±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 1
Overall: 27139
Visitors: 52

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Search found 116 matches

Re: How to use a RAM image to decrypt "encrypted containers"

Post Posted: Tue Mar 04, 2014 4:52 am

I do not quite understand what you mean by a "memory dump of an encrypted hard drive". Was it a small RAM disk located completely in the computer's volatile memory, and you have a dump of that? Or wha ...
Belkasoft
Topic: How to use a RAM image to decrypt "encrypted containers"
Replies: 11
Views: 3456
 

Re: File Carving

Post Posted: Fri Feb 28, 2014 11:31 am

You could do a full format of a small memory card to make sure it's completely empty. Then save this file onto the card, and use any carving tool (such as made by our company) to see what's available. ...
Belkasoft
Topic: File Carving
Replies: 7
Views: 1697
 

Re: Evidence of disk formatting and/or (massive) file deletion

Post Posted: Mon Feb 24, 2014 5:48 am

[quote="hlg33"]
1) Whether its hard drive has been reformatted and, if yes, when that formatting occured,

2) When were files (lots of them) have been deleted, that it the date and time when these ...
Belkasoft
Topic: Evidence of disk formatting and/or (massive) file deletion
Replies: 6
Views: 1081
 

Re: How to use a RAM image to decrypt "encrypted containers"

Post Posted: Mon Feb 24, 2014 5:39 am

What you need is a dump of the full working memory set for the PGP process including all drivers. The decryption key is stored somewhere in their data set. Is that what you mean by "memory dump of the ...
Belkasoft
Topic: How to use a RAM image to decrypt "encrypted containers"
Replies: 11
Views: 3456
 

Re: RAM memory imaging through FireWire attack

Post Posted: Mon Feb 17, 2014 4:51 am

[quote="jaclaz"]
In practice one has to see which of the three possible scenarios you are into:
[list=1]
[*]"normal" scenario (no anti-dumping tool running)
[*]"mild" scenario (e.g. commercial pro ...
Belkasoft
Topic: RAM memory imaging through FireWire attack
Replies: 9
Views: 2602
 

Re: RAM memory imaging through FireWire attack

Post Posted: Mon Feb 17, 2014 4:46 am

[quote="Okti"]No. I understand there are different techniques when it comes to memory acquisition, I was just wondering if anyone would do memory capture through firewire attacks these days. But anywa ...
Belkasoft
Topic: RAM memory imaging through FireWire attack
Replies: 9
Views: 2602
 

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 5:17 am

I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recomm ...
Belkasoft
Topic: FTK Imager stalling --
Replies: 12
Views: 3302
 
Page 1 of 17
Go to page 1, 2, 3 ... 15, 16, 17  Next