Collaborate Disseminate
As far as I’ve heard, hashing a disk image before computer forensics is started, and then comparing that hash to a new hash after the forensics is finished is the most common way to make sure that there is no tampering with the disk during… Continue reading Are there better methods of sustaining forensic integrity apart from disk hashing?
I’m doing an IR on a Linux machine. The attacker has a trojan executed in memory, the file content is backed by a memfd_create based fd.
My questions
How can I extract the contents from memfd?
When a userland program calls memfd_create, a… Continue reading forensics on memfd_create
I have a Samsung Android which I am almost certain has malware/a rootkit on it.
I’d like to take a forensic image of the device.
In developer mode, the ‘USB debugging’ mode is shaded in and set to off. I don’t know how to unshade it and se… Continue reading How to enable USB debugging mode when it has been disabled [migrated]
I understand that in a Hard Disk Drive (HDD) there is EEPROM which stores calibration data. This is not directly accessible by any ring-3 (usermode) or ring-0 (kernel mode) programs.
I was curious as to whether changes to the HDD, such as … Continue reading EEPROM with HDD calibration data
Even if a criminal wears gloves, their cast-off DNA may still be present in a room’s air after they leave. A new study suggests that if such telltale material gets sucked up by an air conditioner, it could let forensic investigators know if a suspect h… Continue reading Air conditioners may help catch criminals, by snagging their DNA
Exploring a plist related with a flash pop-up when booting, I found this folders:
launchctl print gui/$(id -u)/com.apple.sharingd
…
path = /System/Library/LaunchAgents/com.apple.sharingd.plist
state = running
program = /usr… Continue reading How do I start inspecting, in a basic way, what a socket is or was doing?
Using Windows without creating forensic information is impossible. But you can make it harder. How to use a regular Windows 10 with least traces of forensics?
There are some important sources of forensic data:
Event logs
Admin can easily… Continue reading How to make windows forensic harder?
An experimental new forensic spray allows latent fingerprints to be made visible in just 10 seconds, plus it doesn’t require the use of any messy powders. What it does incorporate, however, is a glowing protein that’s obtained from jellyfish.Continue R… Continue reading Glowing jellyfish protein lights the way for better lifting of fingerprints
There are tons of VPN service providers that allow VPN connections for some little amount like 5-15$ per month. Imagine a malicious person using some of these services to hide his cyber-criminal activities. Say, he hacked a website resulti… Continue reading how public vpn service providers avoid being liable for illegal activity of their customers [migrated]
Morning, I recently had need to check for malware on my PC by dumping the memory and searching for unwanted processes which could be malware, my question it’s, is it possibile for malware to detect memory dumping, I am going to analyze the… Continue reading Can malware detect memory dumping?