Mastering Windows Network Forensics and Investigation

An authoritative guide to investigating high-technology
crimes

Internet crime is seemingly ever on the rise, making the need
for a comprehensive resource on how to investigate these crimes
even more dire. This professional-level book--aimed at law
enforcement personnel, prosecutors, and corporate
investigators--provides you with the training you need in order to
acquire the sophisticated skills and software solutions to stay one
step ahead of computer criminals.

• Specifies the techniques needed to investigate, analyze, and
  document a criminal act on a Windows computer or network

• Places a special emphasis on how to thoroughly investigate
  criminal activity and now just perform the initial response

• Walks you through ways to present technically complicated
  material in simple terms that will hold up in court

• Features content fully updated for Windows Server 2008 R2 and
  Windows 7

• Covers the emerging field of Windows Mobile forensics

Also included is a classroom support package to ensure academic
adoption, Mastering Windows Network Forensics and Investigation,
2nd Edition offers help for investigating high-technology
crimes.

Auteur
Steve Anson, CISSP, EnCE, is the cofounder of Forward Discovery. He has previously served as a police officer, FBI High Tech Crimes Task Force agent, Special Agent with the U.S. DoD, and an instructor with the U.S. State Department Antiterrorism Assistance Program (ATA). He has trained hundreds of law enforcement officers around the world in techniques of digital forensics and investigation. Steve Bunting, EnCE, CCFT, has over 35 years of experience in law enforcement, and his background in computer forensics is extensive. He has conducted computer forensic examinations for numerous local, state, and federal agencies on a variety of cases, as well as testified in court as a computer forensics expert. He has taught computer forensics courses for Guidance Software and is currently a Senior Forensic Consultant with Forward Discovery. Ryan Johnson, DFCP, CFCE, EnCE, SCERS, is a Senior Forensic Consultant with Forward Discovery. He was a digital forensics examiner for the Durham, NC, police and a Media Exploitation Analyst with the U.S. Army. He is an instructor and developer with the ATA. Scott Pearson has trained law enforcement entities, military personnel, and network/system administrators in more than 20 countries for the ATA. He is also a certifying Instructor on the Cellebrite UFED Logical and Physical Analyzer Mobile Device Forensics tool and has served as an instructor for the DoD Computer Investigations Training Academy.

Résumé
An authoritative guide to investigating high-technology crimes Internet crime is seemingly ever on the rise, making the need for a comprehensive resource on how to investigate these crimes even more dire. This professional-level book--aimed at law enforcement personnel, prosecutors, and corporate investigators--provides you with the training you need in order to acquire the sophisticated skills and software solutions to stay one step ahead of computer criminals.

• Specifies the techniques needed to investigate, analyze, and document a criminal act on a Windows computer or network
• Places a special emphasis on how to thoroughly investigate criminal activity and now just perform the initial response
• Walks you through ways to present technically complicated material in simple terms that will hold up in court
• Features content fully updated for Windows Server 2008 R2 and Windows 7
• Covers the emerging field of Windows Mobile forensics
  Also included is a classroom support package to ensure academic adoption, Mastering Windows Network Forensics and Investigation, 2nd Edition offers help for investigating high-technology crimes.

Contenu

Introduction xvii

Part 1 Understanding and Exploiting Windows Networks 1

Chapter 1 Network Investigation Overview 3

Performing the Initial Vetting 3

Meeting with the Victim Organization 5

Understanding the Victim Network Information 6

Understanding the Incident 8

Identifying and Preserving Evidence 9

Establishing Expectations and Responsibilities 11

Collecting the Evidence 12

Analyzing the Evidence 15

Analyzing the Suspect's Computers 18

Recognizing the Investigative Challenges of Microsoft Networks 21

The Bottom Line 22

Chapter 2 The Microsoft Network Structure 25

Connecting Computers 25

Windows Domains 27

Interconnecting Domains 29

Organizational Units 34

Users and Groups 35

Types of Accounts 36

Groups 40

Permissions 44

File Permissions 45

Share Permissions 48

Reconciling Share and File Permissions 50

Example Hack 52

The Bottom Line 61

Chapter 3 Beyond the Windows GUI 63

Understanding Programs, Processes, and Threads 64

Redirecting Process Flow 67

DLL Injection 70

Hooking 74

Maintaining Order Using Privilege Modes 78

Using Rootkits 80

The Bottom Line 83

Chapter 4: Windows Password Issues 85

Understanding Windows Password Storage 85

Cracking Windows Passwords Stored on Running Systems 88

Exploring Windows Authentication Mechanisms 98

LanMan Authentication 99

NTLM Authentication 103

Kerberos Authentication 108

Sniffing and Cracking Windows Authentication Exchanges 111

Using ScoopLM and BeatLM to Crack Passwords 114

Cracking Offline Passwords 121

Using Cain & Abel to Extract Windows Password Hashes 122

Accessing Passwords through the Windows Password Verifier 126

Extracting Password Hashes from RAM 127

Stealing Credentials from a Running System 128

The Bottom Line 134

Chapter 5 Windows Ports and Services 137

Understanding Ports 137

Using Ports as Evidence 142

Understanding Windows Services 149

The Bottom Line 155

Part 2 Analyzing the Computer 157

Chapter 6 Live-Analysis Techniques 159

Finding Evidence in Memory 159

Creating a Windows Live-Analysis Toolkit 161

Using DumpIt to Acquire RAM from a 64-Bit Windows 7 System 164

Using WinEn to Acquire RAM from a Windows 7 Environment 166

Using FTK Imager Lite to Acquire RAM from Windows Server 2008 167

Using Volatility 2.0 to Analyze a Windows 7 32-Bit RAM Image 169

Monitoring Communication with the Victim Box 173

Scanning the Victim System 176

The Bottom Line 178

Chapter 7 Windows Filesystems 179

Filesystems vs. Operating Systems 179

Understanding FAT Filesystems 183

Understanding NTFS Filesystems 198

Using NTFS Data Structures 198

Creating, Deleting, and Recovering Data in NTFS 205

Dealing with Alternate Data Streams 208

The exFAT Filesystem 212

The Bottom Line 213

Chapter 8 The Registry Structure 215

Understanding Registry Concepts 215

Registry History 217

Registry Organization and Terminology 217

Performing Registry Research 228

Viewing the Registry with Forensic Tools 232

Using EnCase to View the Registry 234

Examining Information Manually 234

Using EnScripts to Extract Information 236

Using AccessData's Registry Viewer 246

Other Tools 251

The Bottom Line 254

Chapter 9 Registry Evidence 257 ...