Table of Contents for
System Forensics, Investigation, and Response, 3rd Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition System Forensics, Investigation, and Response, 3rd Edition by Easttom Published by Jones & Bartlett Learning, 2017
  1. Cover Page
  2. Contents
  3. System Forensics, Investigation, and Response
  4. Title Page
  5. Copyright Page
  6. Content
  7. Preface
  8. About the Author
  9. PART I Introduction to Forensics
  10. CHAPTER 1 Introduction to Forensics
  11. What Is Computer Forensics?
  12. Understanding the Field of Digital Forensics
  13. Knowledge Needed for Computer Forensics Analysis
  14. The Daubert Standard
  15. U.S. Laws Affecting Digital Forensics
  16. Federal Guidelines
  17. CHAPTER SUMMARY
  18. KEY CONCEPTS AND TERMS
  19. CHAPTER 1 ASSESSMENT
  20. CHAPTER 2 Overview of Computer Crime
  21. How Computer Crime Affects Forensics
  22. Identity Theft
  23. Hacking
  24. Cyberstalking and Harassment
  25. Fraud
  26. Non-Access Computer Crimes
  27. Cyberterrorism
  28. CHAPTER SUMMARY
  29. KEY CONCEPTS AND TERMS
  30. CHAPTER 2 ASSESSMENT
  31. CHAPTER 3 Forensic Methods and Labs
  32. Forensic Methodologies
  33. Formal Forensic Approaches
  34. Documentation of Methodologies and Findings
  35. Evidence-Handling Tasks
  36. How to Set Up a Forensic Lab
  37. Common Forensic Software Programs
  38. Forensic Certifications
  39. CHAPTER SUMMARY
  40. KEY CONCEPTS AND TERMS
  41. CHAPTER 3 ASSESSMENT
  42. PART II Technical Overview: SystemForensics Tools, Techniques, and Methods
  43. CHAPTER 4 Collecting, Seizing, and Protecting Evidence
  44. Proper Procedure
  45. Handling Evidence
  46. Storage Formats
  47. Forensic Imaging
  48. RAID Acquisitions
  49. CHAPTER SUMMARY
  50. KEY CONCEPTS AND TERMS
  51. CHAPTER 4 ASSESSMENT
  52. CHAPTER LAB
  53. CHAPTER 5 Understanding Techniques for Hiding and Scrambling Information
  54. Steganography
  55. Encryption
  56. CHAPTER SUMMARY
  57. KEY CONCEPTS AND TERMS
  58. CHAPTER 5 ASSESSMENT
  59. CHAPTER 6 Recovering Data
  60. Undeleting Data
  61. Recovering Information from Damaged Media
  62. File Carving
  63. CHAPTER SUMMARY
  64. KEY CONCEPTS AND TERMS
  65. CHAPTER 6 ASSESSMENT
  66. CHAPTER 7 Email Forensics
  67. How Email Works
  68. Email Protocols
  69. Email Headers
  70. Tracing Email
  71. Email Server Forensics
  72. Email and the Law
  73. CHAPTER SUMMARY
  74. KEY CONCEPTS AND TERMS
  75. CHAPTER 7 ASSESSMENT
  76. CHAPTER 8 Windows Forensics
  77. Windows Details
  78. Volatile Data
  79. Windows Swap File
  80. Windows Logs
  81. Windows Directories
  82. Index.dat
  83. Windows Files and Permissions
  84. The Registry
  85. Volume Shadow Copy
  86. Memory Forensics
  87. CHAPTER SUMMARY
  88. KEY CONCEPTS AND TERMS
  89. CHAPTER 8 ASSESSMENT
  90. CHAPTER 9 Linux Forensics
  91. Linux and Forensics
  92. Linux Basics
  93. Linux File Systems
  94. Linux Logs
  95. Linux Directories
  96. Shell Commands for Forensics
  97. Kali Linux Forensics
  98. Forensics Tools for Linux
  99. CHAPTER SUMMARY
  100. KEY CONCEPTS AND TERMS
  101. CHAPTER 9 ASSESSMENT
  102. CHAPTER 10 Macintosh Forensics
  103. Mac Basics
  104. Macintosh Logs
  105. Directories
  106. Macintosh Forensic Techniques
  107. How to Examine a Mac
  108. Can You Undelete in Mac?
  109. CHAPTER SUMMARY
  110. KEY CONCEPTS AND TERMS
  111. CHAPTER 10 ASSESSMENT
  112. CHAPTER 11 Mobile Forensics
  113. Cellular Device Concepts
  114. What Evidence You Can Get from a Cell Phone
  115. Seizing Evidence from a Mobile Device
  116. JTAG
  117. CHAPTER SUMMARY
  118. KEY CONCEPTS AND TERMS
  119. CHAPTER 11 ASSESSMENT
  120. CHAPTER 12 Performing Network Analysis
  121. Network Packet Analysis
  122. Network Traffic Analysis
  123. Router Forensics
  124. Firewall Forensics
  125. CHAPTER SUMMARY
  126. KEY CONCEPTS AND TERMS
  127. CHAPTER 12 ASSESSMENT
  128. PART III Incident Response and Resources
  129. CHAPTER 13 Incident and Intrusion Response
  130. Disaster Recovery
  131. Preserving Evidence
  132. Adding Forensics to Incident Response
  133. CHAPTER SUMMARY
  134. KEY CONCEPTS AND TERMS
  135. CHAPTER 13 ASSESSMENT
  136. CHAPTER 14 Trends and Future Directions
  137. Technical Trends
  138. Legal and Procedural Trends
  139. CHAPTER SUMMARY
  140. KEY CONCEPTS AND TERMS
  141. CHAPTER 14 ASSESSMENT
  142. CHAPTER 15 System Forensics Resources
  143. Tools to Use
  144. Resources
  145. Laws
  146. CHAPTER SUMMARY
  147. KEY CONCEPTS AND TERMS
  148. CHAPTER 15 ASSESSMENT
  149. APPENDIX A Answer Key
  150. APPENDIX B Standard Acronyms
  151. Glossary of Key Terms
  152. References
  153. Index

Memory Forensics

Another issue for any computer, but especially a Windows system, is memory forensics. The ability to capture the memory and then analyze it has important ramifications for forensic exams. Often sophisticated malware is best detected by examining memory for specific traces of that malware.

The first step is to capture the memory from a live machine. This can be done with several different tools, many of which are free. One common free tool is the command-line tool Dump-it, which is shown in FIGURE 8-11. Dump-it will dump out the current memory in a file ending in the .raw extension. Note that this can take a few minutes. The Dump-it tool is popular, but can sometimes be hard to find on the Internet.

Another popular memory capture utility is RAM Capturer from Belkasoft (http://belkasoft.com/ram-capturer). This tool has a graphical interface, rather than command line. You can see this in FIGURE 8-12.

OSForensics also provides the option to capture live memory. That is shown in FIGURE 8-13.

There are other tools on the Internet that can be used to capture memory, including the AccessData FTK imager. Regardless of how you capture the memory, analyzing it is the important issue. Fortunately, the premier tool for memory analysis is also a free download. This tool is Volatility (http://www.volatilityfoundation.org). It is a command-line tool.

Volatility

In this section, the Windows standalone version of Volatility is being used.

The first Volatility command is simply to get information about Volatility to ensure it is working properly. The command to get information is shown here:

Volatility-2.5 standalone.exe --info

FIGURE 8-11
Dump-it memory capture.

Courtesy of Comae Technologies

FIGURE 8-12
Belkasoft RAM Capturer.

Courtesy of Belkasoft

FIGURE 8-13
OSForensics memory capture.

Courtesy of PassMark Software

This command should fill the command window with a great deal of information, including the profiles supported. The profile indicates the operating system of the machine the memory dump was taken from, not the machine you are running Volatility on. The basic format of commands is shown here:

volatility-version.exe commandname -f filepath –
profile=profile name

Here are some examples of how to use the command:

volatility-2.5.standalone.exe pslist -f
C:path\ovolatility\dump.bin --profile=Win8SP0x64
volatility-2.5.standalone.exe psscan -f dump.bin --
profile=Win8SP0x64

The command, also called a plug-in, is a module used with Volatility to scan a memory dump for specific data. The memory dump file will have whatever name it was given when it was extracted from the machine. Common extensions include .mem, .bin, .dump, and .raw.

The following commands assume the same profile of Windows 8 Service Pack 0, 64-bit.

Pslist

This is a basic command that lists the processes that were in the memory dump. For example,

volatility-2.5.standalone.exe pslist –f memtest.dmp –
profile=Win8SP0x64

The output is shown in FIGURE 8-14.

The PID is the process ID for that specific process. The PPID is the parent process ID, the ID of the process that spawned this process. The value Thds indicates how many threads that process has. Hnds is the number of handles, and Sess the number of sessions. The start date/time also is shown.

Pstree

This is very much like plist, except it shows the processes in a hierarchical tree, making it very clear what process started a particular process. For example:

volatility-2.5.standalone.exe pstree –f memtest.dmp –
profile=Win8SP0x64

This is shown in FIGURE 8-15.

Psscan

This is particularly interesting in malware investigations. Psscan can find processes that previously terminated (inactive) and processes that have been hidden or unlinked by a rootkit. For example,

volatility-2.5.standalone.exe psscan –f memtest.dmp –
profile=Win8SP0x64

This is shown in FIGURE 8-16.

Svcscan

This is a very commonly used command. It will list details of all services that were in memory when the memory dump was taken. For example,

volatility-2.5.standalone.exe svcscan –f memtest.dmp – profile=Win8SP0x64

This can be seen in FIGURE 8-17.

FIGURE 8-14
Volatility: plist.

FIGURE 8-15
Volatility: pstree.

FIGURE 8-16
Volatility: psscan.

FIGURE 8-17
Volatility: svcscan.

It is beyond the scope of this chapter to provide a complete coverage of all of Volatility’s capabilities. However, the Volatility Foundation provides a cheat sheet at http://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf.