0
Digital Forensics with Open Source Tools
1st Edition
Authors:
Cory Altheide
Harlan Carvey
eBook ISBN: 9781597495875
Paperback ISBN: 9781597495868
Imprint: Syngress
Published Date: 14th April 2011
Page Count: 288
Description
Digital Forensics with Open Source Tools is the definitive book on investigating and analyzing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of open source tools on Mac, Linux and Windows systems as a platform for performing computer forensics. Both well-known and novel forensic methods are demonstrated using command-line and graphical open source computer forensic tools for examining a wide range of target systems and artifacts.
Written by world-renowned forensic practitioners, this book uses the most current examination and analysis techniques in the field. It consists of 9 chapters that cover a range of topics such as the open source examination platform; disk and file system analysis; Windows systems and artifacts; Linux systems and artifacts; Mac OS X systems and artifacts; Internet artifacts; and automating analysis and extending capabilities. The book lends itself to use by students and those entering the field who do not have means to purchase new tools for different investigations.
This book will appeal to forensic practitioners from areas including incident response teams and computer forensic investigators; forensic technicians from legal, audit, and consulting firms; and law enforcement agencies.
Key Features
- Written by world-renowned forensic practitioners
- Details core concepts and techniques of forensic file system analysis
- Covers analysis of artifacts from the Windows, Mac, and Linux operating systems
Readership
Forensic Practitioners from areas including: Incident response teams and computer forensic investigators, forensic technicians from legal, audit, and consulting firms, and law enforcement agencies
Table of Contents
About the Authors
Acknowledgments
Cory Altheide
Harlan Carvey
Introduction
Intended Audience
Layout of the Book
What is not Covered
Chapter 1. Digital Forensics with Open Source Tools
Welcome to “Digital Forensics with Open Source Tools”
What is “Digital Forensics?”
What is “Open Source?”
Benefits of Open Source Tools
Summary
References
Chapter 2. Open Source Examination Platform
Preparing the Examination System
Using Linux as the Host
Using Windows as the Host
Summary
References
Chapter 3. Disk and File System Analysis
Media Analysis Concepts
The Sleuth Kit
Partitioning and Disk Layouts
Special Containers
Hashing
Carving
Forensic Imaging
Summary
References
Chapter 4. Windows Systems and Artifacts
Introduction
Windows File Systems
Registry
Event Logs
Prefetch Files
Shortcut Files
Windows Executables
Summary
References
Chapter 5. Linux Systems and Artifacts
Introduction
Linux File Systems
Linux Boot Process and Services
Linux System Organization and Artifacts
User Accounts
Home Directories
Logs
Scheduling Tasks
Summary
References
Chapter 6. Mac OS X Systems and Artifacts
Introduction
OS X File System Artifacts
OS X System Artifacts
User Artifacts
Summary
References
Chapter 7. Internet Artifacts
Introduction
Browser Artifacts
Mail Artifacts
Summary
References
Chapter 8. File Analysis
File Analysis Concepts
Images
Audio
Video
Archives
Documents
Summary
References
Chapter 9. Automating Analysis and Extending Capabilities
Introduction
Graphical Investigation Environments
Automating Artifact Extraction
Timelines
Summary
References
Appendix A. Free, Non-open Tools of Note
Introduction
Chapter 3: Disk and File System Analysis
Chapter 4: Windows Systems and Artifacts
Chapter 7: Internet Artifacts
Chapter 8: File Analysis
Chapter 9: Automating Analysis and Extending Capabilities
Validation and Testing Resources
Index
Details
- No. of pages:
- 288
- Language:
- English
- Copyright:
- © Syngress 2011
- Published:
- 14th April 2011
- Imprint:
- Syngress
- eBook ISBN:
- 9781597495875
- Paperback ISBN:
- 9781597495868
About the Author
Cory Altheide
Cory Altheide is a Security Engineer at Google, focused on forensics and incident response. Prior to returning to Google, Cory was a principal consultant with MANDIANT, an information security consulting firm that works with the Fortune 500, the defense industrial base and the banks of the world to secure their networks and combat cyber-crime. In this role he responded to numerous incidents for a variety of clients. Cory has authored several papers for the computer forensics journal Digital Investigation and was a contributing author for UNIX and Linux Forensic Analysis (2008) & The Handbook Of Digital Forensics and Investigation (2010). Additionally, Cory is a recurring member of the program committee of the Digital Forensics Research Workshop (DFRWS).
Affiliations and Expertise
Cory Altheide is a Security Engineer at Google, focused on forensics and incident response. Prior to returning to Google, Cory was a principal consultant with MANDIANT, an information security consulting firm that works with the Fortune 500, the defense industrial base and the banks of the world to secure their networks and combat cyber-crime. In this role he responded to numerous incidents for a variety of clients. Cory has authored several papers for the computer forensics journal Digital Investigation and was a contributing author for UNIX and Linux Forensic Analysis (2008) & The Handbook Of Digital Forensics and Investigation (2010). Additionally, Cory is a recurring member of the program committee of the Digital Forensics Research Workshop (DFRWS).
Harlan Carvey
Harlan Carvey is a senior information security researcher with the Dell SecureWorks Counter Threat Unit - Special Ops (CTU-SO) team, where his efforts are focused on targeted threat hunting, response, and research. He continues to maintain a passion and focus in analyzing Windows systems, and in particular, the Windows Registry.
Harlan is an accomplished author, public speaker, and open source tool author. He dabbles in other activities, including home brewing and horseback riding. As a result, he has become quite adept at backing up and parking a horse trailer.
Harlan earned a bachelor’s degree in electrical engineering from the Virginia Military Institute, and a master’s degree in the same discipline from the Naval Postgraduate School. He served in the United States Marine Corps, achieving the rank of captain before departing the service. He resides in Northern Virginia with his family.
Affiliations and Expertise
DFIR analyst, presenter, and open-source tool author
Reviews
"This is highly detailed material. Although the introductory chapter adopts an easy pace, with overviews of important technical concepts, most of the other chapters get right down to the practice of forensic analysis. This is not a book you’re going to want to read in bed: you’ll want this right next to a computer – preferably two or three computers running different operating systems – so that you can try the techniques for yourself as you work your way through. The authors admit that this book does not cover everything you need to know. For instance, it focuses entirely on ‘dead drive’ forensics – offline systems. Analysing running systems often requires high-level proprietary tools. But it does give an excellent grounding in the methods of digital forensic analysis and provides a valuable first step in learning the technicalities."--Network Security, May 2012, page 4
"Digital Forensics – MacGyver Style! The practical solutions of this book, Digital Forensics with Open Source Tools, save the day when commercial tools fail. During an incident, the clock ticks. Response teams scramble to pull anything together to solve the immediate challenge. Cory Altheide and Harlan Carvey take you through the tools and tactics that you need – the ones that in a pinch will get the job done. A welcome addition to my library."--Rob Lee, SANS Institute
"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools."--Reference and Research Book News
"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools. Chapter examples assume a basic knowledge of the Linux command line interface."--Reference and Research Book News
"The authors intended this book for two types of readers: complete novices in the world of digital forensics, and seasoned practitioners who are interested in learning more about open source tools that could help them in their work. And although it might seem difficult to merge the knowledge in such a way to make for an interesting book for both groups, in my opinion, the writers managed to do it beautifully."--Net-Security.org