Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [forensics]

38 questions
2
votes
1 answer

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. It just so happened to be our index page. I…
jps
  • 123
  • 4
2
votes
3 answers

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
Jene Hackman
1
vote
8 answers

Learn as much as possible about the setup behind a website

Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model. Is there a way to determine a bit the kind of setup, software and/or hardware. Some things…
carrier
  • 292
  • 1
  • 3
  • 7
1
vote
1 answer

Finding email read times on exchange server

I'm trying to do a forensic analysis on an exchange server, and I'd like to determine what time a user read a particular email. Is there any way - perhaps with a tool like mfcmapi or another open source or commercial tool that can provide this…
Shmuel Levine
  • 113
  • 3
1
vote
2 answers

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of my sites in serving out malware. As a result of…
MrEyes
  • 313
  • 4
  • 14
1
vote
4 answers

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near what it needs to be. What are a few things I…
Ben
  • 3,630
  • 17
  • 62
  • 93
1
vote
1 answer

How to analyze cause of postfix server sending spam

A client of mine has a server hosting postfix as well as nginx with several websites, including an nginx installation with several subdomains / websites. Since a couple of days the /var/spool/postfix directory is filled with e-mails recognized as…
user1192748
  • 111
  • 3
0
votes
1 answer

Can I find username login log in Active directory server?

I join computer into active directory(AD) domian. User in AD can login to computer by using username, password in AD. Computer was install deep freeze so it can not keep anything after restart. I want to find username login log. I search in AD…
user572575
  • 103
  • 1
0
votes
1 answer

Examine contents of unused space on the HDD

When using managed dedicated services, either virtual or physical, where you're presented with complete control to an operating system installed on some piece of hardware you don't have physical access to, is there any good way to test whether the…
cnst
  • 12,948
  • 7
  • 51
  • 75
0
votes
2 answers

Partition-table on one disk from RAID always equal to partition-table configured for RAID?

Are partition-tables from hard-drives, that are part of a RAID (no matter of what kind of RAID) always equal to the partition-table configured for the RAID? What is clear: A machine has a RAID 1 with four hard-drives. When I shutdown the machine and…
edi38
  • 1
0
votes
1 answer

Extract list of installed drivers using a linux live disk

I have a quit old PC that was running Windows 2000 but the system crashed some days ago. Now I need to know which drivers have been installed on that specific pc but the system isn't booting anymore and the rescue and recovery options failed. Now I…
davidb
  • 246
  • 1
  • 4
  • 16
0
votes
2 answers

Forensics on tons of file changes

It has come to my attention that my CentOS 5.6 5.11 VPS has over 16,000 files with a timestamp during a 3-day period in September this year. I can't figure out why that is, as I did not log in via SSH during that time (nor were there any other…
OsakaWebbie
  • 183
  • 1
  • 11
0
votes
0 answers

Trace IP traffic to physical machine under Linux

In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine is intended to use this net. I guess that the…
Lars Hanke
  • 281
  • 2
  • 15
0
votes
1 answer

Helpful linux command for do some forensic on compromised linux web server

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious open port, and others usefull automatic command…
Yuda Prawira
  • 117
  • 5
0
votes
2 answers

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www lfd[23293]: Suspicious Process…
alfish
  • 3,027
  • 15
  • 45
  • 68
1
2
3