Steve Anson, Steve Bunting, Ryan Johnson
CHF39.00
Download steht sofort bereit
Kein Rückgaberecht
An authoritative guide to investigating high-technology
crimes
Internet crime is seemingly ever on the rise, making the need
for a comprehensive resource on how to investigate these crimes
even more dire. This professional-level book--aimed at law
enforcement personnel, prosecutors, and corporate
investigators--provides you with the training you need in order to
acquire the sophisticated skills and software solutions to stay one
step ahead of computer criminals.
Specifies the techniques needed to investigate, analyze, and
document a criminal act on a Windows computer or network
Places a special emphasis on how to thoroughly investigate
criminal activity and now just perform the initial response
Walks you through ways to present technically complicated
material in simple terms that will hold up in court
Features content fully updated for Windows Server 2008 R2 and
Windows 7
Covers the emerging field of Windows Mobile forensics
Also included is a classroom support package to ensure academic
adoption, Mastering Windows Network Forensics and Investigation,
2nd Edition offers help for investigating high-technology
crimes.
Autorentext
Steve Anson, CISSP, EnCE, is the cofounder of Forward Discovery. He has previously served as a police officer, FBI High Tech Crimes Task Force agent, Special Agent with the U.S. DoD, and an instructor with the U.S. State Department Antiterrorism Assistance Program (ATA). He has trained hundreds of law enforcement officers around the world in techniques of digital forensics and investigation. Steve Bunting, EnCE, CCFT, has over 35 years of experience in law enforcement, and his background in computer forensics is extensive. He has conducted computer forensic examinations for numerous local, state, and federal agencies on a variety of cases, as well as testified in court as a computer forensics expert. He has taught computer forensics courses for Guidance Software and is currently a Senior Forensic Consultant with Forward Discovery. Ryan Johnson, DFCP, CFCE, EnCE, SCERS, is a Senior Forensic Consultant with Forward Discovery. He was a digital forensics examiner for the Durham, NC, police and a Media Exploitation Analyst with the U.S. Army. He is an instructor and developer with the ATA. Scott Pearson has trained law enforcement entities, military personnel, and network/system administrators in more than 20 countries for the ATA. He is also a certifying Instructor on the Cellebrite UFED Logical and Physical Analyzer Mobile Device Forensics tool and has served as an instructor for the DoD Computer Investigations Training Academy.
Zusammenfassung
An authoritative guide to investigating high-technology crimes
Internet crime is seemingly ever on the rise, making the need for a comprehensive resource on how to investigate these crimes even more dire. This professional-level book--aimed at law enforcement personnel, prosecutors, and corporate investigators--provides you with the training you need in order to acquire the sophisticated skills and software solutions to stay one step ahead of computer criminals.
Covers the emerging field of Windows Mobile forensics
Also included is a classroom support package to ensure academic adoption, Mastering Windows Network Forensics and Investigation, 2nd Edition offers help for investigating high-technology crimes.
Inhalt
Introduction xvii
Part 1 Understanding and Exploiting Windows Networks 1
Chapter 1 Network Investigation Overview 3
Performing the Initial Vetting 3
Meeting with the Victim Organization 5
Understanding the Victim Network Information 6
Understanding the Incident 8
Identifying and Preserving Evidence 9
Establishing Expectations and Responsibilities 11
Collecting the Evidence 12
Analyzing the Evidence 15
Analyzing the Suspect's Computers 18
Recognizing the Investigative Challenges of Microsoft Networks 21
The Bottom Line 22
Chapter 2 The Microsoft Network Structure 25
Connecting Computers 25
Windows Domains 27
Interconnecting Domains 29
Organizational Units 34
Users and Groups 35
Types of Accounts 36
Groups 40
Permissions 44
File Permissions 45
Share Permissions 48
Reconciling Share and File Permissions 50
Example Hack 52
The Bottom Line 61
Chapter 3 Beyond the Windows GUI 63
Understanding Programs, Processes, and Threads 64
Redirecting Process Flow 67
DLL Injection 70
Hooking 74
Maintaining Order Using Privilege Modes 78
Using Rootkits 80
The Bottom Line 83
Chapter 4: Windows Password Issues 85
Understanding Windows Password Storage 85
Cracking Windows Passwords Stored on Running Systems 88
Exploring Windows Authentication Mechanisms 98
LanMan Authentication 99
NTLM Authentication 103
Kerberos Authentication 108
Sniffing and Cracking Windows Authentication Exchanges 111
Using ScoopLM and BeatLM to Crack Passwords 114
Cracking Offline Passwords 121
Using Cain & Abel to Extract Windows Password Hashes 122
Accessing Passwords through the Windows Password Verifier 126
Extracting Password Hashes from RAM 127
Stealing Credentials from a Running System 128
The Bottom Line 134
Chapter 5 Windows Ports and Services 137
Understanding Ports 137
Using Ports as Evidence 142
Understanding Windows Services 149
The Bottom Line 155
Part 2 Analyzing the Computer 157
Chapter 6 Live-Analysis Techniques 159
Finding Evidence in Memory 159
Creating a Windows Live-Analysis Toolkit 161
Using DumpIt to Acquire RAM from a 64-Bit Windows 7 System 164
Using WinEn to Acquire RAM from a Windows 7 Environment 166
Using FTK Imager Lite to Acquire RAM from Windows Server 2008 167
Using Volatility 2.0 to Analyze a Windows 7 32-Bit RAM Image 169
Monitoring Communication with the Victim Box 173
Scanning the Victim System 176
The Bottom Line 178
Chapter 7 Windows Filesystems 179
Filesystems vs. Operating Systems 179
Understanding FAT Filesystems 183
Understanding NTFS Filesystems 198
Using NTFS Data Structures 198
Creating, Deleting, and Recovering Data in NTFS 205
Dealing with Alternate Data Streams 208
The exFAT Filesystem 212
The Bottom Line 213
Chapter 8 The Registry Structure 215
Understanding Registry Concepts 215
Registry History 217
Registry Organization and Terminology 217
Performing Registry Research 228
Viewing the Registry with Forensic Tools 232
Using EnCase to View the Registry 234
Examining Information Manually 234
Using EnScripts to Extract Information 236
Using AccessData's Registry Viewer 246
Other Tools 251
The Bottom Line 254
Chapter 9 Registry Evidence 257 ...