4 ms·
For incident analysis, I would clone the drive and obtain a list of files created or modified in 24 hours. I would do this under my Linux recovery environment.
by wiseleo 10y ago
For incident analysis, I would clone the drive and obtain a list of files created or modified in 24 hours. I would do this under my Linux recovery environment. I would also undelete all files. One of those files will likely be the log of file transfers that happened using commercially available remote support software. Logmein and Citrix may have additional logs available if you are ever able to find the right person.
Cached website is likely recoverable from the disk image. I used that technique a few times to get into some clients' accounts with their consent.
Anyway, assume total compromise and apply nuclear option. It is possible to track down the perpetrators because they use toll free numbers.
- vonklaus 10y agothis is helpful. there was a total dump of Chrome on the desktop, which I thought was pretty bad, but if i understand correctly what youve said, that would indicate an attempt to get the accounts right there. Either way, for sure has to be totally reformatted, super shitty thing to do to someone. there is being a skilled hacker and social engineer and then there is scamming an old lady. thanks for info.