skip to content
Forensic discovery Preview this item
ClosePreview this item
Checking...

Forensic discovery

Author: Dan Farmer; Wietse Venema
Publisher: Boston : Addison-Wesley, 2005.
Series: Addison-Wesley professional computing series.
Edition/Format:   Print book : EnglishView all editions and formats
Summary:

Don't look now, but your fingerprints are all over the cover of this book. Simply picking it up off the shelf to read the cover has left a trail of evidence that you were here.

Rating:

(not yet rated) 0 with reviews - Be the first.

Subjects
More like this

Find a copy in the library

&AllPage.SpinnerRetrieving; Finding libraries that hold this item...

Details

Material Type: Internet resource
Document Type: Book, Internet Resource
All Authors / Contributors: Dan Farmer; Wietse Venema
ISBN: 020163497X 9780201634976 0321703251 9780321703255
OCLC Number: 253548068
Description: XIX, 217 Seiten : Diagramme.
Contents: Preface. About the Authors. I. BASIC CONCEPTS. 1. The Spirit of Forensic Discovery. Introduction. Unusual Activity Stands Out. The Order of Volatility (OOV). Layers and Illusions. The Trustworthiness of Information. The Fossilization of Deleted Information. Archaeology vs. Geology. 2. Time Machines. Introduction. The First Signs of Trouble. What's Up, MAC? An Introduction to MACtimes. Limitations of MACtimes. Argus: Shedding Additional Light on the Situation. Panning for Gold: Looking for Time in Unusual Places. DNS and Time. Journaling File Systems and MACtimes. The Foibles of Time. Conclusion. II. EXPLORING SYSTEM ABSTRACTIONS. 3. File System Basics. Introduction. An Alphabet Soup of File Systems. UNIX File Organization. UNIX File Names. UNIX Pathnames. UNIX File Types. A First Look Under the Hood: File System Internals. UNIX File System Layout. I've Got You Under My Skin: Delving into the File System. The Twilight Zone, or Dangers Below the File System Interface. Conclusion. 4. File System Analysis. Introduction. First Contact. Preparing the Victim's File System for Analysis. Capturing the Victim's File System Information. Sending a Disk Image Across the Network. Mounting Disk Images on an Analysis Machine. Existing File MACtimes. Detailed Analysis of Existing Files. Wrapping Up the Existing File Analysis. Intermezzo: What Happens When a File Is Deleted? Deleted File MACtimes. Detailed Analysis of Deleted Files. Exposing Out-of-Place Files by Their Inode Number. Tracing a Deleted File Back to Its Original Location. Tracing a Deleted File Back by Its Inode Number. Another Lost Son Comes Back Home. Loss of Innocence. Conclusion. 5. Systems and Subversion. Introduction. The Standard Computer System Architecture. The UNIX System Life Cycle, from Start-up to Shutdown. Case Study: System Start-up Complexity. Kernel Configuration Mechanisms. Protecting Forensic Information with Kernel Security Levels. Typical Process and System Status Tools. How Process and System Status Tools Work. Limitations of Process and System Status Tools. Subversion with Rootkit Software. Command-Level Subversion. Command-Level Evasion and Detection. Library-Level Subversion. Kernel-Level Subversion. Kernel Rootkit Installation. Kernel Rootkit Operation. Kernel Rootkit Detection and Evasion. Conclusion. 6. Malware Analysis Basics. Introduction. The Dangers of Dynamic Program Analysis. Program Confinement with Hard Virtual Machines. Program Confinement with Soft Virtual Machines. The Dangers of Confinement with Soft Virtual Machines. Program Confinement with Jails and chroot(). Dynamic Analysis with System-Call Monitors. Program Confinement with System-Call Censors. Program Confinement with System-Call Spoofing. The Dangers of Confinement with System Calls. Dynamic Analysis with Library-Call Monitors. Program Confinement with Library Calls. The Dangers of Confinement with Library Calls. Dynamic Analysis at the Machine-Instruction Level. Static Analysis and Reverse Engineering. Small Programs Can Have Many Problems. Malware Analysis Countermeasures. Conclusion. III. BEYOND THE ABSTRACTIONS. 7. The Persistence of Deleted File Information. Introduction. Examples of Deleted Information Persistence. Measuring the Persistence of Deleted File Contents. Measuring the Persistence of Deleted File MACtimes. The Brute-Force Persistence of Deleted File MACtimes. The Long-Term Persistence of Deleted File MACtimes. The Impact of User Activity on Deleted File MACtimes. The Trustworthiness of Deleted File Information. Why Deleted File Information Can Survive Intact. Conclusion. 8. Beyond Processes. Introduction. The Basics of Virtual Memory. The Basics of Memory Pages. Files and Memory Pages. Anonymous Memory Pages. Capturing Memory. The savecore Command. Static Analysis: Recognizing Memory from Files. Recovering Encrypted File Contents Without Keys. File System Blocks vs. Memory Page Technique. Recognizing Files in Memory. Dynamic Analysis: The Persistence of Data in Memory. File Persistence in Memory. The Persistence of Nonfile, or Anonymous, Data. Swap Persistence. The Persistence of Memory Through the Boot Process. The Trustworthiness and Tenacity of Memory Data. Conclusion. Appendix A. The Coroner's Toolkit and Related Software. Introduction. Data Gathering with grave-robber. Time Analysis with mactime. File Reconstruction with lazarus. Low-Level File System Utilities. Low-Level Memory Utilities. Appendix B. Data Gathering and the Order of Volatility. Introduction. The Basics of Volatility. The State of the Art. How to Freeze a Computer. Conclusion. References. Index.
Series Title: Addison-Wesley professional computing series.
Responsibility: Dan Farmer ; Wietse Venema.
More information:

Reviews

User-contributed reviews
Retrieving GoodReads reviews...
Retrieving DOGObooks reviews...

Tags

Be the first.
Confirm this request

You may have already requested this item. Please select Ok if you would like to proceed with this request anyway.

Linked Data


\n\n

Primary Entity<\/h3>\n
<http:\/\/www.worldcat.org\/oclc\/253548068<\/a>> # Forensic discovery<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Book<\/a>, schema:CreativeWork<\/a> ;\u00A0\u00A0\u00A0\nlibrary:oclcnum<\/a> \"253548068<\/span>\" ;\u00A0\u00A0\u00A0\nlibrary:placeOfPublication<\/a> <http:\/\/dbpedia.org\/resource\/Boston<\/a>> ; # Boston<\/span>\n\u00A0\u00A0\u00A0\nlibrary:placeOfPublication<\/a> <http:\/\/id.loc.gov\/vocabulary\/countries\/mau<\/a>> ;\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computersicherheit<\/a>> ; # Computersicherheit<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computersicherheit_swd_id_42743242<\/a>> ; # Computersicherheit ; SWD-ID: 42743242<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/id.worldcat.org\/fast\/872484<\/a>> ; # Computer security<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/eindringerkennung_swd_id_47066271<\/a>> ; # Eindringerkennung ; SWD-ID: 47066271<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/data_recovery<\/a>> ; # Data recovery<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/forensic_sciences<\/a>> ; # Forensic sciences<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/gerichtliche_wissenschaften_swd_id_42001365<\/a>> ; # Gerichtliche Wissenschaften ; SWD-ID: 42001365<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/id.worldcat.org\/fast\/932011<\/a>> ; # Forensic sciences<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/data_recovery_computer_science<\/a>> ; # Data recovery (Computer science)<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computerforensik<\/a>> ; # Computerforensik<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/datensicherung_swd_id_40111441<\/a>> ; # Datensicherung ; SWD-ID: 40111441<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/datensicherung<\/a>> ; # Datensicherung<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computer_security<\/a>> ; # Computer security<\/span>\n\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/dewey.info\/class\/005.8\/<\/a>> ;\u00A0\u00A0\u00A0\nschema:bookFormat<\/a> bgn:PrintBook<\/a> ;\u00A0\u00A0\u00A0\nschema:contributor<\/a> <http:\/\/viaf.org\/viaf\/290896984<\/a>> ; # Wietse Venema<\/span>\n\u00A0\u00A0\u00A0\nschema:creator<\/a> <http:\/\/viaf.org\/viaf\/283937837<\/a>> ; # Dan Farmer<\/span>\n\u00A0\u00A0\u00A0\nschema:datePublished<\/a> \"2005<\/span>\" ;\u00A0\u00A0\u00A0\nschema:exampleOfWork<\/a> <http:\/\/worldcat.org\/entity\/work\/id\/873848<\/a>> ;\u00A0\u00A0\u00A0\nschema:inLanguage<\/a> \"en<\/span>\" ;\u00A0\u00A0\u00A0\nschema:isPartOf<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Series\/addison_wesley_professional_computing_series<\/a>> ; # Addison-Wesley professional computing series.<\/span>\n\u00A0\u00A0\u00A0\nschema:name<\/a> \"Forensic discovery<\/span>\" ;\u00A0\u00A0\u00A0\nschema:productID<\/a> \"253548068<\/span>\" ;\u00A0\u00A0\u00A0\nschema:publication<\/a> <http:\/\/www.worldcat.org\/title\/-\/oclc\/253548068#PublicationEvent\/boston_addison_wesley_2005<\/a>> ;\u00A0\u00A0\u00A0\nschema:publisher<\/a> <http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Agent\/addison_wesley<\/a>> ; # Addison-Wesley<\/span>\n\u00A0\u00A0\u00A0\nschema:url<\/a> <http:\/\/catdir.loc.gov\/catdir\/toc\/ecip052\/2004024189.html<\/a>> ;\u00A0\u00A0\u00A0\nschema:workExample<\/a> <http:\/\/worldcat.org\/isbn\/9780201634976<\/a>> ;\u00A0\u00A0\u00A0\nschema:workExample<\/a> <http:\/\/worldcat.org\/isbn\/9780321703255<\/a>> ;\u00A0\u00A0\u00A0\nwdrs:describedby<\/a> <http:\/\/www.worldcat.org\/title\/-\/oclc\/253548068<\/a>> ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n\n

Related Entities<\/h3>\n
<http:\/\/dbpedia.org\/resource\/Boston<\/a>> # Boston<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Place<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Boston<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/dewey.info\/class\/005.8\/<\/a>>\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Agent\/addison_wesley<\/a>> # Addison-Wesley<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nbgn:Agent<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Addison-Wesley<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Series\/addison_wesley_professional_computing_series<\/a>> # Addison-Wesley professional computing series.<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nbgn:PublicationSeries<\/a> ;\u00A0\u00A0\u00A0\nschema:hasPart<\/a> <http:\/\/www.worldcat.org\/oclc\/253548068<\/a>> ; # Forensic discovery<\/span>\n\u00A0\u00A0\u00A0\nschema:name<\/a> \"Addison-Wesley professional computing series.<\/span>\" ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Addison-Wesley professional computing series<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computer_security<\/a>> # Computer security<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Computer security<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computerforensik<\/a>> # Computerforensik<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Computerforensik<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computersicherheit<\/a>> # Computersicherheit<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Computersicherheit<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/computersicherheit_swd_id_42743242<\/a>> # Computersicherheit ; SWD-ID: 42743242<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Computersicherheit ; SWD-ID: 42743242<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/data_recovery<\/a>> # Data recovery<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Data recovery<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/data_recovery_computer_science<\/a>> # Data recovery (Computer science)<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Data recovery (Computer science)<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/datensicherung<\/a>> # Datensicherung<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Datensicherung<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/datensicherung_swd_id_40111441<\/a>> # Datensicherung ; SWD-ID: 40111441<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Datensicherung ; SWD-ID: 40111441<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/eindringerkennung_swd_id_47066271<\/a>> # Eindringerkennung ; SWD-ID: 47066271<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Eindringerkennung ; SWD-ID: 47066271<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/forensic_sciences<\/a>> # Forensic sciences<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Forensic sciences<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/experiment.worldcat.org\/entity\/work\/data\/873848#Topic\/gerichtliche_wissenschaften_swd_id_42001365<\/a>> # Gerichtliche Wissenschaften ; SWD-ID: 42001365<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Gerichtliche Wissenschaften ; SWD-ID: 42001365<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/id.loc.gov\/vocabulary\/countries\/mau<\/a>>\u00A0\u00A0\u00A0\u00A0a \nschema:Place<\/a> ;\u00A0\u00A0\u00A0\ndcterms:identifier<\/a> \"mau<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/id.worldcat.org\/fast\/872484<\/a>> # Computer security<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Computer security<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/id.worldcat.org\/fast\/932011<\/a>> # Forensic sciences<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Intangible<\/a> ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Forensic sciences<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/viaf.org\/viaf\/283937837<\/a>> # Dan Farmer<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Person<\/a> ;\u00A0\u00A0\u00A0\nschema:familyName<\/a> \"Farmer<\/span>\" ;\u00A0\u00A0\u00A0\nschema:givenName<\/a> \"Dan<\/span>\" ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Dan Farmer<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/viaf.org\/viaf\/290896984<\/a>> # Wietse Venema<\/span>\n\u00A0\u00A0\u00A0\u00A0a \nschema:Person<\/a> ;\u00A0\u00A0\u00A0\nschema:familyName<\/a> \"Venema<\/span>\" ;\u00A0\u00A0\u00A0\nschema:givenName<\/a> \"Wietse<\/span>\" ;\u00A0\u00A0\u00A0\nschema:name<\/a> \"Wietse Venema<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/worldcat.org\/isbn\/9780201634976<\/a>>\u00A0\u00A0\u00A0\u00A0a \nschema:ProductModel<\/a> ;\u00A0\u00A0\u00A0\nschema:isbn<\/a> \"020163497X<\/span>\" ;\u00A0\u00A0\u00A0\nschema:isbn<\/a> \"9780201634976<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/worldcat.org\/isbn\/9780321703255<\/a>>\u00A0\u00A0\u00A0\u00A0a \nschema:ProductModel<\/a> ;\u00A0\u00A0\u00A0\nschema:isbn<\/a> \"0321703251<\/span>\" ;\u00A0\u00A0\u00A0\nschema:isbn<\/a> \"9780321703255<\/span>\" ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n
<http:\/\/www.worldcat.org\/title\/-\/oclc\/253548068<\/a>>\u00A0\u00A0\u00A0\u00A0a \ngenont:InformationResource<\/a>, genont:ContentTypeGenericResource<\/a> ;\u00A0\u00A0\u00A0\nschema:about<\/a> <http:\/\/www.worldcat.org\/oclc\/253548068<\/a>> ; # Forensic discovery<\/span>\n\u00A0\u00A0\u00A0\nschema:dateModified<\/a> \"2019-11-13<\/span>\" ;\u00A0\u00A0\u00A0\nvoid:inDataset<\/a> <http:\/\/purl.oclc.org\/dataset\/WorldCat<\/a>> ;\u00A0\u00A0\u00A0\u00A0.\n\n\n<\/div>\n