All Questions
19 questions
1vote
0answers
141views
What traces are left on a flash card reader after using it? [duplicate]
If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used? I know OS can log ...
- 21
1vote
1answer
3kviews
What traces are left on a USB stick after using it?
If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...
- 21
0votes
0answers
629views
Can I view the format history of a usb key?
Is there a way to view when changes were made to a USB key, such as when the USB key was formatted and/or when some files were transferred? I have seen this previous stackexchange question File system ...
2votes
2answers
378views
iCloud deletion
If I delete photos which are stored in iCloud from my phone. (Which is also linked to my iPad) I know the data is then made ‘free space’ but is still on the phone In some format. If I delete it from ...
- 41
0votes
1answer
140views
Commodity Conversion Cables with Write Blockers
Looking at write-blocking devices I've notice a large variety of specialized hardware based on different source connector types, including USB-to-USB write blockers. It seems as though it should be ...
- 93
3votes
2answers
465views
Server protection measures from authorities
I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
- 31
4votes
1answer
2kviews
Can data be restored from a hard drive after using magnets to wipe the data? [duplicate]
Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
5votes
1answer
500views
What buses carrying sensitive information on a running computer are vulnerable to sniffing?
Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to ...
- 67.5k
10votes
2answers
6kviews
Magnet to wipe HDD [duplicate]
This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
- 1,292
1vote
1answer
338views
Can data be tampered with after expert clones a drive?
Introduction 3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were ...
- 125
1vote
1answer
578views
The use of SHA-1 in a cyber forensic
Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
- 125
2votes
2answers
4kviews
How to make data in hard disk unrecoverable on linux [duplicate]
I need to wipe completely the data on my hard disk so it's unrecoverable. I'm actually using Linux, i have seen this command on the web, but I don't know if its secure. shred -zvn 35 /dev/sdb
- 21
2votes
2answers
2kviews
ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software
I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
- 21
2votes
1answer
114views
Can one trace downloads in storage unit? [closed]
Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
2votes
1answer
2kviews
Autopsy/SleuthKit in the courthouse? [closed]
I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in ...
- 223
