±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35984
New Yesterday: 0 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Tor Exit Nodes

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Christ143uk
Member
 

Tor Exit Nodes

Post Posted: Jun 02, 16 14:00

Hi,

Just wondering if anyone has any experience with examining computers where the defendant claims to have previously had the device set up as an "exit node" for Tor.

I have done some reading around where I have found it can potentially lead to data being left behind on the device and that being an exit node could attract unwanted attention from the Police.

If anyone has any useful information regarding exit nodes and Tor it would be appreciated.

Also if anyone knows how to tell if a computer has been/is currently being used as an exit node that would be great.

Thanks  
 
  

P_R_H
Member
 

Re: Tor Exit Nodes

Post Posted: Jun 02, 16 14:50

Hello Sir,

Assuming the defendant hadn't wiped the machine and rebuilt you should be able to locate the tor node config files, install files, etc..

You might also want to try the links below:

checker tool for existing nodes:-

www.dan.me.uk/torcheck

Tor exit node list:-

www.dan.me.uk/tornodes


Level of success will depend on when this person claimed to be running the exit node..  
 
  

Christ143uk
Member
 

Re: Tor Exit Nodes

Post Posted: Jun 02, 16 15:10

- P_R_H
Hello Sir,

Assuming the defendant hadn't wiped the machine and rebuilt you should be able to locate the tor node config files, install files, etc..

You might also want to try the links below:

checker tool for existing nodes:-

www.dan.me.uk/torcheck

Tor exit node list:-

www.dan.me.uk/tornodes


Level of success will depend on when this person claimed to be running the exit node..


Hi,

Thank you for the response, I have checked the list of nodes and can't find an email address corresponding to the user.

I have checked the "torrc" file and it doesn't appear to have the code required to set it up as an exit node; although the suspect claims to have disable this prior to seizure.

I will now run a keyword search to see if I can find anything relating to the code below:

ORPort 443
Exitpolicy reject *:*
Nickname ididntedittheconfig
ContactInfo [email protected]

Many thanks
Chris  
 

Page 1 of 1