book

Digital Forensics with Kali Linux - Second Edition

Name: Digital Forensics with Kali Linux - Second Edition
ISBN: 9781838640804

by Shiva V. N. Parasram, Alex Samm, Dale Joseph

April 2020

Intermediate to advanced

334 pages

7h 11m

English

Packt Publishing

Read now

Unlock full access

Digital Forensics with Kali Linux Second Edition
Why subscribe?ContributorsAbout the authorAbout the reviewersPackt is searching for authors like you
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchReviews
Section 1: Kali Linux – Not Just for Penetration Testing
Chapter 1: Introduction to Digital Forensics
What is digital forensics?Digital forensics methodologyA brief history of digital forensicsThe need for digital forensics as technology advancesOperating systems and open source tools for digital forensicsDigital Evidence and Forensics Toolkit (DEFT) LinuxCAINEKali LinuxThe need for multiple forensics tools in digital investigationsCommercial forensics toolsBelkasoft Evidence Center (EC) 2020AccessData Forensic Toolkit (FTK)EnCase ForensicAnti-forensics – threats to digital forensicsEncryptionOnline and offline anonymitySummaryFurther reading
Chapter 2: Installing Kali Linux
Software versionDownloading Kali LinuxInstalling Kali LinuxInstalling Kali Linux in VirtualBoxPreparing the Kali Linux virtual machineInstalling Kali Linux on the virtual machineCreating a bootable Kali Linux portable driveExploring Kali LinuxSummary
Section 2: Forensic Fundamentals and Best Practices
Chapter 3: Understanding Filesystems and Storage Media
The history of storage mediaIBM and the history of storage mediaRemovable storage mediaHard disk drivesFilesystems and operating systemsWhat about the data?Data statesMetadataSlack spaceData volatilityThe paging file and its importance in digital forensicsSummary
Chapter 4: Incident Response and Data Acquisition
Digital evidence acquisition and proceduresIncident response and first respondersDocumentation and evidence collectionPhysical evidence collection and preservationPhysical acquisition toolsOrder of volatilityChain of custodyLive acquisition versus post-mortem acquisitionPowered-on devicesPowered-off devicesWrite blockingData imaging and hashingMessage Digest hashSecure Hashing Algorithm (SHA)Device and data acquisition guidelines and best practicesSummary
Section 3: Forensic Tools in Kali Linux
Chapter 5: Evidence Acquisition and Preservation with dc3dd and Guymager
Drive and partition recognition in LinuxDevice identification using the fdisk commandMaintaining evidence integrityUsing dc3dd in Kali LinuxFile-splitting using dc3ddErasing a drive using dc3ddImage acquisition using DDImage acquisition using GuymagerRunning GuymagerAcquiring evidence with GuymagerWindows memory acquisitionFTK ImagerRAM acquisition with FTK ImagerBelkasoft RAM CapturerSummary

Chapter 6: File Recovery and Data Carving with foremost, Scalpel, and bulk_extractor
Forensic test images used in Foremost and ScalpelUsing Foremost for file recovery and data carvingViewing the Foremost resultsSimple JPEG recovery using recoverjpegUsing Scalpel for data carvingSpecifying file types in ScalpelUsing Scalpel for file carvingViewing the results of ScalpelComparing Foremost and Scalpelbulk_extractorForensic test image used in bulk_extractorUsing bulk_extractorViewing the results of bulk_extractorSummary
Chapter 7: Memory Forensics with Volatility
Introducing the Volatility FrameworkDownloading test images for use with VolatilityImage locationUsing Volatility in Kali LinuxChoosing a profile in VolatilityProcess identification and analysisAnalyzing network services and connectionsDLL analysisRegistry analysisPassword dumpingTimeline of eventsMemory analysis using Evolve (a Volatility GUI) Summary
Chapter 8: Artifact Analysis
Identifying devices and operating systems with p0f Information gathering and fingerprinting with NmapLive Linux forensics with Linux ExplorerRansomware analysis Downloading and extracting a sample ransomware fileWannaCry analysis using Volatilityswap_diggerInstalling and using swap_diggerPassword dumping with mimipenguinExamining Firefox artifacts with pdgmailSummary
Section 4: Automated Digital Forensic Suites
Chapter 9: Autopsy
Introduction to AutopsyThe sample image file used in AutopsyDigital forensics with AutopsyStarting AutopsyCreating a new caseAnalysis using AutopsyReopening cases in AutopsyAutopsy in WindowsSummary
Chapter 10: Analysis with Xplico
Software requirementsInstalling Xplico in Kali LinuxStarting Xplico in DEFT Linux 8.2Packet capture analysis using XplicoHTTP and web analysis using XplicoVoIP analysis using XplicoEmail analysis using XplicoNetwork activity analysis exercise Summary
Chapter 11: Network Analysis
Capturing packets using WiresharkNetworkMinerPacket capture analysis with PcapXrayOnline PCAP analysis Reporting and presentationSummary
Other Books You May Enjoy

Content preview from Digital Forensics with Kali Linux - Second Edition

Digital Forensics with Kali Linux Second Edition

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781838640804

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Digital Forensics with Kali Linux - Second Edition

by Shiva V. N. Parasram, Alex Samm, Dale Joseph

Digital Forensics with Kali Linux Second Edition

Digital Forensics with Kali Linux Second Edition

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.