Real Digital Forensics Computer Security and Incident Response

, by Jones, Keith J.; Bejtlich, Richard; Rose, Curtis W.

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9780321240699 | 0321240693
Cover: Paperback
Copyright: 9/23/2005

Buy New

This is a hard-to-find title. We are making every effort to obtain this item, but do not guarantee stock.

$84.06

You can't succeed in the field of computer forensics without hands-on practice-and you can't get hands-on practice without real forensic data. The solution: Real Digital Forensics. In this book, a team of world-class computer forensics experts walks you through six detailed, highly realistic investigations and provides a DVD with all the data you need to follow along and practice.

Preface

Acknowledgments

xix

About the Authors

xxi

Case Studies

xxv

Part I Live Incident Response

(72)

Windows Live Response

(44)

Analyzing Volatile Data

(24)

The System Date and Time

(1)

Current Network Connections

(3)

Open TCP or UDP Ports

(1)

Executables Opening TCP or UDP Ports

(2)

Cached NetBIOS Name Tables

(1)

Users Currently Logged On

(1)

The Internal Routing Table

(1)

Running Processes

(2)

Running Services

(1)

Scheduled Jobs

(1)

Open Files

(1)

Process Memory Dumps

(6)

Full System Memory Dumps

(3)

Analyzing Nonvolatile Data

(14)

System Version and Patch Level

(1)

File System Time and Date Stamps

(4)

Registry Data

(1)

The Auditing Policy

(1)

A History of Logins

(1)

System Event Logs

(1)

User Accounts

(1)

IIS Logs

(4)

Suspicious Files

(1)

Putting It All Together

(4)

Unix Live Response

(26)

Analyzing Volatile Data

(10)

The System Date and Time

(1)

Current Network Connections

(1)

Open TCP or UDP Ports

(1)

Executables Opening TCP or UDP Ports

(2)

Running Processes

(2)

Open Files

(1)

The Internal Routing Table

(1)

Loaded Kernel Modules

(1)

Mounted File Systems

(1)

Analyzing Nonvolatile Data

(12)

System Version and Patch Level

(1)

File System Time and Date Stamps

(2)

File System MD5 Checksum Values

(1)

Users Currently Logged On

(1)

A History of Logins

(2)

Syslog Logs

(2)

User Accounts

(1)

User History Files

(2)

Suspicious Files

(1)

Putting It All Together

(3)

Part II Network-Based Forensics

(88)

Collecting Network-Based Evidence

(20)

Full Content Data

(2)

Session Data

(1)

Alert Data

(1)

Statistical Data

(1)

Putting NBE to Work

(1)

A Standard Intrusion Scenario

(2)

Using Full Content Data

(1)

Using Session Data

(1)

Using Alert Data

(1)

Using Statistical Data

(1)

Data Collection

(5)

Accessing the Wire

(3)

Collecting and Storing Traffic

(1)

Full Content Data Tools

(1)

Session Data Tools

(1)

Alert Data Tools

(1)

Statistical Data Tools

(1)

Putting It All Together

(2)

Analyzing Network-Based Evidence for a Windows Intrusion

(34)

Statistical Data: First Trace

(1)

Alert Data: First Trace

(5)

Session Data: First Trace

102

(4)

Full Content Data: First Trace

106

(2)

Statistical Data: Second Trace

108

(2)

Alert Data: Second Trace

110

(4)

Session Data: Second Trace

114

(2)

Full Content Data: Second Trace

116

(11)

Putting It All Together

127

(2)

Analyzing Network-Based Evidence for a Unix Intrusion

129

(32)

Statistical Data

130

(1)

Alert Data

131

(4)

Session Data

135

(5)

Full Content Data

140

(19)

Putting It All Together

159

(2)

Part III Acquiring a Forensic Duplication

161

(44)

Before You Jump Right In. . .

163

(8)

Preparing for a Forensic Duplication

163

(3)

Document, Document, Document

166

(5)

Commercial-Based Forensic Duplications

171

(16)

The Read-Only IDE-to-Firewire Device

171

(4)

Acquiring a Forensic Duplication with EnCase

175

(6)

Acquiring a Forensic Duplication with FTK

181

(6)

Noncommercial-Based Forensic Duplications

187

(18)

187

(6)

Creating an Evidence File

188

(4)

Creating an Evidence Hard Drive

192

(1)

DD Rescue

193

(2)

DCFLDD

195

(2)

NED---The Open Source Network Evidence Duplicator

197

(8)

Part IV Forensic Analysis Techniques

205

(276)

Common Forensic Analysis Techniques

207

(40)

Recovering Deleted Files

207

(11)

Open Source Solutions

207

(7)

Commercial Solutions

214

(4)

Production of Time Stamps and Other Metadata for Files

218

(7)

Open Source Solutions

218

(3)

Commercial Solutions

221

(4)

Removing Known Files

225

(8)

Open Source Solutions

225

(5)

Commercial Solutions

230

(3)

File Signatures and Electronic Discovery

233

(5)

Open Source Solutions

233

(3)

Commercial Solutions

236

(2)

String Searching and File Fragments

238

(9)

Open Source Solutions

238

(6)

Commercial Solutions

244

(3)

Web Browsing Activity Reconstruction

247

(26)

Commercial Forensic Tools

248

(12)

Open Source Solutions

260

(11)

Pasco---An Open Source Web Browsing Investigation Tool

260

(8)

Galleta---An Open Source IE Cookie Investigation Tool

268

(3)

Putting It All Together

271

(2)

E-Mail Activity Reconstruction

273

(18)

Commercial Forensic Tools

273

(2)

Open Source Solutions

275

(16)

Outlook Express

275

(16)

Microsoft Windows Registry Reconstruction

291

(10)

Identifying Installed Programs

292

(4)

Identifying ``Most Recently Used'' Documents

296

(5)

Forensic Tool Analysis: An Introduction to Using Linux for Analyzing Files of Unknown Origin

301

(45)

Case Background

302

(1)

A Hands-On Introduction to Forensic Tool Analysis: Hello World!

303

(40)

Static Analysis of Hello

305

(30)

Dynamic Analysis of Hello

335

(8)

Putting It All Together

343

(3)

Forensic Tool Analysis: A Hands-On Analysis of the Linux File aio

346

(63)

Static Analysis of aio

346

(7)

md5sum

346

(1)

Is -al

346

(1)

file

347

(1)

strings

347

(1)

Hexadecimal Viewer

348

(1)

349

(1)

Idd

350

(1)

readelf

350

(2)

objdump

352

(1)

Dynamic Analysis of aio

353

(55)

System Call Trace (strace)

353

(5)

GNU Debugger

358

(6)

Recovering the Uncompressed aio Binary

364

(10)

Recovery by Identifying the Packer That Was Used

374

(3)

Static Analysis of the Recovered Uncompressed Binary

377

(20)

Dynamic Analysis of the Recovered Uncompressed Binary

397

(11)

md5sum

408

(1)

Putting It All Together

408

(1)

Forensic Tool Analysis: Analyzing Files of Unknown Origin (Windows)

409

(72)

Case Background

409

(1)

A Hands-On Introduction to Forensic Tool Analysis: Hello World!

410

(34)

Static Analysis of hello.exe

415

(23)

Dynamic Analysis of hello.exe

438

(6)

Summary of hello.exe

444

(1)

A Hands-On Forensic Tool Analysis: sak.exe

444

(35)

Static Analysis of sak.exe

444

(13)

Dynamic Analysis of sak.exe

457

(22)

Putting It All Together

479

(2)

Part V Creating a Complete Forensic Tool Kit

481

(32)

Building the Ultimate Response CD

483

(20)

Preparing the Windows Live Response Tools

483

(9)

Preparing the Unix Live Response Tools

492

(8)

Forensic Duplication Tools

500

(3)

DCFLDD

501

(1)

NED

502

(1)

Making Your CD-ROM a Bootable Environment

503

(10)

Knoppix---A Linux Distribution on a CD-ROM

503

(1)

The Knoppix CD-Rom

504

(9)

Part VI Mobile Device Forensics

513

(82)

Forensic Duplication and Analysis of Personal Digital Assistants

515

(56)

Case Background

515

(2)

Forensic Acquisition Utilizing EnCase

517

(14)

Initial Setup

518

(4)

EnCase

522

(9)

Forensic Acquisition Utilizing Paraben's PDA Seizure

531

(9)

Forensic Acquisition Utilizing Palm Debugger

540

(16)

Forensic Analysis of the Palm IIIc

556

(3)

Forensic Analysis of the HP iPAQ Pocket PC 2003

559

(4)

Forensic Analysis of the Palm m505

563

(7)

Putting It All Together

570

(1)

Forensic Duplication of USB and Compact Flash Memory Devices

571

(6)

Duplicating USB Devices

571

(4)

Duplicating Compact Flash Cards

575

(2)

Forensic Analysis of USB and Compact Flash Memory Devices

577

(18)

USB Memory Devices

577

(11)

Open Source Solutions

578

(7)

Commercial Solutions

585

(3)

Compact Flash Cards

588

(7)

Open Source Solutions

589

(4)

Commercial Solutions

593

(2)

Part VII Online-Based Forensics

595

(30)

Tracing E-Mail

597

(12)

Hotmail

597

(3)

Yahoo!

600

(1)

Netscape

601

(2)

Other E-Mail Services

603

(2)

Anonymous Remailers

605

(4)

Domain Name Ownership

609

(16)

Importing the TLD Zone Files into Postgres

610

(6)

Translating FQDNs to IP Addresses

616

(3)

Searching for Domains

619

(1)

Searching for DNSs

620

(5)

Appendix An Introduction to Perl

625

(12)

Reading Input

625

(3)

Matching Text

628

(1)

Regular Expressions

629

(3)

Formatting Output

632

(2)

Processing Live IR Data Collected

634

(1)

The Data Problem with Microsoft Excel

635

(2)

Index

637

FREE SHIPPING

Rent More, Save More! Use code: BBRENTAL

5% off 1 book, 7% off 2 books, 10% off 3+ books

Real Digital Forensics Computer Security and Incident Response

Summary

Table of Contents

Supplemental Materials