Collaborate Disseminate
I capture memory in Windows 10 with Belkasoft Ram Capture. When I import the dump.mem file for analysis with Volatility, the software hangs and I do not get any output.
volatility.exe -f dump.mem imageinfo
What can I do to get output?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Even if someone’s fingerprints are found on an incriminating document, that person may claim that they only handled the blank sheet of paper before the real criminal printed anything on it. A new technique, however, can now be used to check if that rea… Continue reading Forensic tech shows if fingerprints were applied to incriminating text
I have the opposite problem of this question’s OP: What can be recovered? Securely deleted files
I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then came about the question mentioned abov… Continue reading Recovery of deleted data from a modern disk [migrated]
How can I trace network attacks where a stalker observes my traffic and other malware (including implanting malware/reconnaissance)
Which services or methods should be able to identify the activity?
Continue reading What methods or services identify network attacks? [closed]
I found this string
b2335332-d28f-449b-8d00-80a550b43046
Do you think it´s a hash?
If yes any idea which one and if not any other ideas what it could be?
Continue reading Is this 36 character long string a hash [closed]
I was reading a paper, the authors said they converted their netflow files to 2D image. I want to convert my files to 2D images. What is the process?
I have a disk image. I’m able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I insert… Continue reading Calculations of NTFS Partition Table Starting Points [closed]
Let’s assume that for my question we’re using the equivalent of apt purge, which also removes configuration files. What’s left behind after apt purge and similar commands from other package managers?
I’m guessing it would be loose dependen… Continue reading From a forensics standpoint how much leftovers do package managers in Linux leave behind?