Free forensic courses
Many #digitalforensics enthusiasts are asking about FREE forensic courses that they can take during the #coronavirus #lockdown period. Here are a few..

https://autopsy.com/support/training/covid-19-free-autopsy-training/

https://blackbagtech.com/training/courses/mobilyze-tool-training/

https://itmasters.edu.au/free-short-course-digital-forensics/
🗣cyberg0100


🎖@malwr

An Inside View of Office Document Cache Exploitation
https://arsenalrecon.com/2020/04/an-inside-view-of-office-document-cache-exploitation/


🎖@malwr

[Blog Article OSINT Investigation: Cerberus and the INPS](https://bushidotoken.blogspot.com/2020/04/osint-investigation-cerberus-and-inps.html)
🗣Wthomas97


🎖@malwr

Index of the training Reversing & Exploiting with Free Tools
by RICARDO NARVAJA (Translated by Fare9 & Arrizen)
https://docs.google.com/document/d/18FBSpnPrduNidGS4SAQreXITHMz6PyYfx2nqlcTKDSM/

✅ GOOD RESOURCE ✅

🎖@malwr

Ebfuscation: Abusing system errors for binary obfuscation
https://www.d00rt.eus/2020/04/ebfuscation-abusing-system-errors-for.html


🎖@malwr

What does it mean to image a laptop?
What does this accomplish? I'm guessing you can see the contents stored on the device? Does this work even if it is full disk encrypted?
🗣LilRee12

Short Answer: It's a copy of data that's protected from change by verifying it with a hashing algorithm. Imaging a laptop is usually a full copy of all the data on the laptop's hard drive.

Longer Answer: An image is a file that contains data taken from an original device (either a hard drive or other piece of media like a USB drive). It's often called a "mirror image" but that's not technically correct. The image is itself a file. The data copied from the source into the image file is protected from change and can be verified as a true and accurate copy by "hashing" the file and comparing that to the "hash" of the source. If the hashes match, the image is "verified" as an accurate copy.

While you can sometimes "image" an entire disk, you don't need to. A full disk image gets both the allocated and unallocated data on a device. You can also get a "logical" image that includes only what the file system knows is there. That won't get the unallocated space so you won't get a lot of deleted data. Finally, you can get a "custom content" image where you create a "container" and copy into it only certain files that might be relevant for a fast investigation.

If a drive is encrypted, you can still get a full disk image but will need the encryption key to decrypt the contents to do anything with it. If the drive is encrypted but the computer is up and running, you can get a logical or custom content image of the drive while the computer is on, which will give you unencrypted copies of files copied into the image file.

You usually need forensic software to do anything with an image file. Once you have the image file, you load it into the forensic tool to review the data stored inside the image file for analysis.
👤Upsitting_Standizen

A copy of all addressable space on the device...
👤GENERALRAY82

Yeah, basically making a copy of the hard drive. FDE (i.e. Bitlocker, Firevault) will subvert attempts to view the contents. It's still possible but you would somehow need to get he key to unlock it.

For example, on Macs (Firevault2), you either need the recovery key, the XTS-AES key, or the password for one of the user accounts. If the Mac is in an enterprise environment and the sysadmin knows their stuff, there might be an institutional recovery key as well.

You can dump some of the keys from RAM if the user is logged in and the computer is not asleep. So yeah, FDE makes things a lot more difficult if you don't have a cooperating user.
👤StupidTinyFatUnicorn


🎖@malwr

Defeating Coordinated Inauthentic Behavior at Scale
🗣Soatok

I'm slightly concerned the proposed solution would create a mono culture, and make it near impossible for multiple views to exist. By using consensus the systems only allows a single truth to exist.

Here an example, group A and B have opposing views on the interpretation of a text. Members of group A flags video from group B as misinformation, and vice versa. Group A happens to have more people spending time reviewing videos, leading to group B's videos being removed as misinformation. Group B is eventually lost because new people only sees Group A's interpretation of the text.
👤hatanikri

I think it's a good idea.
👤metavulp

I love that term. I’m going to use that when talking to my girlfriend.

“Why are you behaving inauthentically today?”
👤carrotcypher


🎖@malwr