Questions tagged [forensics]
The forensics tag has no summary.
70 questions
0 votes
0 answers
32 views
How can I Determine CUDA update version based on installed toolkit files?
I've installed some version of the CUDA toolkit to /usr/local/cuda. Suppose I don't have access to any information about the system, like activity logs, package management state and such - I'm only ...
- 11.1k
0 votes
0 answers
1k views
Searching strings in raw disk image
I am currently writing a tool that should scan a readonly raw disk image for a a given pattern. The task is to get the byte offset of the match. I am able to find simple text documents with grep -a -o ...
- 11
0 votes
1 answer
148 views
RabbitMQ, SCP in Linux dropping connections
In GNU/Linux I have an issue with an application I have made. It works in my development environment, most of the components running in dockers or natively, but it randomly (often, but not always) ...
- 238
0 votes
1 answer
124 views
Why does drive image show different start partition free size?
I made an image of /dev/sdc. The free space before the first partition isn't reporting the same byte sizes, but why? The start position is reported as 1024B on the drive and 16384B on the image? # ...
- 1,920
-1 votes
1 answer
2k views
How to recover accidently deleted files from RedHat file server
one of my friend accidently deleted all files (jpg and pdf) from file server by using rm -rf command .is there is a way to recover those files with actual file names? key points - there is no backups ...
- 1
0 votes
0 answers
615 views
Recover files from accidently formatted NTFS dd image by Magic Bytes?
I have an dd image of a partition that once had a Windows 10 NTFS filesystem and then got accidentally formatted (or so I assume) and now has a pretty empty NTFS with only an empty Windows directory ...
- 755
3 votes
4 answers
1k views
Find pattern on multiple lines within BIG log files
To investigate within logs, I am trying to find the very first time a vulnerability in a workflow has been exploited. The pattern is on multiple lines. The pattern would be AAAAAAAAA BBBBBBBBB ...
- 31
2 votes
2 answers
2k views
What is the equivalent of autoruns tool in linux for finding suspicious startup executables?
In Windows, Autoruns tool is a really helpful tool for forensic investigators to help them find suspicious startup executables and filter the benign ones. but i couldn't anything good like this in ...
- 177