Digital Forensics with Open Source Tools

Digital Forensics with Open Source Tools

by Harlan Carvey, Cory Altheide
Released March 2011
Publisher(s): Syngress
ISBN: 9781597495875

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Digital Forensics with Open Source Tools is the definitive book on investigating and analyzing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of open source tools on Mac, Linux and Windows systems as a platform for performing computer forensics. Both well-known and novel forensic methods are demonstrated using command-line and graphical open source computer forensic tools for examining a wide range of target systems and artifacts.

Written by world-renowned forensic practitioners, this book uses the most current examination and analysis techniques in the field. It consists of 9 chapters that cover a range of topics such as the open source examination platform; disk and file system analysis; Windows systems and artifacts; Linux systems and artifacts; Mac OS X systems and artifacts; Internet artifacts; and automating analysis and extending capabilities. The book lends itself to use by students and those entering the field who do not have means to purchase new tools for different investigations.

This book will appeal to forensic practitioners from areas including incident response teams and computer forensic investigators; forensic technicians from legal, audit, and consulting firms; and law enforcement agencies.

  • Written by world-renowned forensic practitioners
  • Details core concepts and techniques of forensic file system analysis
  • Covers analysis of artifacts from the Windows, Mac, and Linux operating systems

Table of contents

  1. Cover image
  2. Title page
  3. Table of Contents
  4. Copyright
  5. About the Authors
  6. Acknowledgments
    1. Cory Altheide
    2. Harlan Carvey
  7. Introduction
    1. Intended Audience
    2. Layout of the Book
    3. What is not Covered
  8. Chapter 1. Digital Forensics with Open Source Tools
    1. Welcome to “Digital Forensics with Open Source Tools”
    2. What is “Digital Forensics?”
    3. What is “Open Source?”
    4. Benefits of Open Source Tools
    5. Summary
    6. References
  9. Chapter 2. Open Source Examination Platform
    1. Preparing the Examination System
    2. Using Linux as the Host
    3. Using Windows as the Host
    4. Summary
    5. References
  10. Chapter 3. Disk and File System Analysis
    1. Media Analysis Concepts
    2. The Sleuth Kit
    3. Partitioning and Disk Layouts
    4. Special Containers
    5. Hashing
    6. Carving
    7. Forensic Imaging
    8. Summary
    9. References
  11. Chapter 4. Windows Systems and Artifacts
    1. Introduction
    2. Windows File Systems
    3. Registry
    4. Event Logs
    5. Prefetch Files
    6. Shortcut Files
    7. Windows Executables
    8. Summary
    9. References
  12. Chapter 5. Linux Systems and Artifacts
    1. Introduction
    2. Linux File Systems
    3. Linux Boot Process and Services
    4. Linux System Organization and Artifacts
    5. User Accounts
    6. Home Directories
    7. Logs
    8. Scheduling Tasks
    9. Summary
    10. References
  13. Chapter 6. Mac OS X Systems and Artifacts
    1. Introduction
    2. OS X File System Artifacts
    3. OS X System Artifacts
    4. User Artifacts
    5. Summary
    6. References
  14. Chapter 7. Internet Artifacts
    1. Introduction
    2. Browser Artifacts
    3. Mail Artifacts
    4. Summary
    5. References
  15. Chapter 8. File Analysis
    1. File Analysis Concepts
    2. Images
    3. Audio
    4. Video
    5. Archives
    6. Documents
    7. Summary
    8. References
  16. Chapter 9. Automating Analysis and Extending Capabilities
    1. Introduction
    2. Graphical Investigation Environments
    3. Automating Artifact Extraction
    4. Timelines
    5. Summary
    6. References
  17. Appendix A. Free, Non-open Tools of Note
    1. Introduction
    2. Chapter 3: Disk and File System Analysis
    3. Chapter 4: Windows Systems and Artifacts
    4. Chapter 7: Internet Artifacts
    5. Chapter 8: File Analysis
    6. Chapter 9: Automating Analysis and Extending Capabilities
    7. Validation and Testing Resources
  18. Index

Product information

  • Title: Digital Forensics with Open Source Tools
  • Author(s): Harlan Carvey, Cory Altheide
  • Release date: March 2011
  • Publisher(s): Syngress
  • ISBN: 9781597495875