forensics

Retrieving the search keywords from a search result entry (Google)

by

Is it possible to go back to the actual google query string given one or more URL results? for example, if I do a search using the keyword “pippo” I get this first entry: http://www.google.it/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CCIQFjAA&url=http%3A%2F%2Fwww.pippo.it%2F&ei=kFSeVdCSDeGC7galoYKwCA&usg=AFQjCNFFQZzm2gZe25THufXZmDrZMWkzFg&sig2=2l9_gUfNQMHfipPwFnVkRA&bvm=bv.96952980,d.ZGU Is it possible, given that entry, to retrieve back the “pippo” keyword? Or at least a set of keywords which … Read more

Trace IP traffic to physical machine under Linux

by

In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine is intended to use this net. I guess that the source is a linux machine 2 hops from the firewall, which could … Read more

Extract list of installed drivers using a linux live disk

by

I have a quit old PC that was running Windows 2000 but the system crashed some days ago. Now I need to know which drivers have been installed on that specific pc but the system isn’t booting anymore and the rescue and recovery options failed. Now I need to know which drivers have been installed … Read more

Examine contents of unused space on the HDD

by

When using managed dedicated services, either virtual or physical, where you’re presented with complete control to an operating system installed on some piece of hardware you don’t have physical access to, is there any good way to test whether the storage have been appropriately wiped of any data from the previous customer? I figure that … Read more

Can I find username login log in Active directory server?

by

I join computer into active directory(AD) domian. User in AD can login to computer by using username, password in AD. Computer was install deep freeze so it can not keep anything after restart. I want to find username login log. I search in AD server envent viewer -> security ,but it have no username login … Read more

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

by

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www lfd[23293]: Suspicious Process PID:17053 PPID:16122 User:www-data Uptime:822 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www lfd[23293]: Suspicious Process PID:17113 PPID:16122 User:www-data Uptime:818 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www lfd[23293]: Suspicious Process … Read more