Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 10. Malware Forensics

In this chapter, we combine malware analysis techniques with forensic tools. The objective is to give you a better understanding of how malware alters a system so that you know what to look for when detecting infections, and how to react when you encounter such malware. Likewise, the chapter gives you some tips on how to build your own tools if the current ones don't suit your needs. It is important to note that this chapter is not a step-by-step guide with a comprehensive list of actions you should take during an investigation. Rather, the chapter presents a collection of explanations and solutions to specific problems that we think you'll run into while analyzing or investigating malware incidents.

The Sleuth Kit (TSK)

The Sleuth Kit (http://www.sleuthkit.org/) is a C library and a collection of command-line tools for file system forensic investigations. On your Ubuntu system, you can type apt-get install sleuthkit to get the Linux binaries. If the repository doesn't have the latest version or if you want the precompiled Windows binaries, you can get them from TSK's SourceForge page at http://sourceforge.net/projects/sleuthkit/files. In this section, we'll use TSK to investigate alternate data streams, hidden files, and hidden Registry keys.

DISCOVERING ALTERNATE DATA STREAMS WITH TSK

Malware that hides in alternate data streams (ADS) has been around for many years and it is still prevalent today. Explorer and command-line directory listings (via cmd.exe) ...