuring out how to determine the linux kernel version by analyzing a memory snapshot from a linux VM. I have used hexdump to examine the binary but can't find anything that would ...
Zack Herbert's user avatar
3 votes
3 answers
751 views

How can I see which process hangs my Banana-pi for few seconds every couple of minutes?

Answer I fixed my "freezes" by turning autoneg of (ethtool -s eth0 duplex full autoneg off). How I found this Every time after a freeze, monitoring disk I/O with the help of the post below, I saw ...
Maurits's user avatar
  • 33
1 vote
1 answer
7k views

Recover deleted commands from history?

If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?
vijay's user avatar
  • 11
2 votes
1 answer
2k views

How to recover a shell script I deleted from a specific folder in Debian 7?

So in a merry mood last night, I deleted an important shell script from my system. I mistook it for something else and figured it wasn't needed. I am trying to recover it. I have tried 'scalpel' and '...
learnerX's user avatar
  • 808
2 votes
2 answers
2k views

Digital Photograph Forensics Software for Linux [closed]

Is there any forensics software that can handle digital Photograph for linux ? An opensource software is preferable
Ossama Nasser's user avatar
1 vote
2 answers
1k views

Forensics on ipad .img wont mount in Kali

I am attempting to do some forensics on my iPad. I am following along with this article from sans.. on page 13 is the start of the Jailbreaking section...I would like to mount the image and then find ...
BryEsch's user avatar
  • 11