You can't succeed in the field of computer forensics without hands-on practice--and you can't get hands-on practice without real forensic data. The solution: Real Digital Forensics. In this book, a team of world-class computer forensics experts walk you through five detailed, highly realistic investigations and provide a DVD-ROM with all the data you need to follow along and practice.
From binary memory dumps to log files, this DVD-ROM's intrusion data was generated by attacking live systems using the same tools and methods real-world attackers use. It was then captured and analyzed using the same tools the authors employ in their own investigations. This book relies heavily on open source tools, so you can perform virtually every task without investing in any commercial software.
You'll investigate environments ranging from financial institutions to software companies and crimes ranging from intellectual property theft to SEC violations. As you move step by step through each investigation, you'll discover practical techniques for overcoming the challenges forensics professionals face most often. Coverage includes
- Responding to live incidents in both Windows and Unix
environments
- Determining whether an attack has actually occurred
- Assembling a toolkit you can take to the scene of a
computer-related crime
- Analyzing volatile data, nonvolatile data, and files of
unknown origin
- Safely performing and documenting forensic duplications
- Collecting and analyzing network-based evidence in
Windows and Unix environments
- Reconstructing Web browsing, e-mail activity, and
Windows registry changes
- Tracing domain name ownership and the source of e-mails
- Duplicating and analyzing the contents of PDAs and flash
memory devices
Part I Live Incident Response
Part II Network-Based Forenscis
Part III Acquiring a forensic Duplication
Part IV Forensic Analysis Techniques
Part V Creating a Complete Forensic Tool Kit
Part VI Mobile Device Forensics
Part Online-Based Forensics