Collaborate Disseminate
I’m working on a case involving an Apple silicon Mac and it has me stumped. It has a user password, which I don’t know, is running the latest OS and has Filevault enabled.
Without the user password, my forensic tools can’t do anything as t… Continue reading Is guessing the password forensically sound?
Is it possible to detect/trace if a Windows Live/PE is used on a system?
Like with logs or dumps etc.
Continue reading How to detect/trace if a Windows Live/PE used on a system?
I’m asking a forensic company,I think the infected malware is a Trojan horse.
When the harassment took place, the forensics engineer had a Surface layer (look at the executed program, as you can see in Process Hacker) nothing. As you can s… Continue reading where are the traces of malware and remote control? [closed]
In this security tutorial:
https://youtu.be/dykc9YC9Z6U?t=257
the author claims that "sihost is a network component of the malware…" (at 4:23). Yet, prior to his claim, at 3:09 he shows that that particular sihost is signed as … Continue reading Can malware module be signed as Microsoft Corporation module?
About 1 year ago I had saved some code on a notepad text file (.txt) I was building using a Windows 10 computer. However, I deleted a portion of the code and saved the text file with a new c++ code patch thinking it was no big deal. Howeve… Continue reading How to obtain a lost version of an edited notepad [.txt] file on a Windows 10 hard drive using a SATA SSD to USB dongle [migrated]
About 1 year ago I had saved some code on a notepad text file (.txt) I was building using a Windows 10 computer. However, I deleted a portion of the code and saved the text file with a new c++ code patch thinking it was no big deal. Howeve… Continue reading How to obtain a lost version of an edited notepad [.txt] file on a Windows 10 hard drive using a SATA SSD to USB dongle [migrated]
Interesting forensics in connection with a serial killer arrest:
Investigators went through phone records collected from both midtown Manhattan and the Massapequa Park area of Long Island—two areas connected to a “burner phone” they had tied to the killings. (In court, prosecutors later said the burner phone was identified via an email account used to “solicit and arrange for sexual activity.” The victims had all been Craigslist escorts, according to officials.)
They then narrowed records collected by cell towers to thousands, then to hundreds, and finally down to a handful of people who could match a suspect in the killings…
Continue reading Tracking Down a Suspect through Cell Phone Records
Don’t do it:
Recently, the manager of the Harvard Med School morgue was accused of stealing and selling human body parts. Cedric Lodge and his wife Denise were among a half-dozen people arrested for some pretty grotesque crimes. This part is also at least a little bit funny though:
Over a three-year period, Taylor appeared to pay Denise Lodge more than $37,000 for human remains. One payment, for $1,000 included the memo “head number 7.” Another, for $200, read “braiiiiiins.”
It’s so easy to think that you won’t get caught.
… Continue reading Typing Incriminating Evidence in the Memo Field
The New York Times has a long article on the investigative techniques used to identify the person who stabbed and killed four University of Idaho students.
Pay attention to the techniques:
The case has shown the degree to which law enforcement investigators have come to rely on the digital footprints that ordinary Americans leave in nearly every facet of their lives. Online shopping, car sales, carrying a cellphone, drives along city streets and amateur genealogy all played roles in an investigation that was solved, in the end, as much through technology as traditional sleuthing…
Kaspersky is reporting a zero-click iOS exploit in the wild:
Mobile device backups contain a partial copy of the filesystem, including some of the user data and service databases. The timestamps of the files, folders and the database records allow to roughly reconstruct the events happening to the device. The mvt-ios utility produces a sorted timeline of events into a file called “timeline.csv,” similar to a super-timeline used by conventional digital forensic tools.
Using this timeline, we were able to identify specific artifacts that indicate the compromise. This allowed to move the research forward, and to reconstruct the general infection sequence:…
Continue reading Operation Triangulation: Zero-Click iPhone Malware