O'Reilly logo

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Digital Forensics with Kali Linux

Book Description

Learn the skills you need to take advantage of Kali Linux for digital forensics investigations using this comprehensive guide

About This Book

  • Master powerful Kali Linux tools for digital investigation and analysis
  • Perform evidence acquisition, preservation, and analysis using various tools within Kali Linux
  • Implement the concept of cryptographic hashing and imaging using Kali Linux
  • Perform memory forensics with Volatility and internet forensics with Xplico.
  • Discover the capabilities of professional forensic tools such as Autopsy and DFF (Digital Forensic Framework) used by law enforcement and military personnel alike

Who This Book Is For

This book is targeted at forensics and digital investigators, security analysts, or any stakeholder interested in learning digital forensics using Kali Linux. Basic knowledge of Kali Linux will be an advantage.

What You Will Learn

  • Get to grips with the fundamentals of digital forensics and explore best practices
  • Understand the workings of file systems, storage, and data fundamentals
  • Discover incident response procedures and best practices
  • Use DC3DD and Guymager for acquisition and preservation techniques
  • Recover deleted data with Foremost and Scalpel
  • Find evidence of accessed programs and malicious programs using Volatility.
  • Perform network and internet capture analysis with Xplico
  • Carry out professional digital forensics investigations using the DFF and Autopsy automated forensic suites

In Detail

Kali Linux is a Linux-based distribution used mainly for penetration testing and digital forensics. It has a wide range of tools to help in forensics investigations and incident response mechanisms.

You will start by understanding the fundamentals of digital forensics and setting up your Kali Linux environment to perform different investigation practices. The book will delve into the realm of operating systems and the various formats for file storage, including secret hiding places unseen by the end user or even the operating system. The book will also teach you to create forensic images of data and maintain integrity using hashing tools. Next, you will also master some advanced topics such as autopsies and acquiring investigation data from the network, operating system memory, and so on. The book introduces you to powerful tools that will take your forensic abilities and investigations to a professional level, catering for all aspects of full digital forensic investigations from hashing to reporting.

By the end of this book, you will have had hands-on experience in implementing all the pillars of digital forensics—acquisition, extraction, analysis, and presentation using Kali Linux tools.

Style and approach

While covering the best practices of digital forensics investigations, evidence acquisition, preservation, and analysis, this book delivers easy-to-follow practical examples and detailed labs for an easy approach to learning forensics. Following the guidelines within each lab, you can easily practice all readily available forensic tools in Kali Linux, within either a dedicated physical or virtual machine.

Downloading the example code for this book You can download the example code files for all Packt books you have purchased from your account at http://www.PacktPub.com. If you purchased this book elsewhere, you can visit http://www.PacktPub.com/support and register to have the files e-mailed directly to you.

Table of Contents

  1. Preface
    1. What this book covers
    2. What you need for this book
    3. Who this book is for
    4. Conventions
    5. Reader feedback
    6. Customer support
      1. Downloading the example code
      2. Errata
      3. Piracy
      4. Questions
  2. Introduction to Digital Forensics
    1. What is digital forensics?
    2. Digital forensics methodology
    3. A brief history of digital forensics
    4. The need for digital forensics as technology advances
    5. Commercial tools available in the field of digital forensics
    6. Operating systems and open source tools for digital forensics
      1. Digital evidence and forensics toolkit Linux
      2. Computer Aided INvestigative Environment
      3. Kali Linux
    7. The need for multiple forensics tools in digital investigations
    8. Anti-forensics: threats to digital forensics
      1. Encryption
      2. Online and offline anonymity
    9. Summary
  3. Installing Kali Linux
    1. Software version
    2. Downloading Kali Linux
    3. Installing Kali Linux
    4. Installing Kali Linux in VirtualBox
      1. Preparing the Kali Linux virtual machine
      2. Installing Kali Linux on the virtual machine
        1. Partitioning the disk
      3. Exploring Kali Linux
    5. Summary
  4. Understanding Filesystems and Storage Media
    1. Storage media
      1. IBM and the history of storage media
      2. Removable storage media
        1. Magnetic tape drives
        2. Floppy disks
          1. Evolution of the floppy disk
        3. Optical storage media
          1. Compact disks
          2. Digital versatile disks
          3. Blu-ray disk
        4. Flash storage media
          1. USB flash drives
        5. Flash memory cards
      3. Hard disk drives
        1. IDE HDDs
        2. SATA HDDs
        3. Solid-state drives
    2. Filesystems and operating systems
    3. What about the data?
      1. Data states
      2. Metadata
      3. Slack space
    4. Data volatility
    5. The paging file and its importance in digital forensics
    6. Summary
  5. Incident Response and Data Acquisition
    1. Digital evidence acquisitions and procedures
    2. Incident response and first responders
    3. Documentation and evidence collection
      1. Physical evidence collection and preservation
      2. Physical acquisition tools
      3. Order of volatility
    4. Chain of Custody
    5. Powered-on versus powered-off device acquisition
      1. Powered-on devices
      2. Powered-off devices
    6. Write blocking
    7. Data imaging and hashing
      1. Message Digest (MD5) hash
      2. Secure Hashing Algorithm (SHA)
    8. Device and data acquisition guidelines and best practices
    9. Summary
  6. Evidence Acquisition and Preservation with DC3DD and Guymager
    1. Drive and partition recognition in Linux
      1. Device identification using the fdisk command
    2. Maintaining evidence integrity
    3. Using DC3DD in Kali Linux
      1. File-splitting using DC3DD
        1. Verifying hashes of split image files
      2. Erasing a drive using DC3DD
    4. Image acquisition using Guymager
      1. Running Guymager
      2. Acquiring evidence with Guymager
      3. Hash verification
    5. Summary
  7. File Recovery and Data Carving with Foremost, Scalpel, and Bulk Extractor
    1. Forensic test images used in Foremost and Scalpel
    2. Using Foremost for file recovery and data carving
      1. Viewing Foremost results
    3. Using Scalpel for data carving
      1. Specifying file types in Scalpel
      2. Using Scalpel for file carving
      3. Viewing results of Scalpel
      4. Comparing Foremost and Scalpel
    4. Bulk_extractor
      1. Forensic test image for Bulk_extractor
      2. Using Bulk_extractor
      3. Viewing results of Bulk_extractor
    5. Summary
  8. Memory Forensics with Volatility
    1. About the Volatility Framework
    2. Downloading test images for use with Volatility
      1. Image location
    3. Using Volatility in Kali Linux
      1. Choosing a profile in Volatility
        1. The imageinfo plugin
      2. Process identification and analysis
        1. The pslist command
        2. The pstree command
        3. The psscan command
        4. The psxview plugin
      3. Analyzing network services and connections 
        1. The connections command
        2. The connscan command
        3. The sockets plugin
      4. DLL analysis
        1. The verinfo command
        2. The dlllist plugin
        3. The getsids command
      5. Registry analysis
        1. The hivescan plugin
        2. The hivelist plugin
      6. Password dumping
      7. Timeline of events
        1. The timeliner plugin
      8. Malware analysis
    4. Summary
  9. Autopsy – The Sleuth Kit
    1. Introduction to Autopsy – The Sleuth Kit
    2. Sample image file used in Autopsy
    3. Digital forensics with Autopsy
      1. Starting Autopsy
      2. Creating a new case
      3. Analysis using Autopsy
        1. Sorting files
      4. Reopening cases in Autopsy
    4. Summary
  10. Network and Internet Capture Analysis with Xplico
    1. Software required
      1. Starting Xplico in Kali Linux
      2. Starting Xplico in DEFT Linux 8.2
    2. Packet capture analysis using Xplico
      1. HTTP and web analysis using Xplico
      2. VoIP analysis using Xplico
      3. Email analysis using Xplico
        1. SMTP exercise using Wireshark sample file
    3. Summary
  11. Revealing Evidence Using DFF
    1. Installing DFF
      1. Starting the DFF GUI
      2. Recovering deleted files with DFF
      3. File analysis with DFF
    2. Summary