Questions tagged [forensics]

The tag has no usage guidance.

7 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
29 views

Linux software to detect external drive partition-level rootkits

clamscan can search file systems for malware, but it can't scan possible rootkits on the boot sectors of an external disk. rkhunter also doesn't seem to provide the ability to scan boot sectors of an ...
2
votes
0answers
129 views

Program to determine when a disc (CD) has been written/burned

I am looking for a program that can: determine the date and time when a disc has been written/burned If possible: works on Windows 7 free also works with DVDs I am aware of How to find out when a ...
1
vote
0answers
14 views

SIEM Dashboard/Add-On/App for Viewing Windows Registry Forensics Data

There are a number of forensically-useful areas in the Windows registry and file system like those detailed in this SANS Poster: https://www.sans.org/security-resources/posters/windows-forensic-...
1
vote
0answers
39 views

Lock screen when unauthorized USB device plugged into Windows

I read an article about how Ross Ulbrich get caught. Basically the FBI put an unauthorized USB that keeps his computer working. This is how they got a lot of evidences against Ulbrich. There is a ...
1
vote
0answers
30 views

Command line tool for file and registry monitoring

I would like to capture the files and registry changes etc during application installation through command line. Please help me to get such tools. Actually there are lot of tools available for this ...
1
vote
0answers
12 views

Recover file from a file

There are tools to recover files from broken hard disks, USB sticks or SD cards. I have an OLE file that was extracted from a Word document. That OLE file seems to contain a video. I'm looking for a ...
0
votes
1answer
19 views

Hash comparison tool or script

I need to see if there is a tool out there that can help me with a project I am working on. I have a remote set of files that we have imported a few TBs, the remote site has sent me a text file that ...