Open Source and Incident Response
|
|
|
- Clinton Joseph
- 8 years ago
- Views:
Transcription
1 Open Source and Incident Response Joe Lofshult, CISSP, GCIH 1
2 Agenda Overview Open Source Tools FIRE Demonstration 2
3 Overview Incident Adverse event that threatens security in computing systems and networks. Examples include system crashes, DOS attacks, unauthorized account access, web page defacement, or virus infection. [Schultz and Shumway] Incident Response Actions taken to handle an incident that occurs. 3
4 Overview Computer Forensics Definition The process of methodically examining computer data for evidence. Network Forensics Applying the computer forensic methods to the search for evidence in network traffic. Host Forensics Applying computer forensic methods to the examination of computer media (hard disks, tapes, diskettes, etc). 4
5 Overview Live System Response Goals Determine if an incident has occurred or is in progress. Take steps to contain the incident. Record all steps taken. Tools Required View processes, network ports, disk files. Network sniffer and diagnostic tools. Trusted binaries. Can t trust any programs on the system. Tools to help automate information gathering and reporting. 5
6 Overview Forensic Analysis Goals Gather evidence from computer media. Gather evidence from network traffic logs. Analyze data to to determine what happened. Do not alter the evidence. Maintain a chain of evidence. Create record of all steps taken. Tools Required Tools to acquire the digital data. Tools to analyze the data. Tools to help automate the analysis and create a record. 6
7 Open Source Tools Pros Price is right Tools can be customized to meet needs Empowers analyst (can look under the covers) Cons Commercial support rarely available Legal acceptability Documentation sometimes sparse Tools not integrated 7
8 Open Source Tools Windows Live Response Standard Windows utilities Other free tools Foundstone tools fport, sfind, hfind, afind, ntlast, etc Sysinternals tools psloggedon, pslist, ntfsinfo, etc Cygwin toolkit Preferably run from external media (disk, CD- ROM, etc) 8
9 Open Source Tools Unix Live Response Standard Unix tools ps, cat, find, dd, script, strings Other freeware tools lsof, netcat, tcpdump Preferably statically compiled and mounted from external media 9
10 Open Source Tools Forensic Analysis Linux makes a great platform because It supports many file system types It affords the ability to examine a file system without affecting it The development community has created many terrific analysis tools for it It can run from bootable media 10
11 Open Source Tools Forensic Analysis Linux File System Support Ext2, Ext3 (Linux) FFS, UFS (BSD, Unix) FAT, VFAT (DOS, Windows) NTFS (Windows NT/2000/XP) HPFS (OS/2) ISO9660 (CD-ROM) 11
12 Open Source Tools Forensic Analysis Control over file system access Drives are not mounted by default Can be mounted with options such as: read-only to prevent modifying files noatime to prevent modifying access time noexec to prevent executing code by mistake 12
13 Open Source Tools Forensic Analysis Data Acquisition Tools dd Rated Best Buy by SC Magazine for data acquisition in September 2000 dcfldd DoD enhanced dd that performs md5sum hashing rda combines dd, md5sum, and netcat in one tool Data Validation Tools md5sum, sha1sum Generate md5 for sha2 hashes 13
14 Open Source Tools Forensic Analysis Data Analysis Tools Media analysis Sleuthkit, Autopsy, mac-robber foremost fatback Network analysis tcpdump The standard Snort Ethereal, Etherape, ngrep 14
15 Open Source Tools Forensic Analysis Bootable distributions Not just for incident response (diskless, old systems, low memory, etc) Knoppix ( Trinux ( FIRE ( 15
16 FIRE F.I.R.E. Forensic and Incident Response Environment Developed by William Salusky Available at Developed with forensics and incident response in mind System requirements x86 system with at least 48 MB RAM 16
17 FIRE Bootable Linux CD-ROM Good hardware support IDE and SCSI devices Firewire and USB drives Support for x filesystems PCMCIA devices X Windows support Security tool collection Everything mentioned so far and much, much more 17
18 FIRE Use for Live Response Good addition to your jump kit Just pop it in the CD-ROM drive Trusted, read-only environment Static binaries for Windows, Solaris, Linux Incident response data collection scripts Linux: linux-ir.sh Solaris: solaris-ir.sh Win32: F.R.E.D. scripts (fred.bat and fred-nc.bat) 18
19 FIRE Use for Forensic Analysis Data Acquisition Boot from the CD-ROM Choose either console or GUI environment Make a bit-level backup of media dd, dcfldd, or rda Send backup to an external disk, cdrom, or to trusted server across a network VNC included for remote analysis 19
20 FIRE Use for Forensic Analysis Data Acquisition Example: Using dd and netcat to send an image to another server for analysis On server: $ nc l p 9000 > image In FIRE: $ dd if=/dev/hda1 nc server
21 FIRE Use for Forensic Analysis Data Analysis Preferably, analysis would be done on backup image Could use tools on FIRE disk If not practical, could perform analysis using FIRE disk on the original system 21
22 FIRE Other Uses Penetration Testing Tools such as Dsniff, firewalk, fragrouter, John the Ripper, Nemesis, Nessus, NBTScan, Nikto, Nmap, hunt, airsnort Emergency Recovery Recover files Reset passwords Repair file systems 22
23 FIRE Demonstration 23
24 Summary Open source tools can play an important role in incident response and forensic analysis. They re not just for cash-strapped organizations. There are many great free tools available. Get familiar with some the tools we ve discussed. During an incident is not the time to learn new tools. Download F.I.R.E. and check it out. I recommend version 0.3.5b. 24
25 Where to Get More Information Books Mandia, Kevin and Chris Prosise. Incident Response. Osborne/McGraw-Hill Schultz, E. Eugene and Russell Shumway. Incident Response. New Riders
26 Where to Get More Information White Papers and Presentations Carrier, Brian. Open Source Software in Digital Forensics. SANS May Webcast on F.I.R.E. Preservation of Fragile Digital Evidence by First Responders. esse_kornblum.pdf 26
27 Where to Get More Information Tools F.I.R.E. Incident Response Homepage. Sleuthkit, Autopsy, and mac-robber. Remote Data Acquisition. Cygwin. Foundstone tools. /navigation.htm&subcontent=/resources/freetools.htm 27
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 12 Network Forensics Objectives Understand Internet fundamentals Understand network basics Acquire data on a Linux computer Guide
Forensic Investigator. Module XI Linux Forensics
Computer Hacking Forensic Investigator Module XI Linux Forensics Module Objective This module will familiarize you with the following: Use of Linux as a forensic tool. Recognizing partitions in Linux.
Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM)
s Unix Definition of : Computer Coherent application of a methodical investigatory techniques to solve crime cases. Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix
INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION
" - * INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION CHRIS PROSISE KEVIN MANDIA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul
Computer Forensic Tools. Stefan Hager
Computer Forensic Tools Stefan Hager Overview Important policies for computer forensic tools Typical Workflow for analyzing evidence Categories of Tools Demo SS 2007 Advanced Computer Networks 2 Important
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 4 Current Computer Forensics Tools Objectives Understand how to identify needs for computer forensics tools Evaluate the requirements
Computing forensics: a live analysis
April 18th, 2005 1 2 3 Objectives Evidence acquisition Recovery and examination of suspect digital evidence (think Warrick Brown on CSI) Hardware: servers, workstations, laptops, PDAs, mobiles, cameras
Design and Implementation of a Live-analysis Digital Forensic System
Design and Implementation of a Live-analysis Digital Forensic System Pei-Hua Yen Graduate Institute of Information and Computer Education, National Kaohsiung Normal University, Taiwan amber8520@gmail.com
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
Linux in Law Enforcement
Linux in Law Enforcement It's all about CONTROL Barry J. Grundy CALUG MEETING JUNE 2008 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd
Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Explanation Section Disk Imaging Definition Disk images are used to transfer a hard drive s contents for various reasons. A disk image can
GNU/LINUX Forensic Case Study (ubuntu 10.04)
GNU/LINUX Forensic Case Study (ubuntu 10.04) Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License wim.bertels@khleuven.be FCCU Federal Computer Crime Unit of Belgium Assistance house
Kevin Cardwell. Toolkits: All-in-One Approach to Security
Kevin Cardwell Kevin Cardwell spent 22 years in the U.S. Navy, starting off in Sound Navigation and Ranging (SONAR). He began programming in 1987. He was fortunate enough to get on the Testing Team and
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics
Digital Forensics Lecture 3 Hard Disk Drive (HDD) Media Forensics Current, Relevant Topics defendants should not use disk-cleaning utilities to wipe portions of their hard drives before turning them over
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
Chapter 8: Installing Linux The Complete Guide To Linux System Administration Modified by M. L. Malone, 11/05
Chapter 8: Installing Linux The Complete Guide To Linux System Administration Modified by M. L. Malone, 11/05 At the end of this chapter the successful student will be able to Describe the main hardware
Freeware Live Forensics tools evaluation and operation tips
Freeware Live Forensics tools evaluation and operation tips Ricci IEONG, Principal Consultant, ewalker Consulting Ltd Abstract Highlighted by a digital forensics investigation specialists from FBI in DFRWS
Israel Aladejebi Computer Forensics Century College Information Technology Department
Israel Aladejebi Computer Forensics Century College Information Technology Department Being able to break security doesn t make you a hacker anymore than being able to hotwire cars makes you an automotive
Useful Computer Forensics Tools Updated: Jun 10, 2003
Useful Computer Forensics Tools Updated: Jun 10, 2003 ProDiscover http://www.techpathways.com Platforms: (Windows NT/2000) ProDiscover is a disk forensics tool with the capabilities of many utilities into
Microsoft Diagnostics and Recovery Toolset 7 Evaluation Guide
Microsoft Diagnostics and Recovery Toolset 7 Evaluation Guide White Paper Descriptor This document provides administrators with information and steps-by-step technique for deploying Microsoft Diagnostics
Chapter 14 Analyzing Network Traffic. Ed Crowley
Chapter 14 Analyzing Network Traffic Ed Crowley 10 Topics Finding Network Based Evidence Network Analysis Tools Ethereal Reassembling Sessions Using Wireshark Network Monitoring Intro Once full content
StorageCraft Technology Corporation Leading the Way to Safer Computing 2004-2009 StorageCraft Technology Corporation. All Rights Reserved.
PRODUCT SCENARIOS Introduction Fast and reliable online backup and bare metal recovery for Windows servers ShadowProtect Server Edition creates an exact point-in-time backup of your entire server or specific
H ARDWARE C ONSIDERATIONS
H ARDWARE C ONSIDERATIONS for Sidewinder 5 firewall software Dell Precision 530 This document provides information on specific system hardware required for running Sidewinder firewall software on a Dell
http://www.airdefense.net/education/index.shtm b. Cerberus Internet Scanner (WinNT/Win2K scanner) http://www.cerberus-infosec.co.uk/cis.
Auditing, Intrusion Detection, Forensics, and Logging 1. Auditing (Code, Host, Network & Password Audit Tools) Utilities for checking and verifying security measures a. AirDefense (Wireless scanner and
Open Source Security Tool Overview
Open Source Security Tool Overview Presented by Kitch Spicer & Douglas Couch Security Engineers for ITaP 1 Introduction Vulnerability Testing Network Security Passive Network Detection Firewalls Anti-virus/Anti-malware
ANTI-HACKER TOOL KIT. ourth Edition
ANTI-HACKER TOOL KIT i ' Mm. i m Fm ourth Edition m CONTENTS Acknowledgments Introduction xvii xix The Best of the Basics 1 Managing Source Code and Working with Programming Languages 3 SCM Concepts 4
"Cheap Security Audits with Linux LiveCDs"
"Cheap Security Audits with Linux LiveCDs" Presented by Beth Lynn Eicher bethlynn@cs.cmu.edu For Notacon.Org 4/9/2006 Released under Creative Commons Attribution-NonCommercial-ShareAlike 2.5 écouter moi
User Manual. Copyright Rogev LTD
User Manual Copyright Rogev LTD Introduction Thank you for choosing FIXER1. This User's Guide is provided to you to familiar yourself with the program. You can find a complete list of all the program's
PORTABLE OPERATING SYSTEMS AND INFORMAITON SECURITY RISKS
Portable Operating Systems and Information Security Risks 1 PORTABLE OPERATING SYSTEMS AND INFORMAITON SECURITY RISKS Portable Operating Systems and Information Security Risks Thomas S. Hyslip East Carolina
Digital forensic techniques for static analysis of NTFS images
Digital forensic techniques for static analysis of NTFS images Mamoun Alazab Internet Commerce Security Laboratory University of Ballarat, Australia m.alazab@ballarat.edu.au Sitalakshmi Venkatraman Internet
Dell NetVault Bare Metal Recovery 10.5. User s Guide
Dell NetVault Bare Metal Recovery 10.5 User s Guide Copyright 2015 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the
Unix/Linux Forensics 1
Unix/Linux Forensics 1 Simple Linux Commands date display the date ls list the files in the current directory more display files one screen at a time cat display the contents of a file wc displays lines,
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
Installing a Second Operating System
Installing a Second Operating System Click a link below to view one of the following sections: Overview Key Terms and Information Operating Systems and File Systems Managing Multiple Operating Systems
Robotics Core School 1
Robotics Core School 1 Robotics Core School 2 Cyber Forensics & Crime Investigation This workshop is dedicated on Cyber Forensics & Crime Investigation. Computer Forensics is a detailed and scientific
Open Source Security Tools
Open Source Security Tools Practical Applications for Security Tony Howlett Prentice Hall Professional Technical Reference PRENTICE Upper Saddle River, NJ 07458 www.phptr.com Preface xi Audience xii Contents
Linux System Administration
System Backup Strategies Objective At the conclusion of this module, the student will be able to: describe the necessity for creating a backup regimen describe the advantages and disadvantages of the most
UNIX Computer Forensics
Honeynet2_book.fm Page 347 Thursday, April 29, 2004 11:09 AM 12 UNIX Computer Forensics Brian Carrier In the last chapter, we discussed the basics of computer forensics. In this chapter, we discuss the
Chapter Contents. Operating System Activities. Operating System Basics. Operating System Activities. Operating System Activities 25/03/2014
Chapter Contents Operating Systems and File Management Section A: Operating System Basics Section B: Today s Operating Systems Section C: File Basics Section D: File Management Section E: Backup Security
CIT 480: Securing Computer Systems. Incident Response and Honeypots
CIT 480: Securing Computer Systems Incident Response and Honeypots Incident Response What is an Incident? Phases of Incident Response 1. Preparation 2. Identification 3. Containment 4. Damage Assessment
Open Source Data Recovery
Open Source Data Recovery Options and Techniques CALUG MEETING October 2008 !! Disclaimer!! This presentation is not sponsored by any organization of the US Government I am here representing only myself
Installing the Operating System or Hypervisor
Installing the Operating System or Hypervisor If you purchased E-Series Server Option 1 (E-Series Server without preinstalled operating system or hypervisor), you must install an operating system or hypervisor.
Additional information >>> HERE Network Forensics an emerging approach to an network analysis.
Network Forensics an emerging approach to an network analysis. 1 Abhishek Srivastav M.S. in Cyber Law & Information Technology Indian Institute of Information Technology, Allahabad, India Abhiit02@gmail.com
Acronis True Image 9.1 Pro/Light for Windows
Installation Guide Acronis True Image 9.1 Pro/Light for Windows Learn more at www.swsoft.com. Revised: November 2006 Published: November 2006 Table of Contents INTRODUCTION... 3 INSTALLATION ON PLESK SERVER...
Digital Forensics. Tom Pigg Executive Director Tennessee CSEC
Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze
EaseUS Partition Master
Reviewer s Guide Contents Introduction... 2 Chapter 1... 3 What is EaseUS Partition Master?... 3 Versions Comparison... 4 Chapter 2... 5 Using EaseUS Partition Master... 5 Partition Manager... 5 Disk &
It should be noted that the installer will delete any existing partitions on your disk in order to install the software required to use BLËSK.
Installation Guide Introduction... 3 1. Booting from the CD... 4 2. Choose the server type to install... 5 3. Disk formatting and installation... 6 4. Confirmation of disk formatting... 7 5. Program installation...
Open Source Security Tools for Information Technology Professionals
Open Source Security Tools for Information Technology Professionals CUNY SPS Course Syllabus Aron Trauring May 23, 2005 (rev October 21, 2005) Course Description Information security is a top priority
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers
Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers Brian Carrier Research Scientist @stake Abstract This paper uses the theory of abstraction layers to describe the purpose
AC 2009-2275: RUNNING LINUX IN A WINDOWS COMPUTER LAB
AC 2009-2275: RUNNING LINUX IN A WINDOWS COMPUTER LAB Ed Crowley, University of Houston American Society for Engineering Education, 2009 Page 14.1039.1 Running Linux in a Windows Computer Lab Abstract
Land Information New Zealand (LINZ) SALT Database. Migration from original hardware to virtualised hardware: Process Documentation
Land Information New Zealand (LINZ) SALT Database Migration from original hardware to virtualised hardware: Process Documentation Contents Migration from original hardware to virtualised hardware: Process
Computer Forensics introduction part A
Computer Forensics introduction part A Dr. Magdalena Szeżyńska, CISA Institute of Electronic Systems WUT m.szezynska@elka.pw.edu.pl Summer 2016 Digital Forensic Investigation Concepts A digital investigation
Backup & Disaster Recovery Appliance User Guide
Built on the Intel Hybrid Cloud Platform Backup & Disaster Recovery Appliance User Guide Order Number: G68664-001 Rev 1.0 June 22, 2012 Contents Registering the BDR Appliance... 4 Step 1: Register the
Forensics Book 2: Investigating Hard Disk and File and Operating Systems. Chapter 5: Windows Forensics II
Forensics Book 2: Investigating Hard Disk and File and Operating Systems Chapter 5: Windows Forensics II Objectives Understand event logs Understand other audit events Understand forensic analysis of event
information security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
Security Event Management. February 7, 2007 (Revision 5)
Security Event Management February 7, 2007 (Revision 5) Table of Contents TABLE OF CONTENTS... 2 INTRODUCTION... 3 CRITICAL EVENT DETECTION... 3 LOG ANALYSIS, REPORTING AND STORAGE... 7 LOWER TOTAL COST
HP One-Button Disaster Recovery (OBDR) Solution for ProLiant Servers
Reference guide HP One-Button Disaster Recovery (OBDR) Solution for ProLiant Servers Reference guide Contents One button disaster recovery (OBDR) 2 Requirements 2 HP tape drive and server support 2 Creating
Computer Forensics Basics, First Responder, Collection of Evidence
May 7, 2008 1 Computer Forensics Basics, First Responder, Collection of Evidence Omveer Singh Joint Director / Scientist D omveer@cert-in.org.in Indian Computer Emergency Response Team (CERT-In) Department
1 MAXDATA Modular System Firmware Update
1 MAXDATA Modular System Firmware Update This document will help you to update the firmware from a MAXDATA Modular System. Modular Systems which was purchased before 1 st April 2009 with Microsoft Windows
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
Pros and Cons of using Linux and Windows Live CDs in Incident Handling and Forensics
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Pros
Acronis True Image 2015 REVIEWERS GUIDE
Acronis True Image 2015 REVIEWERS GUIDE Table of Contents INTRODUCTION... 3 What is Acronis True Image 2015?... 3 System Requirements... 4 INSTALLATION... 5 Downloading and Installing Acronis True Image
Created By: 2009 Windows Server Security Best Practices Committee. Revised By: 2014 Windows Server Security Best Practices Committee
Windows Server Security Best Practices Initial Document Created By: 2009 Windows Server Security Best Practices Committee Document Creation Date: August 21, 2009 Revision Revised By: 2014 Windows Server
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
PARALLELS SERVER 4 BARE METAL README
PARALLELS SERVER 4 BARE METAL README This document provides the first-priority information on Parallels Server 4 Bare Metal and supplements the included documentation. TABLE OF CONTENTS 1 About Parallels
USB 2.0 Flash Drive User Manual
USB 2.0 Flash Drive User Manual 1 INDEX Table of Contents Page 1. IMPORTANT NOTICES...3 2. PRODUCT INTRODUCTION...4 3. PRODUCT FEATURES...5 4. DRIVER INSTALLATION GUIDE...6 4.1 WINDOWS 98 / 98 SE... 6
Introduction to The Sleuth Kit (TSK) By Chris Marko. Rev1 September, 2005. Introduction to The Sleuth Kit (TSK) 1
Introduction to The Sleuth Kit (TSK) By Chris Marko Rev1 September, 2005 Introduction to The Sleuth Kit (TSK) 1 This paper provides an introduction to The Sleuth Kit (referred to as TSK herein), from Brian
EFFECTIVE DIGITAL FORENSIC ANALYSIS OF THE NTFS DISK IMAGE
EFFECTIVE DIGITAL FORENSIC ANALYSIS OF THE NTFS DISK IMAGE Mamoun Alazab, Sitalakshmi Venkatraman, Paul Watters University of Ballarat, Australia {m.alazab, s.venkatraman, p.watters} @ballarat.edu.au ABSTRACT
Tiburon Master Support Agreement Exhibit 6 Back Up Schedule & Procedures. General Notes on Backups
General Notes on Backups This document describes the procedures to backup the minimum set of files required to recover application and/or data files in the event of a hardware failure or data loss. These
COWLEY COLLEGE & Area Vocational Technical School
COWLEY COLLEGE & Area Vocational Technical School COURSE PROCEDURE FOR Student Level: This course is open to students on the college level in either the freshman or sophomore year. Prerequisites: Basic
Security Incident Investigation
Security Incident Investigation Mingchao Ma STFC RAL, UK HEPSYSMAN Workshop 10 th June 2010 Overview Security incident handling lifecycle Based on NIST SP800-61rev1 recommendation http://csrc.nist.gov/publications/nistpubs/800-61-rev1/sp800-61rev1.pdf
Survey of Filesystems for Embedded Linux. Presented by Gene Sally CELF
Survey of Filesystems for Embedded Linux Presented by Gene Sally CELF Presentation Filesystems In Summary What is a filesystem Kernel and User space filesystems Picking a root filesystem Filesystem Round-up
OS Installation Guide Red Hat Linux 9.0
OS Installation Guide Red Hat Linux 9.0 C o n t e n t s Contents 3 About This Guide 5 1 Planning Your Installation 7 Requirements 7 2 Installing Red Hat 9.0 Error! Bookmark not defined. What s Next? 19
Automated Penetration Testing with the Metasploit Framework. NEO Information Security Forum March 19, 2008
Automated Penetration Testing with the Metasploit Framework NEO Information Security Forum March 19, 2008 Topics What makes a good penetration testing framework? Frameworks available What is the Metasploit
Computer Forensic Specialist. Course Title: Computer Forensic Specialist: Storage Device & Operating Systems
Course Title: Computer Forensic Specialist: Storage Device & Operating Systems Page 1 of 14 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify,
Intelligent disaster recovery. Dell DL backup to Disk Appliance powered by Symantec
Intelligent disaster recovery Dell DL backup to Disk Appliance powered by Symantec The PowerVault DL Backup to Disk Appliance Powered by Symantec Backup Exec offers the industry s only fully integrated
Managing Remote Access
VMWARE TECHNICAL NOTE VMware ACE Managing Remote Access This technical note explains how to use VMware ACE to manage remote access through VPN to a corporate network. This document contains the following
Release Notes: NovaBACKUP 17.3
What s new in NovaBACKUP 17.3? Release Notes: NovaBACKUP 17.3 NovaBACKUP 17.3.1203 (December, 2015) Backup for the Rest of Us New Features NovaBACKUP o Support of VMware 6.0 o Enhanced "Last Run" column
Some Tools for Computer Security Incident Response Team (CSIRT)
Some Tools for Computer Security Incident Response Team (CSIRT) AfNOG 12 30 th May 2011 10 th June 2011 Tanzania By Marcus K. G. Adomey Overview Some Unix Commands Some Selected Tools Snort AirSnort hping
Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.
Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.3 Reverse Engineering 1.4 Vulnerability Reporting 1.5 What
Capturing a Forensic Image. By Justin C. Klein Keane <jukeane@sas.upenn.edu> 12 February, 2013
Capturing a Forensic Image By Justin C. Klein Keane 12 February, 2013 Before you Begin The first step in capturing a forensic image is making an initial determination as to the
Digital Forensic Tool for Decision Making in Computer Security Domain
Digital Forensic Tool for Decision Making in Computer Security Domain S. K. Khode 1,V. N. Pahune 2 and M. R. Sayankar 3 1, 2, 3 Computer Engineering Department of Bapurao Deshmukh College of Engineering,
IBM Rapid Restore PC powered by Xpoint - v2.02 (build 6015a)
IBM Rapid Restore PC powered by Xpoint - v2.02 (build 6015a) User s Reference Guide Internal IBM Use Only This document only applies to the software version listed above and information provided may not
Symantec NetBackup Getting Started Guide. Release 7.1
Symantec NetBackup Getting Started Guide Release 7.1 21159722 Contents NetBackup Getting Started Guide... 5 About NetBackup... 5 How a NetBackup system works... 6 How to make a NetBackup system work for
Computer Forensics using Open Source Tools
Computer Forensics using Open Source Tools COMP 5350/6350 Digital Forensics Professor: Dr. Anthony Skjellum TA: Ananya Ravipati Presenter: Rodrigo Sardinas Overview Use case explanation Useful Linux Commands
BrightStor ARCserve Backup for Linux
BrightStor ARCserve Backup for Linux Disaster Recovery Option Guide r11.5 D01217-2E This documentation and related computer software program (hereinafter referred to as the "Documentation") is for the
ALTIRIS Deployment Solution 6.8 Preboot Automation Environment
ALTIRIS Deployment Solution 6.8 Preboot Automation Environment The information contained in the Altiris knowledgebase is subject to the Terms of Use as outlined at http://www.altiris.com/legal/termsofuse.asp.
Quick Start Guide. Version R91. English
Using StorageCraft Recovery Environment Quick Start Guide Version R91 English May 20, 2015 Agreement The purchase and use of all Software and Services is subject to the Agreement as defined in Kaseya s
Recovering Data from Windows Systems by Using Linux
Recovering Data from Windows Systems by Using Linux Published by the Open Source Software at Microsoft, May 27 Special thanks to Chris Travers, Contributing Author to the Open Source Software Lab Most
Migrating to ESXi: How To
ILTA Webinar Session Migrating to ESXi: How To Strategies, Procedures & Precautions Server Operations and Security Technology Speaker: Christopher Janoch December 29, 2010 Migrating to ESXi: How To Strategies,
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
Acronis True Image 9.1 Pro/Light for Linux
Installation Guide Acronis True Image 9.1 Pro/Light for Linux Learn more at www.swsoft.com. Revised: November 2006 Published: November 2006 Table of Contents INTRODUCTION... 3 INSTALLATION... 4 SOFTWARE
An Introduction to Incident Detection and Response Memory Forensic Analysis
An Introduction to Incident Detection and Response Memory Forensic Analysis Alexandre Dulaunoy - TLP:WHITE a@foo.be February 6, 2015 An overview to incident response Detection Analysis Containment Investigation
HP VMware ESXi 5.0 and Updates Getting Started Guide
HP VMware ESXi 5.0 and Updates Getting Started Guide Abstract This guide is intended to provide setup information for HP VMware ESXi. HP Part Number: 616896-002 Published: August 2011 Edition: 1 Copyright