Questions tagged [digital-forensics]
Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.
42 questions
1
vote
0
answers
41
views
UTC Timestamp since 1900
While reverse engineering a system I found a time stamp with a peculiar year:
UTC:'20.09.118 17:41:38'
It seems as if this is the UTC timestamp since 1900, which would result in
UTC:'20.09.2018 17:41:...
- 33
2
votes
1
answer
75
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 49
0
votes
1
answer
273
views
Extract certificate information of a process from memory dump
I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
1
vote
0
answers
116
views
Extracting Binary Stream inside an mp3
In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43.
The section of noise has distinct sections punctuated with momentary silence which leads me to ...
- 111
1
vote
0
answers
131
views
How do I find Python data structures in Linux process memory using Volatility?
I have a Ubuntu 18.04 memory dump (entire RAM), and while I was acquiring it with LiME, I had a Python program running. Using Volatility, I want to recover its data structure values which are located ...
1
vote
1
answer
281
views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
0
answers
105
views
Can I see Stack and Heap value/addresses from this simple C# program process?
I am studying reading dumped memory image and analyzing it with volatility.
I wrote this c# program and I was hoping to see the analyzed data from Volatiliy
namespace CSharpEx1
{
class Program
...
- 111
9
votes
0
answers
969
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 91
8
votes
0
answers
3k
views
Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)
I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
- 363
-1
votes
3
answers
4k
views
Trying to identify a file format for CTF forensics challenge
I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
- 363
1
vote
1
answer
2k
views
Binwalk extracted images corrupt?
I ran:
$> binwalk --dd='jpeg:jpg' file.bin
The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
- 11
3
votes
2
answers
7k
views
Volatility - manually inspect heap of a process
According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
- 31
4
votes
0
answers
170
views
DSi Data Recovery Process?
I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it.
After looking closely at the system, it appears that the memory must be integraded onto ...
- 141
2
votes
1
answer
3k
views
Can I reverse engineer a pdf file to identify the creator's name?
Here is a quick question. Someone told me that I can reverse engineering a pdf file, extracting and analyzing the underlying XML files, and figure out the creator's name for this pdf.
However, I ...
- 2,485
1
vote
0
answers
60
views
Reverse Engineer an iOS MP4 Bug [duplicate]
Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
- 131
3
votes
2
answers
7k
views
Tools for Windows 10 hiberfil.sys file analysis
As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened.
Is there any tools (free, paid, open source, any) that ...
- 131
1
vote
1
answer
306
views
How would I go about imaging a propriatary flash or eeprom memory chip?
I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
- 51
3
votes
2
answers
3k
views
Extracting threads' stack from Windows memory dump
I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB).
I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
- 133
0
votes
1
answer
3k
views
Decode 96 column punch card
I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card?
I am doing an exercise but I can't seem to ...
- 21
2
votes
0
answers
256
views
How can I further identify a file which the file command lists as 'data' [closed]
I have file named 'out'. If I issue the file command I see :
:~/Desktop# file out
out: data
How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
- 153
4
votes
0
answers
208
views
Trying to obtain embedded flash memory on MCP5554 microcontroller
I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go.
...
- 51
3
votes
2
answers
339
views
One-pass streaming algorithm for detecting bytecode/opcode?
I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode.
There are no PE32, ELF, or ...
- 151
1
vote
2
answers
1k
views
Find the right layer header for a corrupt pcap
So the problem is that i have a corrupt pcap file. You can find a the pcap file [here][1].
First i did the file command on it : the.pcap: tcpdump capture file (little-endian) - version 2.4, capture ...
- 485
7
votes
2
answers
6k
views
How to retrieve assembly from a raw memory dump?
I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory.
I'm looking for a tool that will help me identify ...
- 181
1
vote
1
answer
1k
views
Can either volatility or GDB dump only the heap memory of a process under Linux?
What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...
- 1,258
2
votes
1
answer
110
views
Extra bytes between clusters in FAT12
I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
- 123
0
votes
1
answer
115
views
Where is the code for ollytlscatch?
I've been trying to get antiResHacker.exe as mentioned in this question:
How to prevent use of Resource editors
However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
- 233
0
votes
0
answers
467
views
Does malware ever purposely embed resources to thwart resource analysis and extraction
I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
- 233
4
votes
1
answer
306
views
Some help with sprite graphic
I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called NORMAL.SET and contains a set of sprites. There is an executable named SHOWSET.EXE that ...
- 161
1
vote
1
answer
1k
views
Reverse Engineer Video File Format [closed]
I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too.
Please !! I would really ...
- 21
2
votes
3
answers
4k
views
tools - Free Windows Memory Toolkit for x64
I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out ...
- 203
6
votes
2
answers
211
views
What time structure is this?
I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the ...
- 61
2
votes
2
answers
480
views
VADs with RWX permission in winlogon.exe process
On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
- 197
3
votes
2
answers
1k
views
VADs with RWX permission in winlogon and csrss processes
On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
- 197
7
votes
1
answer
807
views
Modules that exist in a process address space
Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list)
This is just an ...
- 197
4
votes
0
answers
330
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
- 197
2
votes
1
answer
733
views
Memory forensics: disabled pagefile but still not everything in memory
I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps.
I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
- 197
10
votes
3
answers
495
views
Physically auditing the layout of transistors inside a processor made at 22mm process die
What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively ...
- 201
7
votes
2
answers
2k
views
What is difference between Digital Forensic and Reverse Engineering
I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
- 927
5
votes
3
answers
347
views
Tool for checking if there is any patch in the loaded module
I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions.
I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
- 3,072
5
votes
2
answers
2k
views
Prevent malware from deleting itself during installation on Windows x64
Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection.
I've looked at CaptureBat, but its ...
- 3,072
14
votes
5
answers
3k
views
How to capture an "in-memory" malware in MS-Windows?
I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
- 19.2k