Forensics: How to create a bitstream image of a live server
A typical scenario for creating a bit-image of a running server is an incident response situation where a critical server may or may not have been compromised or otherwise tampered with and needs to be...
View ArticleForensics: Using DD Over Netcat vs SSH
The following example are for theorectical use in a pinch. There are better methods when collecting live data from a computer. Also, it is better to use cryptcat rather than netcat- nighthawk dd is a...
View ArticleForensics: Erase/Zero out a drive
Before using a drive to copy forensic data on to it you should make certain the drive is completely free of past data. You can accomplish this by using the following command in your favourite variety...
View ArticleForensics: How to find the public key used to encrypt a file
When coming across encrypted files you may have a need to see what key was used to encrypt the file. Although this does not help you decrypt the file it can possibly provide a small piece of a much...
View Article
