Real Digital Forensics: Computer Security and Incident Response
Be the First to Write a Review and tell the world about this title!People who purchase this book frequently purchase: - File System Forensic Analysis; Brian Carrier, $37.50, 37% Off!
- Extrusion Detection: Security Monitoring for Internal Intrusions; Richard Bejtlich, $34.50, 37% Off!
- Windows Forensics and Incident Recovery; Harlan Carvey, $37.50, 37% Off!
- Nessus, Snort, and Ethereal Power Tools: Customizing Open Source Security Applications; Gilbert Ramirez, et al, $28.50, 29% Off!
Books on similar topics, in best-seller order:Books from the same publisher, in best-seller order:
Don't just read about computer forensics... do it, hands-on!
You can't succeed in the field of computer forensics without hands-on practice-and
you can't get hands-on practice without real forensic data. The solution: Real
Digital Forensics. In this book, a team of world-class computer forensics
experts walk you through five detailed, highly realistic investigations and
provide a DVD-ROM with all the data you need to follow along and practice.
From binary memory dumps to log files, this DVD-ROM's intrusion data was generated
by attacking live systems using the same tools and methods real-world attackers
use. It was then captured and analyzed using the same tools the authors employ
in their own investigations. This book relies heavily on open source tools,
so you can perform virtually every task without investing in any commercial
software.
You'll investigate environments ranging from financial institutions to software
companies and crimes ranging from intellectual property theft to SEC violations.
As you move step by step through each investigation, you'll discover practical
techniques for overcoming the challenges forensics professionals face most often.
Coverage includes
-
Responding to live incidents in both Windows and Unix environments
-
Determining whether an attack has actually occurred
-
Assembling a toolkit you can take to the scene of a computer-related crime
-
Analyzing volatile data, nonvolatile data, and files of unknown origin
-
Safely performing and documenting forensic duplications
-
Collecting and analyzing network-based evidence in Windows and Unix environments
-
Reconstructing Web browsing, e-mail activity, and Windows registry changes
-
Tracing domain name ownership and the source of e-mails
-
Duplicating and analyzing the contents of PDAs and flash memory devices
Table of Contents
Preface.
Acknowledgments.
About the
Authors.
Case Studies.
I. LIVE INCIDENT
RESPONSE.
1. Windows
Live Response.
2. Unix
Live Response.
II. NETWORK-BASED
FORENSICS.
3. Collecting
Network-Based Evidence.
4. Analyzing
Network-Based Evidence for a Windows Intrusion.
5. Analyzing
Network-Based Evidence for a Unix Intrusion.
III. ACQUIRING
A FORENSIC DUPLICATION.
6. Before You Jump Right In...
7. Commercial-Based
Forensic Duplications.
8. Noncommercial-Based
Forensic Duplications.
IV. FORENSIC
ANALYSIS TECHNIQUES.
9. Common
Forensic Analysis Techniques.
10. Web Browsing
Activity Reconstruction.
11. E-Mail Activity
Reconstruction.
12. Microsoft
Windows Registry Reconstruction.
13. Forensic
Tool Analysis: An Introduction to Using Linux for Analyzing Files of Unknown
Origin.
14. Forensic
Tool Analysis: A Hands-On Analysis of the Linux File aio.
15. Forensic
Tool Analysis: Analyzing Files of Unknown Origin (Windows).
V. CREATING
A COMPLETE FORENSIC TOOL KIT.
16. Building
the Ultimate Response CD.
17. Making Your
CD-ROM a Bootable Environment.
VI. MOBILE
DEVICE FORENSICS.
18. Forensic
Duplication and Analysis of Personal Digital Assistants.
19. Forensic
Duplication of USB and Compact Flash Memory Devices.
20. Forensic
Analysis of USB and Compact Flash Memory Devices.
VII. ONELINE-BASED
FORENSCIS.
21. Tracing
E-Mail.
22. Domain Name
Ownership.
Appendix:
An Introduction to Perl.
Index.
About the Author
Dr. Keith Jones, Ph.D is a veteran programmer with more than 20 years of development
experience. An expert in artificial intelligence and human/computer interactions,
he has a long history of creating specialized applications for some of the largest
companies in the world, including Ford Motor Company, American Airlines, and
Dun & Bradstreet. Keith's most recent projects included speech recognition
applications for the US Department of Education, artificial intelligence solutions
for the Nielsen Ratings, and programs that enabled NASA robots to see. Dr. Jones
is the has written numerous articles for professional publications including
ComputerWorld, and Enterprise Journal, and is the author of several books on
Y2K issues, and software quality assurance.
|
