Collaborate Disseminate
We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password hint of a user with volatility if we hav… Continue reading Is there a way to get Windows login password hint from SAM hive with volatility?
I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python program to return the section of the core … Continue reading How to extract a RSA private key from an ssh-agent core dump
I capture memory of Windows 10 with "Belkasoft ram capture"
When i take the dump.mem file for analysis with volatility tool the software to hang and i did not get any out put
I try –> volatility.exe -f dump.mem imageinfo
I capture memory in Windows 10 with Belkasoft Ram Capture. When I import the dump.mem file for analysis with Volatility, the software hangs and I do not get any output.
volatility.exe -f dump.mem imageinfo
What can I do to get output?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Even if someone’s fingerprints are found on an incriminating document, that person may claim that they only handled the blank sheet of paper before the real criminal printed anything on it. A new technique, however, can now be used to check if that rea… Continue reading Forensic tech shows if fingerprints were applied to incriminating text
I have the opposite problem of this question’s OP: What can be recovered? Securely deleted files
I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then came about the question mentioned abov… Continue reading Recovery of deleted data from a modern disk [migrated]
How can I trace network attacks where a stalker observes my traffic and other malware (including implanting malware/reconnaissance)
Which services or methods should be able to identify the activity?
Continue reading What methods or services identify network attacks? [closed]
I found this string
b2335332-d28f-449b-8d00-80a550b43046
Do you think it´s a hash?
If yes any idea which one and if not any other ideas what it could be?
Continue reading Is this 36 character long string a hash [closed]