Practical Linux Forensics: A Guide for Digital Investigators
- ISBN-10
- 171850196X
- ISBN-13
- 9781718501966
- Category
- Computers
- Pages
- 400
- Language
- English
- Published
- 2021-12-21
- Publisher
- No Starch Press
- Author
- Bruce Nikkel
Description
A resource to help forensic investigators locate, analyze, and understand digital evidence found on modern Linux systems after a crime, security incident or cyber attack. Practical Linux Forensics dives into the technical details of analyzing postmortem forensic images of Linux systems which have been misused, abused, or the target of malicious attacks. It helps forensic investigators locate and analyze digital evidence found on Linux desktops, servers, and IoT devices. Throughout the book, you learn how to identify digital artifacts which may be of interest to an investigation, draw logical conclusions, and reconstruct past activity from incidents. You’ll learn how Linux works from a digital forensics and investigation perspective, and how to interpret evidence from Linux environments. The techniques shown are intended to be independent of the forensic analysis platforms and tools used. Learn how to: • Extract evidence from storage devices and analyze partition tables, volume managers, popular Linux filesystems (Ext4, Btrfs, and Xfs), and encryption • Investigate evidence from Linux logs, including traditional syslog, the systemd journal, kernel and audit logs, and logs from daemons and applications • Reconstruct the Linux startup process, from boot loaders (UEFI and Grub) and kernel initialization, to systemd unit files and targets leading up to a graphical login • Perform analysis of power, temperature, and the physical environment of a Linux machine, and find evidence of sleep, hibernation, shutdowns, reboots, and crashes • Examine installed software, including distro installers, package formats, and package management systems from Debian, Fedora, SUSE, Arch, and other distros • Perform analysis of time and Locale settings, internationalization including language and keyboard settings, and geolocation on a Linux system • Reconstruct user login sessions (shell, X11 and Wayland), desktops (Gnome, KDE, and others) and analyze keyrings, wallets, trash cans, clipboards, thumbnails, recent files and other desktop artifacts • Analyze network configuration, including interfaces, addresses, network managers, DNS, wireless artifacts (Wi-Fi, Bluetooth, WWAN), VPNs (including WireGuard), firewalls, and proxy settings • Identify traces of attached peripheral devices (PCI, USB, Thunderbolt, Bluetooth) including external storage, cameras, and mobiles, and reconstruct printing and scanning activity
Get the book
Other editions
-
- 2021-10-12
- 400 pages
- Ebook
- No Starch Press
Similar books
-
Practical Forensic Imaging: Securing Digital Evidence with Linux Tools
By Bruce NikkelThis is a must-have reference for every digital forensics lab.
-
Practical Memory Forensics: Jumpstart effective forensic analysis of volatile memory
By Oleg Skulkin, Svetlana OstrovskayaThis book takes a practical approach and uses memory images from real incidents to help you gain a better understanding of the subject and develop the skills required to investigate and respond to malware-related incidents and complex ...
-
Practical Cyber Forensics: An Incident-Based Approach to Forensic Investigations
By Niranjan ReddyWhat You Will LearnCarry out forensic investigation on Windows, Linux, and macOS systems Detect and counter anti-forensic techniques Deploy network, cloud, and mobile forensics Investigate web and malware attacks Write efficient ...
-
File System Forensic Analysis
By Brian CarrierWhether you're a digital forensics specialist, incident response team member, law enforcement officer, corporate security specialist, or auditor, this book will become an indispensable resource for forensic investigations, no matter what ...
-
Digital Forensics with Kali Linux: Perform data acquisition, digital investigation, and threat analysis using Kali Linux tools
By Shiva V. N. ParasramLearn the skills you need to take advantage of Kali Linux for digital forensics investigations using this comprehensive guide About This Book Master powerful Kali Linux tools for digital investigation and analysis Perform evidence ...
-
The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory
By Andrew Case, Michael Hale Ligh, Jamie Levy... [000000002f700000 - 000000002f713000] Loader Data [WRITTEN] [000000002f713000 - 000000002f800000] Conventional [WRITTEN] [000000002f800000 - 000000002fd3e000] Loader Data [WRITTEN] [000000002fd3e000 - 000000002fe00000] Conventional ...
-
Practical Windows Forensics
By Ayman Shaaban, Konstantin SapronovLeverage the power of digital forensics for Windows systems About This Book Build your own lab environment to analyze forensic data and practice techniques.
-
Linux Forensics
By Philip Polstra"Linux Forensics contains extensive coverage of Linux ext2, ext3, and ext4 filesystems. A large collection of Python and shell scripts for creating, mounting, and analyzing filesystem images are presented in this book.
-
Digital Forensics Basics: A Practical Guide Using Windows OS
By Nihad A. HassanThis book provides you with the necessary skills to identify an intruder's footprints and to gather the necessary digital evidence in a forensically sound manner to prosecute in a court of law.
-
Digital Forensics with Open Source Tools
By Harlan Carvey, Cory AltheideThis book will appeal to forensic practitioners from areas including incident response teams and computer forensic investigators; forensic technicians from legal, audit, and consulting firms; and law enforcement agencies.