Collaborate Disseminate
I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access to my computer when I am not there (I … Continue reading How to make a virtual machine forensics-proof – completely or to the maximum possible level?
In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs.
For their experiments, they wrote large amounts of text to twelve SSDs, then shift-deleted the files,… Continue reading Reasons for recovering small amounts of deleted data from SSDs
We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password hint of a user with volatility if we hav… Continue reading Is there a way to get Windows login password hint from SAM hive with volatility?
I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python program to return the section of the core … Continue reading How to extract a RSA private key from an ssh-agent core dump
I capture memory of Windows 10 with "Belkasoft ram capture"
When i take the dump.mem file for analysis with volatility tool the software to hang and i did not get any out put
I try –> volatility.exe -f dump.mem imageinfo
I capture memory in Windows 10 with Belkasoft Ram Capture. When I import the dump.mem file for analysis with Volatility, the software hangs and I do not get any output.
volatility.exe -f dump.mem imageinfo
What can I do to get output?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.
Cool, the strange thing is that the… Continue reading malicious dll making GET & POST requests to legit sites. What could it be doing?
Even if someone’s fingerprints are found on an incriminating document, that person may claim that they only handled the blank sheet of paper before the real criminal printed anything on it. A new technique, however, can now be used to check if that rea… Continue reading Forensic tech shows if fingerprints were applied to incriminating text
I have the opposite problem of this question’s OP: What can be recovered? Securely deleted files
I deleted some files in September 2017 and need to have them back. I actually gave up on this, but then came about the question mentioned abov… Continue reading Recovery of deleted data from a modern disk [migrated]