Skip to main content

Home/ Groups/ ComputerForensicsTV
cftvgroup

Top 20 Free Digital Forensic Investigation Tools for SysAdmins - 0 views

  • Sleuth Kit is an open source
  • CAINE (Computer Aided INvestigative Environment) is Linux Live CD
  • disk image, file, or directory of files and extracts information such as credit card numbers, domains, e-mail addresses, URLs, and ZIP files.
cftvgroup

Understanding the Android File Hierarchy | Android News for Costa Rica - 0 views

  •  
    "thumb"
cftvgroup

Windows 10 Forensics - AFENTIS FORENSICS - 0 views

  • The start screen from Windows 8 is no longer there
  • The difference is rather than protecting the drive as a whole each file is now protected by BitLocker, so if a file is removed from the drive it will still carry the protection that was added to it during the BitLocker process.
  • Trusted platform module (TPM) is still not needed to use BitLocker
  • ...10 more annotations...
  • Signed driver enforcement
  • The new multi desktop
  • New sharing and security options for folders now include permissions, auditing and effective access as well as giving the user more control of how the folder is shared and who can view it.
  • Phone authentication could be through a number, NFC or built in alert/application.
  • When file’s properties are opened it now shows a ‘Previous Versions’ tab which shows any older versions of this file along with the date it was last modified. This will help determine if the file has been edited and when it happened.
  • Microsoft is also including “next generation user credentials” which will allows single sign in everywhere.
  • Per application VPN is being added to W10,
  • There is now a folder called Home on the file explorer that allows the user to view favorites, frequent folders and recent files. This could help determine what the user has been opening from their files.
  • W10 will still use NTLM and LSAAS meaning the various password cracking tools that forensic investigators use such as rainbow tables will still work in the same way on W10.
  • TPM or software KSP attestation based authentication means there won’t be any secrets on the disk. This will allow the users to have hardware based authentication which will be more secure and quicker to use. This will only feature on machines that house a TPM chip which will store the keys. This type of authentication is secure as it has good resistance against attacks since it is based on hardware within the machine and harder to access
cftvgroup

RaiderSec: How Browsers Store Your Passwords (and Why You Shouldn't Let Them) - 0 views

  • Since sources are a bit tough to find in one place, I've decided to post the results here, as well as show some simple code to extract passwords from each browser's password manager.
cftvgroup

Plists | Taksati - 0 views

  • internal structure of Plist files
  • Plist files are found sprinkled throughout OS X and iOS and contain the various configuration settings and other information of use to the OS and applications.
  • Plists are key/value pairs that are stored in either text or binary.
  • ...2 more annotations...
  • XML is not a very efficient way to save data on disk
  • So, Apple introduced a binary format. When opened in something that doesn't like it, it will look like this
cftvgroup

Bulk Extract EXIF | Taksati - 0 views

  • Can you script that so I can do that to several hundred files, he said. Don’t have to, I said…
  • ExifTool is a extremely powerful command line utility that has been around since 2003. It is still actively maintained and has grown to encompass so many metadata types beyond EXIF that it has well outgrown its name. It also has some very powerful formatting and processing capabilities in it, making bulk extraction of just the data you want an easy task.
  • produces 38 data points
  • ...10 more annotations...
  • Irfanview
  • There is a lot of really good info in executable files,
  • Run Time Since Power Up : 5 days 2:24:57
  • But, ExifTool against the same file produces 72 data points.
  • And, since .dll files are structurally identical to .exe files, we get very similar data from them.
  • internal metadata inside office documents
  • Can recurse subdirectories if the target is a directory.
  • Can specify multiple filetypes using -ext switch instead of file mask.
  • Control the output format with -T, -csv, -json.
  • It should be one of your favorite tools.
cftvgroup

Root command execution bug found across wireless router range - 0 views

  • A currently unpatched bug in ASUS wireless routers has been discovered whereby users inside a network can gain full administrative control, according to recent research conducted by security firm Accuvant.
cftvgroup

DEFT Zero (beta) ready for download | DEFT Linux - Computer Forensics live CD - 0 views

  • This new mini DEFT distro is fully optimized for the acquisition and hashing of mass storage devices, in just 400 MB! Due DEFT Zero’s light weight and the fact that it can be loaded entirely into RAM at computer boot, it allows you virtually to turn any computer (even a really obsolete one) into a storage media cloner device.
  • final public BETA of DEFT Zero
cftvgroup

Sitting for too long can kill you, even if you exercise: study - 0 views

  • Sitting on one’s butt for a major part of the day may be deadly in the long run — even with a regimen of daily exercise, researchers say.
  • amount of time a person sits during the day is associated with a higher risk of heart disease, diabetes, cancer and death, regardless of regular exercise.
  • Our study finds that despite the health-enhancing benefits of physical activity, this alone may not be enough to reduce the risk for disease.”
  • ...4 more annotations...
  • prolonged sedentary behaviour was associated with a 15 to 20 per cent higher risk of death from any cause;
  • “We need to get sedentary behaviour on our radar and start talking about that, not just exercise
  • So the total spectrum of movement within the 24-hour period is critical.
  • This paper shows in a very robust fashion that you can be active and that in and of itself is not going to protect you from ignoring the other part of the day
cftvgroup

Taylor & Francis Online :: Attributing Cyber Attacks - Journal of Strategic Studies - V... - 0 views

  • Three common assumptions
  • The second assumption is a binary view on attribution: for any given case, the problem can either be solved,77 Former Secretary of Defense Leon Panetta famously said on the USS Intrepid, ‘the [DoD] has made significant advances in solving a problem that makes deterring cyber adversaries more complex: the difficulty of identifying the origins of an attack.’ Leon Panetta, Remarks on Cybersecurity to the Business Executives for National Security, New York City’, Washington DC: Department of Defense, 12 Oct. 2012.View all notes or not be solved.8
  • The third common assumption is that the attributive evidence is readily comprehensible, that the main challenge is finding the evidence itself, not analysing, enriching, and presenting it.1010 The most influential articles on intrusion analysis seem to assume that the evidence speaks for itself, as they do not focus on the problem of communicating results to a non-technical audience. The two most influential and useful contributions are the ‘Diamond Model’, see Sergio Caltagirone, Andrew Pendergast and Christopher Betz, The Diamond Model of Intrusion Analysis, ADA586960 (Hanover, MD: Center for Cyber Threat Intelligence and Threat Research 5 July 2013), as well as the ‘Kill Chain’ analysis, see, Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains (Bethesda, MD: Lockheed Martin Corporation 2010).View all notes
  • ...10 more annotations...
  • if evidence is inconspicuous and equivocal, how should it be marshalled and analysed? How should attribution as a whole be managed and communicated to third parties?
  • if attribution is not a binary affair but a matter of degree, what, then, is normal attribution and how is high-quality attribution different from low-quality attribution?
  • if attribution is not first and foremost a technical problem, what is it instead?
  • On an operational level, attribution is a nuanced process, not a simple problem.
  • The tactical goal is understanding the incident primarily in its technical aspects, the how. The operational goal is understanding the attack’s high-level architecture and the attacker’s profile — the what. The strategic goal is understanding who is responsible for the attack, assessing the attack’s rationale, significance, appropriate response — the who and why. Finally communication is also a goal on its own: communicating the outcome of a labour-intensive forensic investigation is part and parcel of the attribution process, and should not be treated as low priority. Indeed public attribution itself can have significant effects: offenders may abort an operation, change tactics, or react publicly to allegations, thus shaping the victim’s wider response
  • Detail is critical. But detail can also overwhelm.
  • In complex scenarios, only a small fraction of the attribution process will be visible to senior officials and politicians, and an even smaller fraction to the public.
  • First, releasing more details will bolster the credibility of both the messenger and the message.
  • A second reason favours release: publishing more details will improve attribution itself. When a case and its details are made public, the quality of attribution is likely to increase.
  • The third benefit of openness may be the most significant one. Making more details public enables better collective defences.
cftvgroup

Grady Judd's sex stings under microscope with officers breaking rules - 0 views

  • the tactics they're using to put alleged sexual offenders in jail are sweeping up large numbers of law-abiding men, too.
  • they now routinely post more innocuous personal ads of adults on traditional dating sites. When men – many of them under 25 with no criminal history - respond, officers switch the bait and typically indicate their age is really 14 or 15 years old. However, sometimes the storyline isn't switched until the men, who were looking for legal love, already start falling for the undercover agent.
  • Officers bend rules in sex stings to boost arrest totals.
  • ...6 more annotations...
  • law enforcement is also now routinely making first contact with men who have done nothing wrong,
  • judge
  • the officer controlled the tone, pace and subject matter of online conversation, pushing toward a discussion of sexual activity.
  • Almost all of South Florida's law enforcement agencies have moved away from the stings as well. The Broward County Sheriff's Office, which is in charge of the South Florida ICAC task force, told 10 Investigates it was time for the agency to move on to other areas of cybercrime fighting.
  • no place in modern day law enforcement
  • Ryan adds that officers are pushing the boundaries further and further to keep up their arrest numbers and keep the federal ICAC grants flowing. And responding to legal ads on legal dating sites crosses the line.
1 - 13 of 13
Showing 20 items per page