Digital Forensics with Kali Linux Second Edition

Perform data acquisition, data recovery, network forensics, and malware analysis with Kali Linux 2019.x

Shiva V. N. Parasram 지음

Packt(GCO Science) 2020년 04월 17일 출간

작품소개

책소개

▶Book Description
Kali Linux is a Linux-based distribution that's widely used for penetration testing and digital forensics. It has a wide range of tools to help for digital forensics investigations and incident response mechanisms.

This updated second edition of Digital Forensics with Kali Linux covers the latest version of Kali Linux and The Sleuth Kit. You'll get to grips with modern techniques for analysis, extraction, and reporting using advanced tools such as FTK Imager, hex editor, and Axiom. Updated to cover digital forensics basics and advancements in the world of modern forensics, this book will also delve into the domain of operating systems. Progressing through the chapters, you'll explore various formats for file storage, including secret hiding places unseen by the end user or even the operating system. The book will also show you how to create forensic images of data and maintain integrity using hashing tools. Finally, you'll cover advanced topics such as autopsies and acquiring investigation data from networks, operating system memory, and quantum cryptography.

By the end of this book, you'll have gained hands-on experience of implementing all the pillars of digital forensics: acquisition, extraction, analysis, and presentation, all using Kali Linux tools.

▶What You Will Learn
- Get up and running with powerful Kali Linux tools for digital investigation and analysis
- Perform internet and memory forensics with Volatility and Xplico
- Understand filesystems, storage, and data fundamentals
- Become well-versed with incident response procedures and best practices
- Perform ransomware analysis using labs involving actual ransomware
- Carry out network forensics and analysis using NetworkMiner and other tools

▶Key Features
- Perform evidence acquisition, preservation, and analysis using a variety of Kali Linux tools
- Use PcapXray to perform timeline analysis of malware and network activity
- Implement the concept of cryptographic hashing and imaging using Kali Linux

▶Who This Book Is For
This Kali Linux book is for forensics and digital investigators, security analysts, or anyone interested in learning digital forensics using Kali Linux. Basic knowledge of Kali Linux will be helpful to gain a better understanding of the concepts covered.

목차

▶TABLE of CONTENTS
▷ Section 1: Kali Linux ？ Not Just for Penetration Testing
Chapter 1: Introduction to Digital Forensics
Chapter 2: Installing Kali Linux
▷ Section 2: Forensic Fundamentals and Best Practices
Chapter 3: Understanding Filesystems and Storage Media
Chapter 4: Incident Response and Data Acquisition
▷ Section 3: Forensic Tools in Kali Linux
Chapter 5: Evidence Acquisition and Preservation with dc3dd and Guymager
Chapter 6: File Recovery and Data Carving with foremost, Scalpel, and bulk_extractor
Chapter 7: Memory Forensics with Volatility
Chapter 8: Artifact Analysis
▷ Section 4: Automated Digital Forensic Suites
Chapter 9: Autopsy
Chapter 10: Analysis with Xplico
Chapter 11: Network Analysis

책 속으로

▶What this book covers
- Chapter 1, Introduction to Digital Forensics, introduces the reader to the world of digital forensics and forensic methodology, and also introduces the reader to various forensic operating systems.

- Chapter 2, Installing Kali Linux, covers the various methods that can be used to install Kali Linux as a virtual machine or as a standalone operating system, which can also be run from a flash drive or SD card.

- Chapter 3, Understanding Filesystems and Storage Media, dives into the realm of operating systems and the various formats for file storage, including secret hiding places not seen by the end user or even the operating system. We also inspect data about data, known as metadata, and look at its volatility.

- Chapter 4, Incident Response and Data Acquisition, asks what happens when an incident is reported or detected? Who are the first responders and what are the procedures for maintaining the integrity of the evidence? In this chapter, we look at best practices and procedures in data acquisition and evidence collection.

- Chapter 5, Evidence Acquisition and Preservation with dc3dd and Guymager, helps you to harness the power of DC3DD to acquire evidence, calculate and verify hashes, split images, and even forensically erase media. We'll also look at the Guymager GUI interface to acquire evidence and introduce Windows imaging tools such as FTK Imager and Belkasoft RAM Capturer.

- Chapter 6, File Recovery and Data Carving with foremost, Scalpel, and bulk_extractor, covers tools that demonstrate that deleted data can be recovered using various file-carving methods.

- Chapter 7, Memory Forensics with Volatility, demonstrates the importance of preserving volatile evidence such as the contents of the RAM and the paging file. Using Volatility and Evolve, we will identify and analyze running processes and network connections, and identify existing malware.

- Chapter 8, Artifact Analysis, deals with tools that we can use to identify systems, processes, passwords, emails, and other artifacts that are useful to any investigator. We also perform artifact analysis of the WannaCry ransomware.

- Chapter 9, Autopsy, The Sleuth Kit, revisits Autopsy (with new labs), which is recognized as one of the very few available tools to rival commercial forensic tools. This powerful tool takes forensic abilities and investigations to a professional level, catering for all aspects of full digital forensics investigations from hashing to reporting.

- Chapter 10, Analysis with Xplico, investigates and analyzes captured network and internet traffic using this powerful tool.

- Chapter 11, Network Analysis, continues with network artifact analysis by demonstrating how to create packet captures with Wireshark, and then quickly moves into automated analysis using offline and online tools such as Network Miner, PcapXray, and PacketTotal.

출판사 서평

▶ Preface
In this second edition of this book, you'll find that the theory and methodologies have remained mostly the same, as the procedures and documentation are standard throughout the field; however, you'll find that the technical chapters contain new labs using new examples. I've also decided to include two completely new chapters that go into artifact analysis and network analysis, showcasing several tools with practicals that even beginners will find easy to follow. As much as we try to secure our data, systems, and networks to the best of our abilities, breaches occur. In an effort to understand what took place, we turn to the field of digital forensics. Although still a relatively new field, forensics has become just as important as security, especially considering the wealth of information available to anyone accessing the internet with the intent of carrying out malicious activity. Thankfully, digital fingerprints and artifacts are sometimes left behind, whether in a deleted or hidden file, an email, in someone's browsing history, a remote connection list, or even a mobile text message.

인물정보

저자(글) Shiva V. N. Parasram

Shiva V. N. Parasram is the Executive Director and CISO of the Computer Forensics and Security Institute, which specializes in penetration testing, forensics, and advanced cybersecurity training. As the only Certified EC-Council Instructor (CEI) in the Caribbean, he has also trained hundreds in CCNA, CND, CEH, CHFI, ECSA, and CCISO, among other certifications. He has partnered with international companies including Fujitsu (Trinidad) and Take It To The Top LLC as the lead trainer for advanced cybersecurity courses. Shiva is also the author of two other books from Packt Publishing and has delivered workshops, lectures, and keynote speeches regionally for ISACA, universities, law associations, and other institutions.