Hello,

I’ve installed SIFT workstation on WSL. I know SIFT comes pre loaded with volatility 2 , but would like to upgrade to 3. I’ve installed volatility 3 however every time I run vol.py it uses 2 and not 3.

Any pointers?

I'm looking for vendor-neutral training, and my job will be paying for the training (so money shouldn't be an issue)

I recently started using volatility 3, so many changes made to volatility 2 to 3 update, ISF symbol is one thing. Recently am facing some challenges while I try to create an symbol for Raspberry Pi 4 Model B (running kali: kernel version: 5.15.44-Re4son-v8l+). Is it possible to create symbol for raspberry based kali linux? Is anyone done RAM analysis on raspberry based hardware? If, so would you please guide me.

Made a 2024 Google survey to get a feel on the DFIR industry and salary. You can fill it out here: https://forms.gle/Zfjx7rrBGnoQHrp9A (it is set to not collect email or user account)

Last year we have 45 people fill it out and it seem to give a good sample data.

I want to try to get an Idea of salary ranges and backgrounds of people in the field.

It will be based on:

Education background

How many years have you been in the DFIR field

Do you hold any certifications from the following vendors

Are you currently happy with your current job

Would you consider yourself overworked or burnt out

What is your current salary

What is your job role (select all the applies)

Role level

Do you feel underpaid

How many times have you swapped jobs/companies

Are you Law Enforcement or Private Sector

What advice would you have for recent graduates or newcomers to the DFIR community

I'll be closing this out May 15th and then supply the results.

The last survey from last year can be viewed here: https://docs.google.com/document/d/e/2PACX-1vQmfZozAOYjGpH4giK7BsBTelf-G-_DD0A0kIbzs3dwZmtV75IvZ1raTjw_aSDEC52BtrAijz3ulN7k/pub

I want to know under what circumstances would push tokens tied to a user ID be kept on apple servers. Would a reset/wipe of iPhone cause the token to be removed from server?

Hello,

I'm frequently doing capture the flag events featuring forensics challenges, I've been using Volatility 2 and 3 to find interesting stuff and was wondering if there was other softwares, available on Linux that were more practical, or with more features oriented toward CTF.

For example, I'm working on a challenge that hints that there is a deleted file, I can see its record on mftparser but I'm not able to dump its content as it's absent from windows.filescan, so maybe I'm not using the proper tools?

Thanks a lot!

Hey all,

I’m working on a case and a client is trying to obtain cell tower coordinates - does this information get saved to the iPhone itself or would the phone carrier have this information?

If it does get saved to the iPhone, would I need something like Verakey or Cellebrite to obtain that data? An encrypted backup parsed with Axiom didn’t reveal that information. I’m curious if it even exists, or if I’m chasing a ghost.

Thanks in advance.

It has been almost two decades since I've handled anything forensics and I have a few questions and need some recommendations please. If this is incorrect post, please remove. All my questions and needed recommendations involves having 1-3 person part-time team imaging 98% laptops and some mobile devices. The images will be kept for several years and potentially used in court proceedings. Yes, they are cheap and not looking to spend $2 million on stuff. I'd be lucky to get 20-25K as a budget.

1. Can you image Macs without taking the drive out? If so, what is the recommended method or software/device combo? Is there a 'these Macs you have to and these Macs you don't' list?
2. What is the recommended method/tool for Windows systems?
3. Let's add in Linux as well.
4. What is the recommended method/device to take an image in our storage and transfer to another drive for a legal disclosure?
5. Mobile devices, probably 70/30 Android/iOS. What is recommended software/tool/device for these? Androids are mostly tablets while iOS would be corporate phones.

Leadership is big about not taking the drives out to image them (especially Macs) and was looking at a FRED device but I don't know if FRED can do images without removing the drive(s), especially on Macs.

I'd like to get a little forensic drive wiping device as well. Last I remember those were 1-48 drives at a time systems, depending on size.

Thank you for your help on this.

We are looking around for options for replacing our Enterprise Forensics software, I don't want to name names on who we are currently with but who are you currently using? I want to review a few but don't know which ones I should be considering.

Thanks.

Is there anyway to retrive airdropped data log from a week ago after the laptop has been factory reset?

Background: CS Degree, software programming. 0 in digital forensics. Law enforcement/social career adjacent, wanna pursue further into this space.

What are the highest in demand certificates? Im really looking to get into forensics without going back to school. Small courses are fine as long as they arent like 10k.

I dont know what exactly to go for or certificates/programs that are BS.

Help me please!

In August 2023, we observed an intrusion that started with a phishing campaign using PrometheusTDS to distribute IcedID, which eventually ended in Dagon Locker Ransomware.

https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/

Hey everyone,

I've been struggling with this issue for days and could really use some help. I'm trying to view a .dmg file in VMware on my Windows 11 computer, but I've hit a roadblock. I've managed to mount the .dmg file in HFS Explorer, but when I converted it to .vmdk to view it in VMware, I keep getting an error saying "no media" in the boot menu.

I've tried troubleshooting by checking file integrity, verifying disk permissions, and even restarting VMware services, but nothing seems to work.

If anyone has experience with this or has any suggestions on how to resolve this issue, I would greatly appreciate your help!

Thanks in advance!

Hello all,

I'd like to hear your to-go plan on executing forensics and providing analysis on isolated INFECTED windows laptop.

Very Important!!!: You have 'green' light on performing forensics directly on the machine, because the laptop itself will be re-imaged afterwards due to the infection. You don't need to create an image of the drive.

Below I'll list my simple plan on how I would do it - Please provide your own plan and correct me if my plan makes no sense.

1. I would install all needed forensics tools that I'll use to a USB drive.

2. I'll plug in the USB to the infected laptop

3. I'll start with KAPE to extract whatever artifacts

4. I'll then use the various tools(from this list - https://nasbench.medium.com/windows-forensics-analysis-tools-and-resources-b819c8b4b6b0 ) to further analyze the artifacts.

5. For event logs analysis - EvtxECmd by EZ. Throw the output into Timeline Explorer.

Your Turn!

Having an issue trying to extract data from an iOS device using Autopsy. I have the correct plugin downloaded and installed for the module to work properly. I get all the way to the last step where it asks what you want for it to pull, when i click next, it buffers like it’s starting the extraction… then i get an error stating “iOS device connection problem” any ideas what i can do to fix this?

Edit: I have an iPhone X Plus and an iPhone 14 Plus

The iPhone X has 16.0.3 The iPhone 14 has 17.4.1

Hello I have loaded my image on autopsy and I’m trying to find the outlook logs. I’m search for the ost file but I can’t find it? Any ideas?

Hello DFIR experts:)

I'm looking for advice/s - First of all, I would make it as short as possible in order to not bore people and at the same time to keep the anonymity at a good level.

So I've got 2 laptops in front of me:

Laptop 1: Personal (probably infected)

Laptop 2: Corporate owned - isolated from network (probably infected)

Equipment:

No write hardware write blockers are available

Scenario:

Laptop 1 and Laptop 2 needs to be investigated - I want to make a copy of the Hard Disks in order to use tools like Autopsy,etc to parse the data and extract artifacts. I also want to extract the Windows Event Logs in order to parse them using Chainsaw.

Question:

What is/are the best method/s to achieve this having in mind we don't have a hardware write blocker?

Any opinions on what path there are after doing collections for an ediscovery company.

If a threat actor is logged into a computer remotely and they take screenshots of data, can they exfil the data to their own USB using tsusbhub.sys (Remote Desktop USB)? If so, what might that look like in the event logs?

Hey everyone,

Currently unemployed following burnout (left to focus on my mental health). Found I am autistic (probably ADHD too) and looking to get back into work, but in a job that better suits me.

A bit about me:

Master’s in Computing

8 years’ experience in IT (about 5 in sysadmin, 2 in cloud services (Azure/M365) and the last in enterprise architecture).

Used to sell consumer electronics and have repaired iPhones so fairly familiar with consumer devices too.

Wanting to move into cybersec and digital forensics ticks all my boxes for the ideal job. I’m a good communicator (written and verbal) with good attention to detail and love troubleshooting/investigating. I feel like I won’t burn out in this job as it’s gonna have a good balance of solitary work vs comms whereas ent arch was back to back meetings.

What is the best way to get into this field (taking into account my existing experience)? Postgrad degree in forensics? Cyber bootcamp? Certs?

I want to get into work asap so the quicker the better (not compromising on quality of learning of course)

Thanks!

Hello everyone! I have a couple of questions about the consistency of hashes when acquiring an SSD, but I still have some doubts. I know that if a physical acquisition (sector by sector) of an SSD is performed, the hashes are likely not to match if further acquisitions are made from the same device (due to wear-leveling, TRIM, etc.).

However, what I'm not entirely clear on is: if I acquire a partition (logical acquisition), and subsequent acquisitions are made from the same device, the hashes will match, right? Because here, not all sectors (only active sectors, without unused or pending for deletion sectors) are cloned and hashed. I understand that these can also be moved to physical areas of the SSD, but would the hash still be the same? I'm guessing it would, because it's the same logical address and the existing data is not modified. Is that right or I'm missing something.

Thanks in advance!

I'm currently pursuing my undergrad in computer science and realized I don't like software development. I've always had my eye on computer forensics since I originally wanted to do criminal justice. How can I get started with this subject?

Also (random question), do employers prefer applicants with computer science degrees?

This is a random question I'm sure it's not but maybe more niche?

Background: started in a private forensics lab but most of the work I did was just collections for eDiscovery tools. I did help our examiners with minor examinations and they'd check my work such as. Did they wipe their computer? Look for suspicious activity/file transfers (mostly IP theft) etc... I had a lot of fun of learning and growing to really like what I was doing great examiner who always challenged us.

Company closed.

Got another job where I knew I would be doing most collections. But everyone I networked with is also just doing collections and eDiscovery processing. I do know some labs that still do CF but most just are hired for collections that we can't perform etc... tools.

Anyone with a lot of experience in the private sector notice a decline in actual forensics?

Edit: meant private labs/companies.

Is there any site where I can find extracted android data for testing and analysing purposes?

I'm really interested in this field and i wanna know what degree would be better for a bachelors.
Do I even need a degree in criminal justice? I'm really interested in joining some federal or law enforcement sector

I'm trying to perform a full memory dump from a Windows PC to which I don't have administrator access. Is this possible? Up to now the various solutions I have found still require elevated privileges, even software like FTK or FDD.
Thanks all

I’m not the strongest public speaker in the world and my boss asked my to give a 30m presentation on digital forensics. The audience will be college students. The topic needs to be digital evidence at the municipal policing level.

Any tips on talking points? I’m very bad at this 😭

Hey, everyone!

I just released version 1.2.1 of my OSINT / forensics tool, Horus.

Here's a link: GitHub

Here's a description of the project:

Horus is an all-in-one encompassing tool for investigations assistance, from API leveraging to compiling data. It is still a work in progress, but feel free to check out the GitHub page here. Horus has many features, ranging from IP tracking to Virustotal scans, all from your terminal!

What's Changed:

• added the following features: Numlook, Geolock, Cryptotrace, Mactrace, Pvpn
• added commands to options

Question for the analysts out there - how on earth do you get Cellebrite PDF reports to sort the entries by chronological order? I’ve tried the options of Sort by view / default when creating the report, and sorting the views in each window by date/time etc but the reports never come out as per the screen view? It makes the pdfs useless for disclosure if nobody can follow a conversation, or device events which flicking back and forth through multiply pages. Magnet Axiom does sorting correctly but their pdfs are very limited - they don’t even hyperlink to the file to play videos / images etc.

Thanks

Know of any tools where AI is used to help analyze digital data? Maybe some popular software already uses something like this?