• 0 Posts
  • 45 Comments
Joined 8 months ago
cake
Cake day: November 10th, 2023

help-circle

  • groet@feddit.detoComic Strips@lemmy.worldI'm in!
    link
    fedilink
    arrow-up
    11
    ·
    2 months ago

    You DONT want to turn it off. Digital forensics work WAAAAAAY better if you have a memory dump of the system. And all the memory is lost if you turn it off. Even if the virus ran 10h ago and the program has long stoped running, there will most likely still be traces in the RAM. Like a hard drive, simply deleting something in RAM doesn’t mean it is gone. As long as that specific area was not written over later it will still hold the same contenta. You can sometimes find memory that belonged to a virus days or even weeks after the infection if the system was never shut down. There is so much information in ram that is lost when the power is turned off.

    You want to 1: quarantine from network (don’t pull the cable at the system, but firewall it at the switch if possible) 2: take a full copy of the RAM 2.5: read out bitlocker keys if the drive is encrypted. 3: turn off and take a bitwise copy of the hard drive or just send the drive + memory dump to the forensics team. 4: get coffee



  • No. It’s not a magic invisibility field inside. It’s a magic object that works only on living “intelligent” creatures. It also doesn’t work the same on different races. Only humans (hobbits are a subtype of human in Tolkiens lore) turn invisible. And because it’s magic it also turns their clothing etc invisible. So either Frodo and his poop is invisible or nothing is.














  • Can you verify the software running on an instance is the same as the one in the source code repository? You can’t. Can you verify the instance isn’t running code to read passwords from your login requests even if the code is the original open source code? You can’t.

    That’s why (and for other reasons) you should never use a password for more than one site/service/instance.

    Lemmy admins (admins in the Lemmy application) probably can’t read your password. But everyone with admin rights on the server operating system can.