book

System Forensics, Investigation, and Response

by John R. Vacca, K Rudolph

September 2010

Intermediate to advanced

339 pages

10h 19m

English

Jones & Bartlett Learning

Read now

Unlock full access

Copyright
Preface
Purpose of This BookLearning FeaturesAudience
Acknowledgments
About the Authors
ONE. The System Forensics Landscape
1. System Forensics Fundamentals
Understanding System ForensicsWho Uses Forensics?How Computers Are Used in CrimesSystem Forensics Specialists and What They DoTasks of a Forensic SpecialistHow a Forensic Specialist Begins an InvestigationSystem Forensics Evidence: Its Use and HandlingDigital Evidence ChallengesProtecting EvidenceTesting Forensic EvidenceApplying Forensic Analysis SkillsFollowing Proper Forensic ProceduresTypes of System Forensics AnalysisExamples of Forensic InvestigationsCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 1 ASSESSMENT
2. Overview of Computer Crime
Types of CybercrimeDoS and DDoS AttacksIntellectual Property TheftChild Exploitation, Abuse, and PornographyIdentity TheftFraudExtortionCyberstalkingTransmission of MalwareHackingSpammingSale and Purchase of Narcotics Over the InternetGamblingSources of Cybercrime ThreatsNation-StatesCyberterroristsOther ThreatsMeans, Motives, and Opportunities of CybercriminalsMeans: Tools and Techniques of CybercriminalsMotives of CybercriminalsOpportunities for CybercriminalsReporting CybercrimesWhat to ReportWhere to Report Computer CrimesApplicable LawsThe Role of System Forensics in Solving CrimesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 2 ASSESSMENT
3. Challenges of System Forensics
Difficulties in Obtaining Forensic Digital EvidenceWhat Is Digital Evidence?Data AccessCreating a Data Analysis PlanOvercoming Search and Seizure RestrictionsTechnical Data Collection ConsiderationsConsidering the Life Span of DataCollecting Data QuicklyCollecting Bit-Level DataObscured Data and Anti-ForensicsObscured DataAnti-ForensicsThe Role Evidence Dynamics Plays in System ForensicsScope-Related Challenges to System ForensicsLarge Volumes of DataSystem ComplexityDistributed Crime ScenesGrowing Caseload and Limited ResourcesThe Need for ProfessionalizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 3 ASSESSMENT
4. Forensics Methods and Labs
Forensic SoundnessForensic Frameworks and ProcessesThe DFRWS FrameworkAn Event-Based Digital Forensic Investigation FrameworkBuilding a Business Case for Creating a Forensics LabSetting Up a Forensics LabThe Duties of a Lab Manager and StaffPlanning a Forensics Lab BudgetEstimating Facility CostsEstimating Hardware Needs and CostsEstimating Software Needs and CostsConsidering Miscellaneous CostsDetermining Physical Requirements for a Computer Forensics LabIdentifying Lab Security NeedsConducting High-Risk InvestigationsUsing Evidence Storage ContainersOverseeing Facility MaintenanceAuditing a Computer Forensics LabDetermining the Floor Plan for a Computer Forensics LabStocking a Forensics LabSelecting Forensic WorkstationsSelecting workstations for police labs.Selecting workstations for private and corporate labs.Maintaining Operating Systems and Software InventoriesStocking Other ItemsPolicies, Processes, and Procedures for Maintaining a LabCreating a Disaster Recovery PlanPlanning for Equipment UpgradesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 4 ASSESSMENT
TWO. Technical Overview: System Forensics Tools, Techniques, and Methods

5. System Forensics Technologies
How the Military Uses System ForensicsWhich Technologies Law Enforcement Agencies UseEvidence PreservationTrojan Horse ProgramsDocumentation of Methodologies and FindingsDisk StructureFile Slack SearchingData-Hiding TechniquesFuzzy Logic Tools for Identifying Unknown TextData EncryptionDisk-to-Computer MatchingData CompressionRecovery of Erased FilesInternet Abuse Identification and DetectionThe Boot Process and Memory-Resident ProgramsFlash Memory Media ProcessingHow Businesses Use System Forensics TechnologiesRemote Monitoring of Target ComputersTrackable Electronic DocumentsTheft Recovery Software for Laptops and PCsHandling EvidenceEvidence-Handling TasksEvidence-Gathering MeasuresEncryption Methods and VulnerabilitiesHow Encryption WorksProblems with EncryptionSecurity and Wireless TechnologiesForensics on iPhonesForensics on BlackBerry SmartphonesFirewall ForensicsCommonly Used System Forensics ToolsEnCaseForensic Toolkit (FTK)HelixAnaDisk Disk Analysis ToolCopyQM Plus Disk Duplication SoftwareTextSearch PlusFilter_G Intelligent Forensic FilterUFEDDevice SeizureThe Zdziarski TechniqueCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 5 ASSESSMENT
6. Controlling a Forensic Investigation
Preserving a Digital Crime SceneConsiderations in Collecting EvidenceSecuring the Physical EvidenceVolatile Data: Two Schools of ThoughtDetermining How Much to DuplicateBalancing Speed and ThoroughnessApproaches to Duplicating DataMaking a Bit Stream BackupBooting a ComputerExamining EvidencePhysical Analysis and Logical AnalysisPhysical AnalysisThe Swap FileUnallocated (Free) SpaceFile SlackShadow DataLogical AnalysisLegal Aspects of Acquiring EvidenceThe Fourth AmendmentProcessing and Logging EvidenceDocumentationPreservationAuthenticityThe Computer Evidence Collection ProcessComputer Forensics PoliciesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 6 ASSESSMENT
7. Collecting, Seizing, and Protecting Evidence
Collecting Forensic EvidenceObstacles to Data CollectionTypes of Forensic EvidenceThe Rules of EvidenceDo's and Don'ts of Data CollectionLogging and MonitoringMethods of Data Collection: Freezing the Scene and HoneypottingThe Steps in Seizing Forensic EvidenceShutting Down the ComputerDocumenting the Hardware Configuration of the SystemTransporting the Computer System to a Secure LocationMathematically Authenticating Data on All Storage DevicesMaking a List of Key Search WordsEvaluating the Windows Swap FileEvaluating File SlackEvaluating Unallocated SpaceSearching Files, File Slack, and Unallocated Space for KeywordsDocumenting Filenames, Dates, and TimesIdentifying File, Program, and Storage AnomaliesEvaluating Program FunctionalityDocumenting FindingsRetaining Copies of Software UsedProtecting Evidence: Controlling ContaminationCreating a TimelineForensic Analysis of BackupsReconstructing an AttackCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 7 ASSESSMENT
8. Understanding Information-Hiding Techniques
History of Data HidingAlternate Data Streams (ADS)Risks Associated with ADSUsing ADS to Hide DataDestructive and Other Uses for ADSExecuting Code from ADSRootkitsSteganography Concepts and ToolsTypes of SteganographySteganography AlgorithmsSteganography SoftwareEzStegoMandelStegSpam MimicSnowOutGuessappendXInvisible SecretsDefeating SteganographyDetecting the Use of Steganography SoftwareTraces of Steganography SoftwareLocation of Pairs of Carrier/Stego FilesKeyword Search and Activity MonitoringSuspect's Computer KnowledgeUnlikely FilesLocation of Steganography KeysStrengths and Weaknesses of Today's Detection MethodsSteganalysisFile SignaturesFile AnomaliesVisual AttacksExtracting Hidden InformationSteganalysis SoftwareStegSpyStegdetectStegbreakStego SuiteStegAlyzerCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 8 ASSESSMENT
9. Recovering Data
What Is Data Recovery?Disk Structure and Recovery TechniquesRecovering Data After Physical DamagePhysical Damage Recovery TechniquesRecovering Data After Logical DamagePreventing Logical DamageLogical Damage Recovery TechniquesConsistency checking.Zero-knowledge analysis.Data Backup and RecoveryObstacles to Data BackupKey Elements of Data BackupThe Backup DeviceThe Network Data PathThe Backup WindowBackup Storage DevicesRecommended Backup FeaturesThe Role of Backups in Data RecoveryData Recovery TodayHandling FailuresCritical Thinking and Creative Problem SolvingPreparing for RecoveryEvaluating ProceduresEnsuring That Resources Are AvailableAutomating RecoveryMaking Recovery EfficientCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 9 ASSESSMENT
10. Investigating and Scrutinizing E-mail
The Roles of Mail Servers and E-mail ClientsUnderstanding E-mail HeadersViewing an E-mail HeaderInterpreting an E-mail HeaderE-mail TracingFaking E-mailSpoofingAnonymous RemailingUsing Mail RelaysSpammingStealingUsing Bogus AccountsE-mail Tracing in Forensic InvestigationsAn E-mail Tracing ExampleLegal Considerations in Investigating E-mailThe Fourth Amendment to the U.S. ConstitutionThe Electronic Communications Privacy ActCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 10 ASSESSMENT
11. Performing Network Analysis
Network BasicsWireless NetworksCommon Network ProtocolsTypes of Network-Related AttacksTypes of Router AttacksDoS AttacksWeb AttacksInvestigating Network TrafficUsing Log Files as EvidenceFirewall ForensicsUsing Sniffers and Other Traffic Analysis ToolsInvestigating Router AttacksCollecting Router EvidenceRouter LogsCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 11 ASSESSMENT
12. Searching Memory in Real Time with Live System Forensics
The Need for Live System ForensicsLive System Forensics Versus Dead System AnalysisProblems with Dead System ForensicsLive Forensic AcquisitionBenefits and Limitations of Live AcquisitionLive System Forensics Consistency IssuesUnderstanding the Consistency ProblemLocating Different Memory Segments in UNIXTools for Analyzing Computer MemoryLive ResponsePsListListDLLsHandleNetstatFPortUserdumpPsLoggedOnVolatile Memory AnalysisThe Volatility FrameworkPTFinderAnalysis of Live Response Versus Volatile Memory AnalysisCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 12 ASSESSMENT
THREE. Incident Response, Future Directions, and Resources
13. Incident and Intrusion Response
Minimizing IncidentsEvents and IncidentsAssembling an Incident Response TeamEstablishing Team RolesCoordinating a ResponseDefining an Incident Response PlanAssessmentCommunicationContainmentEvaluationCollecting DataProtecting EvidenceNotifying External AgenciesRecoveryDocument and ReviewAssessing Incident Damage and CostReviewing the Response and Updating PoliciesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 13 ASSESSMENT
14. Trends and Future Directions
Hardware TrendsWhat Moore's Law Means to System ForensicsDevice OverloadSoftware TrendsProliferation of Software ProductsSoftware as a ServiceForensic Support SoftwareProliferation of Software Development ModelsThe Changing Uses of TechnologyCollaborative InvestigationsThe Changing Legal EnvironmentThe Computer Fraud and Abuse Act (1984)Computer Trespass or IntrusionTheft of InformationInterception of Communications LawsSpam and Phishing LawsCybersquattingMalicious ActsEvolving Cybercrime LawsTrends in Professionalization and CertificationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 14 ASSESSMENT
15. System Forensics Resources
System Forensics Certification and TrainingInternational Association of Computer Investigative Specialists (IACIS)High Tech Crime Network (HTCN)EnCase Certified Examiner (EnCE) CertificationAccessData Certified Examiner (ACE)Defense Cyber Investigations Training Academy (DCITA)Other Training Programs and CertificationsUser GroupsOnline ResourcesSystem Forensics Organizations and InformationDiscussion List ServersForensic JournalsConferencesForensic ToolsOpen Source Software ToolsCommercial Software Tools and VendorsCommercial Hardware Tools and VendorsCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 15 ASSESSMENT
A. Answer Key
B. Standard Acronyms
Glossary of Key Terms
References

Overview

PART OF THE NEW JONES & BARTLETT LEARNING INFORMATION SYSTEMS SECURITY & ASSURANCE SERIES!

Computer crimes call for forensics specialists, people who know how to find and follow the evidence. System Forensics, Investigation, and Response begins by examining the fundamentals of system forensics, such as what forensics is, the role of computer forensics specialists, computer forensic evidence, and application of forensic analysis skills. It also gives an overview of computer crimes, forensic methods, and laboratories. It then addresses the tools, techniques, and methods used to perform computer forensics and investigation. Finally, it explores emerging technologies as well as future directions of this interesting and cutting-edge field.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

System Forensics, Investigation, and Response, 3rd Edition

Publisher Resources

ISBN: 9780763791346

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills