book

Digital Forensics with Kali Linux - Third Edition

Name: Digital Forensics with Kali Linux - Third Edition
Author: Shiva V. N. Parasram
ISBN: 9781837635153

by Shiva V. N. Parasram

April 2023

Intermediate to advanced

414 pages

8h 57m

English

Packt Publishing

Read now

Unlock full access

Digital Forensics with Kali Linux
ContributorsAbout the authorAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Part 1: Blue and Purple Teaming Fundamentals
Chapter 1: Red, Blue, and Purple Teaming Fundamentals
How I got started with Kali LinuxWhat is Kali Linux?Why is Kali Linux so popular?Understanding red teamingUnderstanding blue teamingUnderstanding purple teamingSummary
Chapter 2: Introduction to Digital Forensics
What is digital forensics?The need for blue and purple teamsDigital forensics methodologies and frameworksDFIR frameworksComparison of digital forensics operating systemsDigital evidence and forensics toolkit LinuxComputer Aided INvestigative Environment (CAINE)CSI LinuxKali LinuxThe need for multiple forensics tools in digital investigationsCommercial forensics toolsAnti-forensics – threats to digital forensicsSummary
Chapter 3: Installing Kali Linux
Technical requirementsDownloading Kali LinuxDownloading the required tools and imagesDownloading the Kali Linux Everything torrentInstalling Kali Linux on portable storage media for  live DFIRInstalling Kali as a standalone operating systemInstalling Kali in VirtualBoxPreparing the Kali Linux VMInstalling Kali Linux on the virtual machineInstalling and configuring Kali Linux as a virtual machine or as a standalone OSSummary
Chapter 4: Additional Kali Installations and Post-Installation Tasks
Installing a pre-configured version of Kali Linux in VirtualBoxInstalling Kali Linux on Raspberry Pi4Updating KaliEnabling the root user account in KaliAdding the Kali Linux forensics metapackageSummary
Chapter 5: Installing Wine in Kali Linux
What Wine is and the advantages of using it in Kali LinuxInstalling WineConfiguring our Wine installationTesting our Wine installationSummary
Part 2: Digital Forensics and Incident Response Fundamentals and Best Practices
Chapter 6: Understanding File Systems and Storage
History and types of storage mediaIBM and the history of storage mediaRemovable storage mediaMagnetic tape drivesFloppy disksOptical storage mediaBlu-ray DiscFlash storage mediaUSB ﬂash drivesFlash memory cardsHard disk drivesIntegrated Drive Electronics HDDsSerial Advanced Technology Attachment HDDsSolid-state drivesFile systems and operating systemsMicrosoft WindowsMacintosh (macOS)LinuxData types and statesMetadataSlack spaceVolatile and non-volatile data and the order of volatilityThe importance of RAM, the paging file, and cache in DFIRSummary

Chapter 7: Incident Response, Data Acquisitions, and DFIR Frameworks
Evidence acquisition proceduresIncident response and first respondersEvidence collection and documentationPhysical acquisition toolsLive versus post-mortem acquisitionOrder of volatilityPowered-on versus powered-off device acquisitionThe CoCThe importance of write blockersData imaging and maintaining evidence integrityMessage Digest (MD5) hashSecure Hashing Algorithm (SHA)Data acquisition best practices and DFIR frameworksDFIR frameworksSummary
Part 3: Kali Linux Digital Forensics and Incident Response Tools
Chapter 8: Evidence Acquisition Tools
Using the fdisk command for partition recognitionDevice identification using the fdisk commandCreating strong hashes for evidence integrityDrive acquisition using DC3DDVerifying the hash output of image filesErasing a drive using DC3DDDrive acquisition using DDDrive acquisition using GuymagerRunning GuymagerAcquiring evidence with GuymagerDrive and memory acquisition using FTK Imager in WineInstalling FTK ImagerRAM acquisition with FTK ImagerRAM and paging file acquisition using Belkasoft RAM CapturerSummary
Chapter 9: File Recovery and Data Carving Tools
File basicsDownloading the sample filesFile recovery and data carving with ForemostImage recovery with MagicrescueData carving with ScalpelData extraction with bulk_extractorNTFS recovery using scrounge-ntfsImage recovery using RecoverjpegSummary
Chapter 10: Memory Forensics and Analysis with Volatility 3
What’s new in Volatility 3Downloading sample memory dump filesInstalling Volatility 3 in Kali LinuxMemory dump analysis using Volatility 3Image and OS verificationProcess identification and analysisSummary
Chapter 11: Artifact, Malware, and Ransomware Analysis
Identifying devices and operating systems with p0fLooking at the swap_digger tool to explore Linux artifactsInstalling and using swap_diggerPassword dumping with MimiPenguinPDF malware analysisUsing Hybrid Analysis for malicious file analysisRansomware analysis using Volatility 3The pslist pluginSummary
Part 4: Automated Digital Forensics and Incident Response Suites
Chapter 12: Autopsy Forensic Browser
Introduction to Autopsy – The Sleuth KitDownloading sample files for use and creating a case in the Autopsy browserStarting AutopsyCreating a new case in the Autopsy forensic browserEvidence analysis using the Autopsy forensic browserSummary
Chapter 13: Performing a Full DFIR Analysis with the Autopsy 4 GUI
Autopsy 4 GUI featuresInstalling Autopsy 4 in Kali Linux using WineDownloading sample files for automated analysisCreating new cases and getting acquainted with the Autopsy 4 interfaceAnalyzing directories and recovering deleted files and artifacts with Autopsy 4Summary
Part 5: Network Forensic Analysis Tools
Chapter 14: Network Discovery Tools
Using netdiscover in Kali Linux to identify devices on a networkUsing Nmap to find additional hosts and devices on a networkUsing Nmap to fingerprint host detailsUsing Shodan.io to find IoT devices including firewalls, CCTV, and serversUsing Shodan filters for IoT searchesSummary
Chapter 15: Packet Capture Analysis with Xplico
Installing Xplico in Kali LinuxInstalling DEFT Linux 8.1 in VirtualBoxDownloading sample analysis filesStarting Xplico in DEFT LinuxUsing Xplico to automatically analyze web, email, and voice trafficAutomated web traffic analysisAutomated SMTP traffic analysisAutomated VoIP traffic analysisSummary
Chapter 16: Network Forensic Analysis Tools
Capturing packets using WiresharkPacket analysis using NetworkMinerPacket capture analysis with PcapXrayOnline PCAP analysis using packettotal.comOnline PCAP analysis using apackets.comReporting and presentationSummary
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Content preview from Digital Forensics with Kali Linux - Third Edition

10 Memory Forensics and Analysis with Volatility 3

In the previous chapters, we looked at the various methods for data carving and file recovery. In this chapter, we’ll look at the analysis of content stored in Random Access Memory (RAM) using the very powerful Volatility 3. RAM is volatile, meaning that the data in RAM is easily lost when there is no longer an electrical charge or current going to the RAM. With the data on RAM being the most volatile, it ranks high in the order of volatility and must be forensically acquired and preserved as a matter of high priority.

Many types of data and forensic artifacts reside in RAM and the paging file. As discussed in previous chapters, login passwords, user information, running and hidden processes, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781837635153

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Digital Forensics with Kali Linux - Third Edition

by Shiva V. N. Parasram

10

Memory Forensics and Analysis with Volatility 3

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.