Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [digital-forensics]

Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.

1
vote
1answer
99 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
1
vote
0answers
49 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
7
votes
0answers
146 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
5
votes
0answers
295 views

Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)

I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
-1
votes
3answers
410 views

Trying to identify a file format for CTF forensics challenge

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
0
votes
1answer
238 views

Binwalk extracted images corrupt?

I ran: $> binwalk --dd='jpeg:jpg' file.bin The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
1
vote
1answer
2k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
5
votes
0answers
90 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
1
vote
1answer
467 views

Can I reverse engineer a pdf file to identify the creator's name?

Here is a quick question. Someone told me that I can reverse engineering a pdf file, extracting and analyzing the underlying XML files, and figure out the creator's name for this pdf. However, I ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
2
votes
2answers
3k views

Tools for Windows 10 hiberfil.sys file analysis

As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened. Is there any tools (free, paid, open source, any) that ...
1
vote
1answer
106 views

How would I go about imaging a propriatary flash or eeprom memory chip?

I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
2
votes
0answers
73 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
4
votes
0answers
152 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
2answers
273 views

One-pass streaming algorithm for detecting bytecode/opcode?

I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. There are no PE32, ELF, or ...
1
vote
2answers
433 views

Find the right layer header for a corrupt pcap

So the problem is that i have a corrupt pcap file. You can find a the pcap file [here][1]. First i did the file command on it : the.pcap: tcpdump capture file (little-endian) - version 2.4, capture ...
5
votes
2answers
2k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
0
votes
1answer
861 views

Can either volatility or GDB dump only the heap memory of a process under Linux?

What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...
2
votes
1answer
79 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
0
votes
1answer
80 views

Where is the code for ollytlscatch?

I've been trying to get antiResHacker.exe as mentioned in this question: How to prevent use of Resource editors However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
0
votes
0answers
435 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
4
votes
1answer
133 views

Some help with sprite graphic

I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called NORMAL.SET and contains a set of sprites. There is an executable named SHOWSET.EXE that ...
1
vote
1answer
536 views

Reverse Engineer Video File Format [closed]

I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too. Please !! I would really ...
2
votes
3answers
2k views

tools - Free Windows Memory Toolkit for x64

I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out ...
5
votes
2answers
186 views

What time structure is this?

I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the ...
1
vote
2answers
285 views

VADs with RWX permission in winlogon.exe process

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
3
votes
2answers
944 views

VADs with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
5
votes
1answer
462 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
3
votes
0answers
267 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
1
vote
1answer
349 views

Memory forensics: disabled pagefile but still not everything in memory

I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps. I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
9
votes
3answers
441 views

Physically auditing the layout of transistors inside a processor made at 22mm process die

What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively ...
6
votes
2answers
1k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
4
votes
3answers
279 views

Tool for checking if there is any patch in the loaded module

I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions. I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
4
votes
1answer
1k views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
14
votes
5answers
2k views

How to capture an “in-memory” malware in MS-Windows?

I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...