+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: The Lounge (https://sinister.ly/Forum-The-Lounge)
+--- Thread: Computer Forensics (/Thread-Computer-Forensics)
Pages:
1
2
Computer Forensics - dismay - 05-20-2019
Has anyone researched computer forensics or any form of personal study in your spare time? If so, what was it? Do you do it regularly?
What was the most interesting thing that you found whilst doing it?
I'm currently trying to keep my distance from video games as it has been a burden in my life for the longest time. 55 hours a week isn't healthy
RE: Computer Forensics - Sartux - 05-20-2019
Good you're trying new things. What do you mean by computer forensics? Do you mean stuff like file carving?
Its an interesting area but I find pentesting and coding more interesting/rewarding. Sometimes you just cant find forensics whereas no system is unbreakable and you can code anything you can imagine. Just my thoughts on it.
RE: Computer Forensics - dismay - 05-20-2019
(05-20-2019, 03:21 PM)Sartux Wrote: Good you're trying new things. What do you mean by computer forensics? Do you mean stuff like file carving?
Its an interesting area but I find pentesting and coding more interesting/rewarding. Sometimes you just cant find forensics whereas no system is unbreakable and you can code anything you can imagine. Just my thoughts on it.
Honestly, I have no idea yet. This is why I believe it would be a fun journey to learn something new as I only have prior Wireshark experience.
Personally, I attempted to learn the language C but I lost interest quite quickly. I do see your point, learning forensics without coding experience isn't a good idea—I'll keep it in mind.
RE: Computer Forensics - q0xd - 05-20-2019
(05-20-2019, 03:51 PM)vex. Wrote:(05-20-2019, 03:21 PM)Sartux Wrote: Good you're trying new things. What do you mean by computer forensics? Do you mean stuff like file carving?
Its an interesting area but I find pentesting and coding more interesting/rewarding. Sometimes you just cant find forensics whereas no system is unbreakable and you can code anything you can imagine. Just my thoughts on it.
Honestly, I have no idea yet. This is why I believe it would be a fun journey to learn something new as I only have prior Wireshark experience.
Personally, I attempted to learn the language C but I lost interest quite quickly. I do see your point, learning forensics without coding experience isn't a good idea—I'll keep it in mind.
I've been meaning to learn more about computer forensics, I find it a really interesting topic.
https://en.wikipedia.org/wiki/Digital_forensics < Guess that could be an ok starting point.
RE: Computer Forensics - catchnina - 05-20-2019
A good start in forensics is FTK or the Slueth Live CD, you can find all types of crazy stuff about things you thought were hidden or not available
RE: Computer Forensics - mothered - 05-21-2019
I delved Into It many years ago- data recovery/acquisition, validation of digital evidence for the most part, was very Interesting Indeed.
RE: Computer Forensics - Magnetron - 05-21-2019
(05-20-2019, 02:43 PM)vex. Wrote: Has anyone researched computer forensics or any form of personal study in your spare time? If so, what was it? Do you do it regularly?
What was the most interesting thing that you found whilst doing it?
I'm currently trying to keep my distance from video games as it has been a burden in my life for the longest time. 55 hours a week isn't healthy
X-Ways Forensics, that's the program the feds will use to bust you when they grab your PC. Back in the day, I realized if I was gonna become a hacker that I had to be smarter than the cops and the only way to protect myself from their methods was to learn their methods. I used to have a regular routine of overwriting free space, MFT records, secure deletion of files, dislodging the paging file upon shutdown, keeping all my private stuff in passworded RARs, using temp file/cookie erasers, all sorts of nitpicky shit.
Thankfully, all these outlandishly paranoid habits have been made obsolete by one simple program: Truecrypt. If you encrypt your entire system drive, you're set and forensics can kiss your indifferent ass.
Now the only way to access your data is to grab your password with a keylogger.
Forensics can still be useful in the event of a crash or accidentally deleting your own stuff, however.
I recovered a video that took me 16 hours to edit one time. Another time, the piece of shit Windows Disk Manager deleted all 8 partitions on a 2TB drive. One partition in particular was very difficult to recover but I did it. And the ultimate: a 250GB USB stick failed and the filesystem was corrupted so I had no choice but to recover everything by hand, a process which took 6 months. Every repair shop told me it would be impossible, every tech forum on the internet said the same. I offered $10,000 to anyone who could do it and nobody took the offer. I did the impossible.
Forensics is pretty fucking useful.
RE: Computer Forensics - dismay - 05-21-2019
(05-21-2019, 06:29 AM)Magnetron Wrote:(05-20-2019, 02:43 PM)vex. Wrote: Has anyone researched computer forensics or any form of personal study in your spare time? If so, what was it? Do you do it regularly?
What was the most interesting thing that you found whilst doing it?
I'm currently trying to keep my distance from video games as it has been a burden in my life for the longest time. 55 hours a week isn't healthy
X-Ways Forensics, that's the program the feds will use to bust you when they grab your PC. Back in the day, I realized if I was gonna become a hacker that I had to be smarter than the cops and the only way to protect myself from their methods was to learn their methods. I used to have a regular routine of overwriting free space, MFT records, secure deletion of files, dislodging the paging file upon shutdown, keeping all my private stuff in passworded RARs, using temp file/cookie erasers, all sorts of nitpicky shit.
Thankfully, all these outlandishly paranoid habits have been made obsolete by one simple program: Truecrypt. If you encrypt your entire system drive, you're set and forensics can kiss your indifferent ass.
Now the only way to access your data is to grab your password with a keylogger.
Forensics can still be useful in the event of a crash or accidentally deleting your own stuff, however.
I recovered a video that took me 16 hours to edit one time. Another time, the piece of shit Windows Disk Manager deleted all 8 partitions on a 2TB drive. One partition in particular was very difficult to recover but I did it. And the ultimate: a 250GB USB stick failed and the filesystem was corrupted so I had no choice but to recover everything by hand, a process which took 6 months. Every repair shop told me it would be impossible, every tech forum on the internet said the same. I offered $10,000 to anyone who could do it and nobody took the offer. I did the impossible.
Forensics is pretty fucking useful.
Damn, it's one of the reasons why I want to learn Forensics, not because I'm doing illegal things but the information is there in my head if I ever need it. I use tools on the weekly that would be technically forensics: WinDirStat to find files (I do this to deleted large/unused videos) I use Recuva to recover deleted files off my system. As you mentioned, I have also lost files and never retrieved them, I also had people willing to pay may to recover files but I only have limited knowledge except for basic recovery with the Recuva software.
There is no use of my computer being Encrypted but when I buy a new laptop it will most likely be secured.
I 'ironically' found a copy of this Udemy Course for free, it has a lot what you have mentioned, including the step-by-step on how authorities handle your data and devices https://www.udemy.com/computer-forensics-crime-investigation-using-open-source-tools/
RE: Computer Forensics - Magnetron - 05-21-2019
I haven't used Recuva but be sure to use multiple tools to make sure you're getting the best you can get. If you can manually recover a deleted file with a hex editor but the program can't, get rid of it.
'vex Wrote:WinDirStat to find files (I do this to deleted large/unused videos)
It has a nice graphic view but it should use the MFT for instant searching like TreeSize does. I have no patience to wait 10 minutes for it to finish traversing the drive. Honestly, I have no clue why the aforementioned method isn't THE standard.
Quote:I 'ironically' found a copy of this Udemy Course for free, it has a lot what you have mentioned, including the step-by-step on how authorities handle your data and devices https://www.udemy.com/computer-forensics-crime-investigation-using-open-source-tools/
Much has changed with the advent of SSDs with all their wear-leveling schemes that now make recovering shit from a crashed drive way harder than before. Incidentally, this also has security risks if unencrypted data ever touched the drive. If you overwrite the sensitive data, chances are the write happened somewhere else and the sensitive data was merely reallocated.
RE: Computer Forensics - Sartux - 05-28-2019
(05-21-2019, 06:29 AM)Magnetron Wrote: Forensics can still be useful in the event of a crash or accidentally deleting your own stuff, however.That's damn impressive. Good work.
I recovered a video that took me 16 hours to edit one time. Another time, the piece of shit Windows Disk Manager deleted all 8 partitions on a 2TB drive. One partition in particular was very difficult to recover but I did it. And the ultimate: a 250GB USB stick failed and the filesystem was corrupted so I had no choice but to recover everything by hand, a process which took 6 months. Every repair shop told me it would be impossible, every tech forum on the internet said the same. I offered $10,000 to anyone who could do it and nobody took the offer. I did the impossible.
Forensics is pretty fucking useful.
Do you mind me asking what tools you used?