book

Computer Forensics InfoSec Pro Guide

by David Cowen

April 2013

Intermediate to advanced

512 pages

7h 40m

English

McGraw-Hill

Read now

Unlock full access

What You Can Do with Computer ForensicsHow People Get Involved in Computer ForensicsLaw EnforcementMilitaryUniversity ProgramsIT or Computer Security ProfessionalsIncident Response vs. Computer ForensicsHow Computer Forensic Tools WorkTypes of Computer Forensic ToolsProfessional Licensing Requirements

Where and How to Get TrainingLaw Enforcement TrainingCorporate TrainingWhere and How to Get CertifiedVendor CertificationsVendor-Neutral CertificationsStaying CurrentConferencesBlogsForumsPodcastsAssociations
Choosing Where to Put Your LabAccess ControlsElectrical PowerAir ConditioningPrivacyGathering the Tools of the TradeWrite BlockersDrive KitsExternal StorageScrewdriver KitsAntistatic BagsAdaptorsForensic WorkstationChoosing Forensic SoftwareOpen Source SoftwareCommercial SoftwareStoring EvidenceSecuring Your EvidenceOrganizing Your EvidenceDisposing of Old Evidence
The Investigative ProcessWhat Are You Being Asked to Find Out?Where Would the Data Exist?What Applications Might Have Been Used in Creating the Data?Should You Request to Go Beyond the Scope of the Investigation?Testing Your HypothesisStep 1. Define Your HypothesisStep 2. Determine a Repeatable TestStep 3. Create Your Test EnvironmentStep 4. Document Your TestingThe Forensic Data LandscapeActive DataUnallocated SpaceSlack SpaceMobile DevicesExternal StorageWhat Do You Have the Authority to AccessWho Hosts the Data?Who Owns the Device?Expectation of Privacy
Forensic ImagingDetermining Your Comfort LevelForensic Imaging Method Pros and ConsCreating Forms and Your Lab ManualChain of Custody FormsRequest FormsReport FormsStandard Operating Procedures Manual
When Do You Need to TestCollecting Data for Public Research or PresentationsTesting a Forensic MethodTesting a ToolWhere to Get Test EvidenceRaw ImagesCreating Your Own Test ImagesForensic ChallengesLearn Forensics with David Cowen on YouTubeHoneynet ProjectDC3 ChallengeDFRWS ChallengeSANS Forensic ChallengesHigh School Forensic ChallengeCollections of Tool Testing ImagesDigital Forensic Tool Testing ImagesNIST Computer Forensics Reference Data Sets ImagesThe Hacking CaseNIST Computer Forensics Tool Testing
Live ForensicsWhen Live Forensics Is the Best OptionTools for Live ForensicsPostmortem ForensicsPostmortem Memory Analysis
Creating Forensic Images of Internal Hard DrivesFTK Imager with a Hardware Write BlockerFTK Imager with a Software Write BlockerCreating Forensic Images of External DrivesFTK Imager with a USB Write BlockerFTK Imager with a Software Write BlockerSoftware Write Blocking on Linux SystemsCreating Forensic Images of Network SharesCapturing a Network Share with FTK ImagerMobile DevicesServers
Breaking the Rules: Nontraditional Digital Forensic TechniquesVolatile ArtifactsMalwareEncrypted File SystemsChallenges to Accessing Encrypted DataMobile Devices: Smart Phones and TabletsSolid State DrivesVirtual Machines
Determining What Type of Investigation Is RequiredHuman Resources CasesAdministrator AbuseStealing InformationInternal LeaksKeyloggers and MalwareWhat to Do When Criteria Causes an OverlapWhat to Do When No Criteria MatchesWhere Should the Evidence Be?Did This Occur over the Network?Nothing Working? Create a Super Timeline
Results of a Human Resource CaseHow to Work a Pornography CasePornography Case StudyHow to Investigate a Pornography CaseHow to Work a Productivity Waste Case
The Abuse of OmniscienceScenario 1: Administrator Runs a Pornographic Site Using Company ResourcesBeginning an InvestigationThe Web Server’s Role in the NetworkDirectoriesVirtual ServersVirtual DirectoriesScenario 2: Exploiting Insider Knowledge Against an Ex-employerA Private Investigator Calls…As if They’re Reading Our Minds…What a Network Vulnerability Assessment Can RevealE-mail Data Review and Server RestorationStepping Up Your Game: Knowledge Meets Creativity
What Are We Looking For?Determining Where the Data WentLNK FilesShellbagsScenario: Recovering Log Files to Catch a Thief
Why Internal Leaks HappenInvestigating Internal LeaksReviewing the Registry FilesIdentifying LNK FilesWrapping Up the InvestigationUsing File System Meta-data to Track Leaked or Printed Materials
Defining Keyloggers and MalwareHow to Detect Keyloggers and MalwareRegistry FilesPrefetch FilesKeyword SearchesHandling Suspicious FilesDetermining How an Infection OccurredWhat We Know About This InfectionWhat We Know About the KeyloggerIdentifying What Data Was CapturedFinding Information About the AttackerWhat We Know About the AttackerWhere to Find More About the Attacker
Documenting Your FindingsWho Asked You to Undertake the InvestigationWhat You Were Asked to DoWhat You ReviewedWhat You FoundWhat Your Findings MeanTypes of ReportsInformal ReportIncident ReportInternal ReportDeclarationAffidavitExplaining Your WorkDefine Technical TermsProvide Examples in Layperson TermsExplain Artifacts
Important Legal TermsWhat Type of Witness Are You?Fact WitnessExpert ConsultantExpert WitnessSpecial MasterNeutralWriting Reports for CourtDeclarations in Support of MotionsExpert ReportsCreating ExhibitsWorking with Forensic Artifacts