Computer Hacking Forensic Investigator

Understand-the-Importance-of-Network-Forensics

Understand the Importance of Network Forensics

Leave a Comment / CHFI / By

Understand the Importance of Network Forensics in this this article Network Forensics is the implementation of sniffing, recording, acquisition, and analysis of network traffic and event logs to investigate a network security incident. Capturing network traffic over a network is simple in theory, but relatively complex in practice due to many inherent reasons such as the large amount of data flow and complex nature of Internet protocols. Recording network traffic involves a lot of resources. …

Understand the Importance of Network Forensics Read More »

Linux-Forensics

Linux Forensics

Leave a Comment / CHFI, Knowledge Base / By

Linux forensics refers to performing forensic investigation on a Linux operated device. To do so, the investigators should have a good understanding on the techniques required to conduct live analysis; to collect volatile and non-volatile data, along with knowledge of various shell commands and the information they can retrieve. The investigators should also be aware of the Linux log files, their storage and location in the directory, as they are the most important sources of information …

Linux Forensics Read More »

Inside-the-Registry

Inside the Registry

Leave a Comment / CHFI / By

A Windows Registry contains potential information which is of evidential value and can support the forensic analysts in exploring the different aspects of forensic investigation. A forensic analysis in general is performed with a specific agenda in mind. In the forensic investigator’s perspective, it is essential to know the type and significance of information to look for, and also where to find it. Forensic investigations which involve a windows platform vigorously require a careful assessment …

Inside the Registry Read More »

Understanding-EProcess-Structure

Understanding EProcess Structure

CHFI / By

Understanding EProcess Structure in Each process on the Windows operating system is associated with an executive process or Eprocess block. It is the basic data structure that stores various attributes of the process and the pointer to the other attributes and data structures related to the process. The investigator can read this data structure. The data structure is essentially a sequence of bytes, with each sequence having a particular meaning. The size and even the …

Understanding EProcess Structure Read More »

Collecting-Hidden-Partition-Information

Collecting Hidden Partition Information

Leave a Comment / CHFI, Knowledge Base / By

In this article explain Collecting Hidden Partition Information and diffrent types of hard disk partition and file formates. 1. Partition Logic Partition Logic is a hard disk partitioning and data management tool. It can create, delete, erase, format, defragment, resize, copy, and move partitions and modify their attributes. It can copy entire hard disks from one to another. 2. Partition Find & Mount Partition Find & Mount implements a new concept of deleted or lost …

Collecting Hidden Partition Information Read More »

Other-Important-Information-of-forensic-Investigation

Other Important Information of Forensic Investigation

Leave a Comment / CHFI, Knowledge Base / By

In this article explain Other Important Information of forensic Investigation using investigator. Clipboard Contents Clipboard is a temporary storage area, where the system stores data during copy and paste operations. Most Windows applications provide this functionality through the Edit option on the menu bar, Clicking Edit reveals a drop-down menu, which contains choices, like cut, copy, and paste. The user selects text or other data, chooses copy, and then chooses Paste to insert that data …

Other Important Information of Forensic Investigation Read More »

How-to-Open-Files-using-Command -Line

How to Open Files using Command Line

Leave a Comment / CHFI, Knowledge Base / By

Open Files using Command Line in this when the output obtained from psloggedon.exe commands shows the investigators that there are users logged on to the system remotely, then the investigators will also want to see what files have they opened, if any. Many times when someone accesses a system remotely, they might be looking for something specific while opening files. A user in a corporate environment could have shared available content and allowed other users to …

How to Open Files using Command Line Read More »

Introduction-of-Windows-Forensics

Introduction of Windows Forensics

Leave a Comment / CHFI / By

Windows Forensics, include the process of conducting or performing forensic investigations of systems which run on Windows operating systems, It includes analysis of incident response, recovery, and auditing of equipment used in executing any criminal activity. In order to accomplish such intricate forensic analyses, the investigators should possess extensive knowledge of the Microsoft Windows operating systems. This module will discuss about collecting volatile and non-volatile information; performing windows memory and registry analysis; cache, cookie, and …

Introduction of Windows Forensics Read More »

Introduction-to-Operating-System-Forensics

Introduction to Operating System Forensics

Leave a Comment / CHFI, Knowledge Base / By

Operating System Forensics is that the process of retrieving useful information from the OS (OS) of the pc or mobile device in question. The aim of collecting this information is to accumulate empirical evidence against the perpetrator. An OS (OS) is that the software component of a computing system that’s liable for the management and coordination of activities and therefore the sharing of the resources of the pc . The OS acts as a number …

Introduction to Operating System Forensics Read More »

Anti-Forensics-Tools

Anti-Forensics Tools

Leave a Comment / CHFI / By

In this article Explain different types of Anti-Forensics Tools which are using in forensic investigation. 1. Steganography Studio Source: http://stegstudio.sourceforge.net Steganography Studio is an anti-forensic tool to analyze the key steganographic algorithms. This tool implements algorithms that are configurable with a variety of filters. It implements the image analysis algorithms for the detection of hidden information. The software is developed in Java, allowing use in multiple OSs. 2. CryptaPix Source: http://www.briggsoft.com CryptaPix is an anti-forensic …

Anti-Forensics Tools Read More »