封面
版权信息
Credits
Disclaimer
About the Author
About the Reviewers
www.PacktPub.com
Why subscribe?
Customer Feedback
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the example code
Errata
Piracy
Questions
Introduction to Digital Forensics
What is digital forensics?
Digital forensics methodology
A brief history of digital forensics
The need for digital forensics as technology advances
Commercial tools available in the field of digital forensics
Operating systems and open source tools for digital forensics
Digital evidence and forensics toolkit Linux
Computer Aided INvestigative Environment
Kali Linux
The need for multiple forensics tools in digital investigations
Anti-forensics: threats to digital forensics
Encryption
Online and offline anonymity
Summary
Installing Kali Linux
Software version
Downloading Kali Linux
Installing Kali Linux
Installing Kali Linux in VirtualBox
Preparing the Kali Linux virtual machine
Installing Kali Linux on the virtual machine
Partitioning the disk
Exploring Kali Linux
Summary
Understanding Filesystems and Storage Media
Storage media
IBM and the history of storage media
Removable storage media
Magnetic tape drives
Floppy disks
Evolution of the floppy disk
Optical storage media
Compact disks
Digital versatile disks
Blu-ray disk
Flash storage media
USB flash drives
Flash memory cards
Hard disk drives
IDE HDDs
SATA HDDs
Solid-state drives
Filesystems and operating systems
What about the data?
Data states
Metadata
Slack space
Data volatility
The paging file and its importance in digital forensics
Summary
Incident Response and Data Acquisition
Digital evidence acquisitions and procedures
Incident response and first responders
Documentation and evidence collection
Physical evidence collection and preservation
Physical acquisition tools
Order of volatility
Chain of Custody
Powered-on versus powered-off device acquisition
Powered-on devices
Powered-off devices
Write blocking
Data imaging and hashing
Message Digest (MD5) hash
Secure Hashing Algorithm (SHA)
Device and data acquisition guidelines and best practices
Summary
Evidence Acquisition and Preservation with DC3DD and Guymager
Drive and partition recognition in Linux
Device identification using the fdisk command
Maintaining evidence integrity
Using DC3DD in Kali Linux
File-splitting using DC3DD
Verifying hashes of split image files
Erasing a drive using DC3DD
Image acquisition using Guymager
Running Guymager
Acquiring evidence with Guymager
Hash verification
Summary
File Recovery and Data Carving with Foremost Scalpel and Bulk Extractor
Forensic test images used in Foremost and Scalpel
Using Foremost for file recovery and data carving
Viewing Foremost results
Using Scalpel for data carving
Specifying file types in Scalpel
Using Scalpel for file carving
Viewing results of Scalpel
Comparing Foremost and Scalpel
Bulk_extractor
Forensic test image for Bulk_extractor
Using Bulk_extractor
Viewing results of Bulk_extractor
Summary
Memory Forensics with Volatility
About the Volatility Framework
Downloading test images for use with Volatility
Image location
Using Volatility in Kali Linux
Choosing a profile in Volatility
The imageinfo plugin
Process identification and analysis
The pslist command
The pstree command
The psscan command
The psxview plugin
Analyzing network services and connections
The connections command
The connscan command
The sockets plugin
DLL analysis
The verinfo command
The dlllist plugin
The getsids command
Registry analysis
The hivescan plugin
The hivelist plugin
Password dumping
Timeline of events
The timeliner plugin
Malware analysis
Summary
Autopsy – The Sleuth Kit
Introduction to Autopsy – The Sleuth Kit
Sample image file used in Autopsy
Digital forensics with Autopsy
Starting Autopsy
Creating a new case
Analysis using Autopsy
Sorting files
Reopening cases in Autopsy
Summary
Network and Internet Capture Analysis with Xplico
Software required
Starting Xplico in Kali Linux
Starting Xplico in DEFT Linux 8.2
Packet capture analysis using Xplico
HTTP and web analysis using Xplico
VoIP analysis using Xplico
Email analysis using Xplico
SMTP exercise using Wireshark sample file
Summary
Revealing Evidence Using DFF
Installing DFF
Starting the DFF GUI
Recovering deleted files with DFF
File analysis with DFF
Summary
更新时间：2021-07-02 21:34:07
完结共169章
倒序