UNIX and Linux Forensic Analysis DVD Toolkit - 1st Edition - ISBN: 9781597492690, 9780080879123

UNIX and Linux Forensic Analysis DVD Toolkit

1st Edition

Authors: Chris Pogue Cory Altheide Todd Haverkos
eBook ISBN: 9780080879123
Imprint: Syngress
Published Date: 16th June 2008
Page Count: 248
Tax/VAT will be calculated at check-out Price includes VAT (GST)
64.95
49.95
39.99
64.95
Unavailable
Price includes VAT (GST)
× DRM-Free

Easy - Download and start reading immediately. There’s no activation process to access eBooks; all eBooks are fully searchable, and enabled for copying, pasting, and printing.

Flexible - Read on multiple operating systems and devices. Easily read eBooks on smart phones, computers, or any eBook readers, including Kindle.

Open - Buy once, receive and download all available eBook formats, including PDF, EPUB, and Mobi (for Kindle).

Institutional Access

Secure Checkout

Personal information is secured with SSL technology.

Free Shipping

Free global shipping
No minimum order.

Description

This book addresses topics in the area of forensic analysis of systems running on variants of the UNIX operating system, which is the choice of hackers for their attack platforms. According to a 2007 IDC report, UNIX servers account for the second-largest segment of spending (behind Windows) in the worldwide server market with $4.2 billion in 2Q07, representing 31.7% of corporate server spending. UNIX systems have not been analyzed to any significant depth largely due to a lack of understanding on the part of the investigator, an understanding and knowledge base that has been achieved by the attacker.

The book begins with a chapter to describe why and how the book was written, and for whom, and then immediately begins addressing the issues of live response (volatile) data collection and analysis. The book continues by addressing issues of collecting and analyzing the contents of physical memory (i.e., RAM). The following chapters address /proc analysis, revealing the wealth of significant evidence, and analysis of files created by or on UNIX systems. Then the book addresses the underground world of UNIX hacking and reveals methods and techniques used by hackers, malware coders, and anti-forensic developers. The book then illustrates to the investigator how to analyze these files and extract the information they need to perform a comprehensive forensic analysis. The final chapter includes a detailed discussion of loadable kernel Modules and malware.

Throughout the book the author provides a wealth of unique information, providing tools, techniques and information that won't be found anywhere else.

Key Features

  • This book contains information about UNIX forensic analysis that is not available anywhere else. Much of the information is a result of the author's own unique research and work.
  • The authors have the combined experience of law enforcement, military, and corporate forensics. This unique perspective makes this book attractive to all forensic investigators.

Readership

Digital forensic investigators and security professionals.

Table of Contents

Chapter 1: Introduction Chapter 2: Understanding Unix Chapter 3: Live Response: Data Collection Chapter 4: Initial Triage and Live Response: Data Analysis Chapter 5: The Hacking Top 10 Chapter 6: The /Proc File System Chapter 7: File Analysis Chapter 8: Malware Appendix: Implementing Cybercrime Detection Techniques on Windows and *nix Index

Details

No. of pages:
248
Language:
English
Copyright:
© Syngress 2008
Published:
Imprint:
Syngress
eBook ISBN:
9780080879123

About the Author

Chris Pogue

Chris Pogue has spent the past five years as part of the IBM Ethical Hacking Team. He was tasked with emulating the actions of an actual malicious attacker with the intention of assisting customers to identify and eliminate probable attack vectors. Chris has worked on over 3000 exploitation attempts for both internal IBM systems as well as third party customers. Chris is also a former US Army Warrant Officer and has worked with the Army Reserve Information Operations Command (ARIOC) on Joint Task Force (JTF) missions with the National Security Agency (NSA), Department of Homeland Security, Regional Computer Emergency Response Team-Continental United States (RCERT-CONUS), and the Joint Intelligence Center-Pacific (JICPAC). Chris attended Forensics training at Carnegie Mellon University in Pittsburgh, Pennsylvania, and holds a Master’s degree in Information Security. He is a Certified Information Systems Security Professional (CISSP) and a Certified Ethical Hacker (CEH). Chris also holds a Top Secret (TS) security clearance from the Department of Defense.

Affiliations and Expertise

Member of IBM Ethical Hacking Team

Cory Altheide

Cory Altheide is a Security Engineer at Google, focused on forensics and incident response. Prior to returning to Google, Cory was a principal consultant with MANDIANT, an information security consulting firm that works with the Fortune 500, the defense industrial base and the banks of the world to secure their networks and combat cyber-crime. In this role he responded to numerous incidents for a variety of clients. Cory has authored several papers for the computer forensics journal Digital Investigation and was a contributing author for UNIX and Linux Forensic Analysis (2008) & The Handbook Of Digital Forensics and Investigation (2010). Additionally, Cory is a recurring member of the program committee of the Digital Forensics Research Workshop (DFRWS).

Affiliations and Expertise

Cory Altheide is a Security Engineer at Google, focused on forensics and incident response. Prior to returning to Google, Cory was a principal consultant with MANDIANT, an information security consulting firm that works with the Fortune 500, the defense industrial base and the banks of the world to secure their networks and combat cyber-crime. In this role he responded to numerous incidents for a variety of clients. Cory has authored several papers for the computer forensics journal Digital Investigation and was a contributing author for UNIX and Linux Forensic Analysis (2008) & The Handbook Of Digital Forensics and Investigation (2010). Additionally, Cory is a recurring member of the program committee of the Digital Forensics Research Workshop (DFRWS).

Todd Haverkos