Collaborate Disseminate
I have a long history with the Techno Security Conference, thanks to my mentor and friend “Uncle” Jack Wiles. At one point, over 10 years ago, I was the conference’s youngest ever keynote speaker. It’s with great honor I return again this year to deliv… Continue reading My Return to Techno Security Conference
I have a disk image divided in 4 files, image.E01, image.E02, image.E03 and image.E04. I created a case in autopsy and I’m trying to recover the Product ID and the Product Key.
The product ID I already found it in the Operating System Info… Continue reading How can I get the Product Key with Autopsy or FTK viewer? [closed]
I was presented with a task. I have .vmdk disk available and I have to check its contents – forensically check the data on it without modifiying it and then check whether some data on this disk has been deleted. I also have to check whethe… Continue reading How to forensically check if some data on .vmdk disk has been hidden/deleted?
I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted).
I need… Continue reading Get file from the linux_volshell from volatility
I’m trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 vulnerability was exploited but I need eviden… Continue reading How to recover a file with volatility from a linux profile
Let’s say someone has a full disk encrypted laptop powered on when the adversary tries to break into her home to seize her laptop. If she simply put her powered-on laptop into a fish tank nearby, would it be effective against forensic inve… Continue reading Is throwing powered on laptop into a fish tank effective against forensic [closed]
My class question:
"What are the key challenges for cloud forensics on cloud storage such
as Dropbox?"
With what I’ve been told and what I generally understand, the question is basically what difficulties a digital investigator… Continue reading What are the challenges when doing forensics on cloud storage services?
I have taken a DFIR course, but I have not worked with an SME. Looking at this SuperTimeline output, I saw something like what is pictured. SVCHOST executing from prefetch and the file then being deleted. The other instance is modificatio… Continue reading Log analysis of suspicious activity [closed]
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like secret messaging, which he had modified via… Continue reading As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?
The Intercept has a long article on the insecurity of photo cropping:
One of the hazards lies in the fact that, for some of the programs, downstream crop reversals are possible for viewers or readers of the document, not just the file’s creators or editors. Official instruction manuals, help pages, and promotional materials may mention that cropping is reversible, but this documentation at times fails to note that these operations are reversible by any viewers of a given image or document.
[…]
Uncropped versions of images can be preserved not just in Office apps, but also in a file’s own metadata. A photograph taken with a modern digital camera contains all types of metadata. Many image files record text-based metadata such as the camera make and model or the GPS coordinates at which the image was captured. Some photos also include binary data such as a thumbnail version of the original photo that may persist in the file’s metadata even after the photo has been edited in an image editor…