What is another name for a forensic drive controller?
write blocker
What tool in Linux can be used to create a forensic copy of a hard drive that will be used in an investigation?
- dd
- dd creates a bit-by-bit copy of the target drive that is well suited to forensic use, and special forensic versions of dd exist that can provide even more forensic features
What are the 4 functions of forensic disk controller?
- write blocking
- intercepts write commands sent to the device and prevents them from modifying data on the device
- returning data requested by a read operation
- returning access-significant information from the device
- reporting errors from the device back to the forensic host
What does forensics deal with?
investigation, preservation, analysis, and presentation of digital evidence that will be used in an investigation
What is the goal of forensics?
establish the authenticity and integrity of the evidence, enabling it to be admissible in court, and ultimately, to assist in solving cyber crimes, intellectual property theft, fraud, and other digital-related offences
What are the 4 types of forensics?
- Computer Forensics
- Network Forensics
- Memory Forensics
- Mobile Forensics
What are the different security roles that deal with forensics?
- Tier 1 SOC Analyst
- Tier 2/3 SOC Analyst
- Malware Analyst
- Digital Forensics Analyst
- Insider Threat Analyst
- Threat Hunter
- Incident Responder
What is the role of a Tier 1 SOC Analyst in terms of forensics?
- collect evidence that will be added to an investigation case
- the evidence is then used as justification for taking defensive measures, such as blocking an IP, domain, or email sender
- understand that these artefacts (IPs, emails, domains) are considered evidence for the investigation
What is the role of a Tier 2/3 SOC Analyst in terms of forensics?
- typically handle escalated/more critical investigations that require more technical expertise, or access to additional tools or sensors
- related evidence is likely to be collected and handled under more strict conditions
Is the process of malware analysis considered forensics?
yes
What is the purpose of the KAPE (Kroll Artifact Parser and Extractor) tool and what is it used for?
- automate the collection and parsing of forensic artefacts from a computer’s file system and memory
- can be deployed locally or on remote systems to quickly gather key dat
- can retrieve artefacts relating to browser usage, program execution, the filesystem, logs, and much more
What is the purpose of the FTK Imager tool and what is it used for?
- create hard drive images, but also memory images, which can be analyzed in other programs for analysis
- possible to import disk images into FTKi, allowing us to navigate through the file system as if we were on a live device
What is the purpose of the EnCase tool and what is it used for?
take forensic images of computers, mobile phones, and internet-of-things devices, which can then be analyzed to collect digital evidence
What is the purpose of the Cellebrite tool and what is it used for?
suite of tools designed primarily for mobile forensics, which allows easy acquisition of data from a mobile device so it can be processed in other tools
What are the forensic tools used for evidence collection?
- KAPE
- FTK Imager
- EnCase
- Cellebrite
What is the purpose of the Autopsy tool and what is it used for?
- helps investigators analyze and extract evidence from various data sources, such as hard drives and mobile devices
- works by creating a forensic image of the target storage media and then running in-depth searches to quickly retrieve key information, such as recently used programs, deleted files, emails, visited websites
What is the purpose of the Volatility tool and what is it used for?
- memory forensics framework that enables the analysis of memory dumps or memory images
- captures a snapshot of a computer’s memory, allowing users to search for valuable information
- aids in understanding the computer’s past activities and uncovering potential evidence of malicious actions
What are the forensic tools used for evidence analysis?
- Autopsy
- Volatility
What OSs’ are supported by Volatility?
Windows, Linux, and Mac OS
What are the two common ways of hiding data?
- using disk’s slack space
- using steganography
What basic information should be tracked to preserve the chain of custody?
- Received From
- Received By
- Date
- Time
What should be done with the original disk image when doing forensics?
- the disk needs to be hashed and then a full-bit copy should be taken, ensuring that absolutely everything is included in the copied image
- new file should then be hashed, and if it is an exact copy, the file hashes will be the same - analyst then work on the copy, so the original evidence is not modified, making it inadmissible in court
Who’s the guy who crearted many tools for Windows forensics?
Eric Zimmerman
What is the Redline tool?
- incident response tool developed and freely distributed by FireEye
- gather forensic data from a system and help with collected forensic information
-
Defense Tools8
-
Log Analysis9
-
Indicator of Compromise (IoC)6
-
Vulnerability Analysis and Nessus14
-
XDR, EDR, XSOAR, SIEM, UEBA41
-
OSINT29
-
Forensics25
-
Phishing Analysis17
-
Responding to Cyberattacks7
-
Cybersecurity Positions3
-
MITRE Frameworks5
-
Malware Analysis Theory45
-
Threat Intelligence15
-
Handling Ransomware3
-
Commercial Defense Products12
-
Malware Analysis Practical15
-
Incident Response57
