Geekly Articles each Day
📜 ⬆️ ⬇️

Computer forensics (forsensik) - a review of the tools and training sites



Forensic (computer forensics, cybercrime investigation) - an applied science about the disclosure of crimes related to computer information, the study of digital evidence, methods of searching, obtaining and consolidating such evidence. In this article we will look at popular tools for conducting forensic analysis and collecting digital evidence.

Distributions


Let's start the review of utilities with a specialized distribution kit containing the majority of utilities, frameworks and tools for forensic analysis.

Digital Evidence & Forensics Toolkit: DEFT Linuix


This distribution is designed on the Lubuntu platform and is equipped with a user-friendly graphical interface. In addition, a set of specialized utilities has been added to the product, starting from antiviruses, information search systems in the browser's cache, network scanners and rootkit detection tools and ending with the tools needed when searching for data hidden on disk.
')
The main purpose is to carry out measures on forensics - to analyze the consequences of hacking computer systems, determining lost and compromised data, and also to collect so-called. digital evidence of cybercrime.

www.deftlinux.net

image

Frameworks


One of the most popular frameworks is the Volatility Framework , a framework for examining RAM images and extracting digital artifacts from volatile memory (RAM).
Recoverable data:


List of supported RAM images for the following operating systems:


To test the framework, I recommend using ready-made RAM images .

DFF (Digital Forensics Framework) - a framework for forensic analysis, interfaces are presented as a command line, and GUI. DFFs can be used to examine hard drives and volatile memory and report on user and system actions.

PowerForensics provides a single platform for real-time hard drive forensic analysis.

The Sleuth Kit (TSK) is a set of command line tools for digital forensics that allow you to examine hard disk and file system volume data.

MIG: Mozilla InvestiGator is a platform for conducting operational research on remote endpoints. Fremywork allows researchers to simultaneously obtain information from a large number of sources, thereby speeding up the investigation of incidents and ensuring the security of everyday operations.

bulk_extractor - allows you to extract information using special scanners (mail, credit card number, GPS coordinates, phone numbers, EXIF ​​data in images). The speed of work is achieved through the use of multithreading and work with the hard disk "directly."

PhotoRec is a multisystem platform for searching and extracting files from test images of operating systems, compact discs, memory cards, digital cameras, etc. The main purpose is to extract deleted (or lost) files.

Network communication analysis


SiLK (System for Internet-Level Knowledge) - designed for the effective collection, storage and analysis of network flow data. SiLK is ideally suited for analyzing traffic on a trunk or border of a large, distributed enterprise or medium-sized provider.

Wireshark - this network packet sniffer (or sniffer) can be effectively used to analyze traffic (including malware). One of the most popular tools. The functionality that Wireshark provides is very similar to the capabilities of the tcpdump program, however, Wireshark has a graphical user interface and much more options for sorting and filtering information. The program allows the user to view all the traffic passing through the network in real time, translating the network card into promiscuous mode.

Study material


In order to carry out certain actions on data analysis, it is necessary to have a basis of theoretical material on the investigation of cybercrime. For this, I recommend reading the following publications:


Practical sites


To test the above tools, you can use specialized platforms or images for analysis, presented on the visualized mindmap . As the first samples for training, I recommend:


Conclusion


Forensic, as an offshoot of information security, is much less developed than penetration testing or the organization of protective equipment. Competent approach in carrying out activities to collect digital evidence will not only restore the picture of a possible incident, but also allow you to identify ways and prerequisites for the occurrence of the incident.

Source: https://habr.com/ru/post/327740/

More articles:


All Articles