Collaborate Disseminate
I have a question regarding bitlocker. Suppose I have any operating system installed on an unencrypted disk (windows for example) and I have confidential data on it. Then, someone formats the disk and installs windows, but this time encryp… Continue reading Does Bitlocker securely erase the blocks where the first and last partition will go?
Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process.
There is Process-Dump which is able to extract PE from … Continue reading Cuckoo dump a PE file from a memory dump?
I want to image a drive with FTK Imager’s feature ‘Create Disk Image’ but the external hard drive has some issues. The external HDD does not appear in Windows File Explorer but it appears in Disk Management as Online and Unallocated. The d… Continue reading Creating disk image with FTK Imager: Failure: The specified network resource or device is no longer available. (55)
I have trouble with some questions related to digital forensics, but I cannot find the exact correct answer from any source on the Internet. Please anyone who now the answer exactly can help me?
Continue reading What’s the answers of these questions on digital forensics [closed]
People with long commutes usually come up with tricks to stay focused and alert and avoid the dangerous tendency to zone out during the drive. One trick I used to …read more Continue reading Books You Should Read: Why Buildings Fall Down
I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access to my computer when I am not there (I … Continue reading How to make a virtual machine forensics-proof – completely or to the maximum possible level?
In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs.
For their experiments, they wrote large amounts of text to twelve SSDs, then shift-deleted the files,… Continue reading Reasons for recovering small amounts of deleted data from SSDs
We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password hint of a user with volatility if we hav… Continue reading Is there a way to get Windows login password hint from SAM hive with volatility?
I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python program to return the section of the core … Continue reading How to extract a RSA private key from an ssh-agent core dump
I capture memory of Windows 10 with "Belkasoft ram capture"
When i take the dump.mem file for analysis with volatility tool the software to hang and i did not get any out put
I try –> volatility.exe -f dump.mem imageinfo