UNIX AND LINUX FORENSIC ANALYSIS DVD TOOLKIT

By PATRICIA HARRIS

CHAPTER 1 INTRODUCTION HISTORY TARGET AUDIENCE WHAT IS COVERED WHAT IS NOT COVERED CHAPTER 2 UNDERSTANDING UNIX INTRODUCTION UNIX, UNIX, LINUX, AND *NIX LINUX DISTRIBUTIONS GET A LINUX! BOOTING UBUNTU LINUX FROM THE LIVECD THE SHELL ALL HAIL THE SHELL ESSENTIAL COMMANDS HIGHLIGHTS OF THE LINUX SECURITY MODEL THE *NIX FILE SYSTEM STRUCTURE MOUNT POINTS: WHAT THE HECK ARE THEY? FILE SYSTEMS EXT2/EXT3 SUMMARY CHAPTER 3 LIVE RESPONSE: DATA COLLECTION PREPARE THE TARGET MEDIA MOUNT THE DRIVE FORMAT THE DRIVE FORMAT THE DISK WITH THE EXT FILE SYSTEM GATHER VOLATILE INFORMATION PREPARE A CASE LOGBOOK ACQUIRING THE IMAGE PREPARATION AND PLANNING BOOTABLE *NIX ISOS HELIX KNOPPIX CONTENTS BACKTRACK 2 INSERT ENCASE LINEN FTK IMAGER PRODISCOVER CHAPTER 4 INITIAL TRIAGE AND LIVE RESPONSE: DATA ANALYSIS INITIAL TRIAGE LOG ANALYSIS ZGREP TAIL MORE LESS KEYWORD SEARCHES STRINGS /PROC/KCORE –T D > /TMP/KCORE_OUTFILE FILE AND DIRECTORY NAMES IP ADDRESSES AND DOMAIN NAMES TOOL KEYWORDS TRICKS OF THE TRADE USER ACTIVITY SHELL HISTORY LOGGED ON USERS NETWORK CONNECTIONS RUNNING PROCESSES OPEN FILE HANDLERS CHAPTER 5 THE HACKING TOP 10 THE HACKING TOP TEN NETCAT RECONNAISSANCE TOOLS NMAP NESSUS TRY IT OUT CONFIGURING NESSUS PLUG-INS PORTS TARGET NIKTO WIRESHARK CANVAS/CORE IMPACT THE METASPLOIT FRAMEWORK PAROS HPING2 - ACTIVE NETWORK SMASHING TOOL ETTERCAP CHAPTER 6 THE /PROC FILE SYSTEM CMDLINE CPUINFO DISKSTATS DRIVER/RTC FILESYSTEMS KALLSYMS (KSYMS) KCORE MODULES MOUNTS PARTITIONS SYS/ UPTIME VERSION PROCESS IDS CWD ENVIRON EXE LOGINUID PUTTING IT ALL TOGETHER SYSFS BLOCK CHAPTER 7 FILE ANALYSIS THE LINUX BOOT PROCESS INIT AND RUNLEVELS SYSTEM AND SECURITY CONFIGURATION FILES USERS, GROUPS, AND PRIVILEGES CRON JOBS LOG FILES WHO WHERE AND WHAT IDENTIFYING OTHER FILES OF INTEREST SUID AND SGID ROOT FILES RECENTLY MODIFIED/ACCESSED/CREATED FILES MODIFIED SYSTEM FILES OUT-OF-PLACE INODES HIDDEN FILES AND HIDING PLACES CHAPTER 8 MALWARE VIRUSES STORMS ON THE HORIZON DO IT YOURSELF WITH PANDA AND CLAM DOWNLOAD CLAMAV INSTALL CLAMAV UPDATING VIRUS DATABASE WITH FRESHCLAM SCANNING THE TARGET DIRECTORY DOWNLOAD PANDA ANTIVIRUS INSTALL PANDA ANTIVIRUS WEB REFERENCES