Questions tagged [digital-forensics]

Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.

Filter by
Sorted by
Tagged with
1 vote
0 answers
38 views

UTC Timestamp since 1900

While reverse engineering a system I found a time stamp with a peculiar year: UTC:'20.09.118 17:41:38' It seems as if this is the UTC timestamp since 1900, which would result in UTC:'20.09.2018 17:41:...
Suske Lambik's user avatar
2 votes
1 answer
71 views

Capture and Replay

I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
jjprince's user avatar
0 votes
1 answer
243 views

Extract certificate information of a process from memory dump

I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
Timberwolf's user avatar
1 vote
0 answers
115 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
Gabriel Fair's user avatar
1 vote
0 answers
129 views

How do I find Python data structures in Linux process memory using Volatility?

I have a Ubuntu 18.04 memory dump (entire RAM), and while I was acquiring it with LiME, I had a Python program running. Using Volatility, I want to recover its data structure values which are located ...
hainan_chicken's user avatar
1 vote
1 answer
270 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
Colin Milhaupt's user avatar
1 vote
0 answers
101 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
RollRoll's user avatar
  • 111
8 votes
0 answers
926 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
user25105's user avatar
8 votes
0 answers
3k views

Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)

I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
BronzeOtter's user avatar
-1 votes
3 answers
3k views

Trying to identify a file format for CTF forensics challenge

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
BronzeOtter's user avatar
1 vote
1 answer
2k views

Binwalk extracted images corrupt?

I ran: $> binwalk --dd='jpeg:jpg' file.bin The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
Justin Clark's user avatar
3 votes
2 answers
7k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
Sohel Ahmed's user avatar
4 votes
0 answers
156 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
ylluminate's user avatar
2 votes
1 answer
2k views

Can I reverse engineer a pdf file to identify the creator's name?

Here is a quick question. Someone told me that I can reverse engineering a pdf file, extracting and analyzing the underlying XML files, and figure out the creator's name for this pdf. However, I ...
lllllllllllll's user avatar
1 vote
0 answers
60 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
MikeSchem's user avatar
  • 131
3 votes
2 answers
7k views

Tools for Windows 10 hiberfil.sys file analysis

As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened. Is there any tools (free, paid, open source, any) that ...
Nikita's user avatar
  • 131
1 vote
1 answer
283 views

How would I go about imaging a propriatary flash or eeprom memory chip?

I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
ChipsAhoy's user avatar
3 votes
2 answers
3k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
Yuval's user avatar
  • 133
0 votes
1 answer
3k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
Ihara's user avatar
  • 21
2 votes
0 answers
244 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
codecowboy's user avatar
4 votes
0 answers
207 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
ChipsAhoy's user avatar
3 votes
2 answers
337 views

One-pass streaming algorithm for detecting bytecode/opcode?

I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. There are no PE32, ELF, or ...
John Greene's user avatar
1 vote
2 answers
1k views

Find the right layer header for a corrupt pcap

So the problem is that i have a corrupt pcap file. You can find a the pcap file [here][1]. First i did the file command on it : the.pcap: tcpdump capture file (little-endian) - version 2.4, capture ...
creuchmeuch's user avatar
7 votes
2 answers
6k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
Runcible's user avatar
  • 181
1 vote
1 answer
1k views

Can either volatility or GDB dump only the heap memory of a process under Linux?

What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...
MrSynAckSter's user avatar
  • 1,256
2 votes
1 answer
108 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
brandbir's user avatar
  • 123
0 votes
1 answer
115 views

Where is the code for ollytlscatch?

I've been trying to get antiResHacker.exe as mentioned in this question: How to prevent use of Resource editors However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
Fred Concklin's user avatar
0 votes
0 answers
466 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
Fred Concklin's user avatar
4 votes
1 answer
298 views

Some help with sprite graphic

I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called NORMAL.SET and contains a set of sprites. There is an executable named SHOWSET.EXE that ...
Daniel's user avatar
  • 161
1 vote
1 answer
1k views

Reverse Engineer Video File Format [closed]

I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too. Please !! I would really ...
Akhilesh's user avatar
2 votes
3 answers
4k views

tools - Free Windows Memory Toolkit for x64

I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out ...
Sreyan's user avatar
  • 203
6 votes
2 answers
208 views

What time structure is this?

I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the ...
AlexeiD's user avatar
  • 61
2 votes
2 answers
474 views

VADs with RWX permission in winlogon.exe process

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
user3365's user avatar
  • 197
3 votes
2 answers
1k views

VADs with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
user3365's user avatar
  • 197
7 votes
1 answer
791 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
user3365's user avatar
  • 197
4 votes
0 answers
329 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
user3365's user avatar
  • 197
2 votes
1 answer
718 views

Memory forensics: disabled pagefile but still not everything in memory

I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps. I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
user3365's user avatar
  • 197
10 votes
3 answers
494 views

Physically auditing the layout of transistors inside a processor made at 22mm process die

What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively ...
user2987828's user avatar
7 votes
2 answers
2k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
Pranit Kothari's user avatar
5 votes
3 answers
339 views

Tool for checking if there is any patch in the loaded module

I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions. I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
PhoeniX's user avatar
  • 3,032
5 votes
1 answer
2k views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
PhoeniX's user avatar
  • 3,032
14 votes
5 answers
3k views

How to capture an "in-memory" malware in MS-Windows?

I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
perror's user avatar
  • 19.1k