Forensic Discovery
Dan Farmer
Wietse Venema

ISBN-10: 020163497X
ISBN-13: 9780201634976

Publisher: Addison-Wesley Professional
Copyright: 2005
Format: Cloth; 240 pp
Published: 12/30/2004

Suggested retail price: $44.99
Buy from myPearsonStore

Forensic computing is gathering and analyzing data in a manner as free from

distortion as possible to reconstruct data or what has happened in the past on a

system. Many of the tools presented in this book were developed and used first

by the authors. This is the book by the people who wrote the original versions

of forensic tools that are now widely used. The thrust of the book deals with

the collection and use of computer evidence to apprehend the hacker and, once

apprehended, to either prosecute or defend. The majority of examples are from

Solaris, FreeBSD, and Linux systems, Microsoft's Windows shows up as well.

Internationally recognized computer security experts offer advice and tools for achieving security through computer forensic analysis.

° Authors are renowned for developing notorious computer-security software such as SATAN (Security Administrator's Tool for Analyzing Networks) and the Coroner's Toolkit.

° Covers looking at systems in a new way--one that affords the opportunity to understand how systems can be compromised.

° Only titles approved by Brian Kernighan are allowed into Professional Computing Series.

Preface.

About the Authors.

I. BASIC CONCEPTS.

1. The Spirit of Forensic Discovery.

    Introduction.

    Unusual Activity Stands Out.

    The Order of Volatility (OOV).

    Layers and Illusions.

    The Trustworthiness of Information.

    The Fossilization of Deleted Information.

    Archaeology vs. Geology.

2. Time Machines.

    Introduction.

    The First Signs of Trouble.

    What's Up, MAC? An Introduction to MACtimes.

    Limitations of MACtimes.

    Argus: Shedding Additional Light on the Situation.

    Panning for Gold: Looking for Time in Unusual Places.

    DNS and Time.

    Journaling File Systems and MACtimes.

    The Foibles of Time.

    Conclusion.

II. EXPLORING SYSTEM ABSTRACTIONS.

3. File System Basics.

    Introduction.

    An Alphabet Soup of File Systems.

    UNIX File Organization.

    UNIX File Names.

    UNIX Pathnames.

    UNIX File Types.

    A First Look Under the Hood: File System Internals.

    UNIX File System Layout.

    I've Got You Under My Skin: Delving into the File System.

    The Twilight Zone, or Dangers Below the File System Interface.

    Conclusion.

4. File System Analysis.

    Introduction.

    First Contact.

    Preparing the Victim's File System for Analysis.

    Capturing the Victim's File System Information.

    Sending a Disk Image Across the Network.

    Mounting Disk Images on an Analysis Machine.

    Existing File MACtimes.

    Detailed Analysis of Existing Files.

    Wrapping Up the Existing File Analysis.

    Intermezzo: What Happens When a File Is Deleted?

    Deleted File MACtimes.

    Detailed Analysis of Deleted Files.

    Exposing Out-of-Place Files by Their Inode Number.

    Tracing a Deleted File Back to Its Original Location.

    Tracing a Deleted File Back by Its Inode Number.

    Another Lost Son Comes Back Home.

    Loss of Innocence.

    Conclusion.

5. Systems and Subversion.

    Introduction.

    The Standard Computer System Architecture.

    The UNIX System Life Cycle, from Start-up to Shutdown.

    Case Study: System Start-up Complexity.

    Kernel Configuration Mechanisms.

    Protecting Forensic Information with Kernel Security Levels.

    Typical Process and System Status Tools.

    How Process and System Status Tools Work.

    Limitations of Process and System Status Tools.

    Subversion with Rootkit Software.

    Command-Level Subversion.

    Command-Level Evasion and Detection.

    Library-Level Subversion.

    Kernel-Level Subversion.

    Kernel Rootkit Installation.

    Kernel Rootkit Operation.

    Kernel Rootkit Detection and Evasion.

    Conclusion.

6. Malware Analysis Basics.

    Introduction.

    The Dangers of Dynamic Program Analysis.

    Program Confinement with Hard Virtual Machines.

    Program Confinement with Soft Virtual Machines.

    The Dangers of Confinement with Soft Virtual Machines.

    Program Confinement with Jails and chroot().

    Dynamic Analysis with System-Call Monitors.

    Program Confinement with System-Call Censors.

    Program Confinement with System-Call Spoofing.

    The Dangers of Confinement with System Calls.

    Dynamic Analysis with Library-Call Monitors.

    Program Confinement with Library Calls.

    The Dangers of Confinement with Library Calls.

    Dynamic Analysis at the Machine-Instruction Level.

    Static Analysis and Reverse Engineering.

    Small Programs Can Have Many Problems.

    Malware Analysis Countermeasures.

    Conclusion.

III. BEYOND THE ABSTRACTIONS.

7. The Persistence of Deleted File Information.

    Introduction.

    Examples of Deleted Information Persistence.

    Measuring the Persistence of Deleted File Contents.

    Measuring the Persistence of Deleted File MACtimes.

    The Brute-Force Persistence of Deleted File MACtimes.

    The Long-Term Persistence of Deleted File MACtimes.

    The Impact of User Activity on Deleted File MACtimes.

    The Trustworthiness of Deleted File Information.

    Why Deleted File Information Can Survive Intact.

    Conclusion.

8. Beyond Processes.

    Introduction.

    The Basics of Virtual Memory.

    The Basics of Memory Pages.

    Files and Memory Pages.

    Anonymous Memory Pages.

    Capturing Memory.

    The savecore Command.

    Static Analysis: Recognizing Memory from Files.

    Recovering Encrypted File Contents Without Keys.

    File System Blocks vs. Memory Page Technique.

    Recognizing Files in Memory.

    Dynamic Analysis: The Persistence of Data in Memory.

    File Persistence in Memory.

    The Persistence of Nonfile, or Anonymous, Data.

    Swap Persistence.

    The Persistence of Memory Through the Boot Process.

    The Trustworthiness and Tenacity of Memory Data.

    Conclusion.

Appendix A. The Coroner's Toolkit and Related Software.

    Introduction.

    Data Gathering with grave-robber.

    Time Analysis with mactime.

    File Reconstruction with lazarus.

    Low-Level File System Utilities.

    Low-Level Memory Utilities.

Appendix B. Data Gathering and the Order of Volatility.

    Introduction.

    The Basics of Volatility.

    The State of the Art.

    How to Freeze a Computer.

    Conclusion.

References.

Index.

 

Dan Farmer is author of a variety of security programs and papers. He is currently chief technical officer of Elemental Security, a computer security software company. Together he and Wietse Venema, have written many of the world�s leading information security and forensics packages, including the SATAN network security scanner and the Coroner�s Toolkit.

Wietse Venema has written some of the world�s most widely used software, including TCP Wrapper and the Postfix mail system. He is currently a research staff member at IBM Research. Together, he and Dan Farmer have written many of the world�s leading information security and forensics packages, including the SATAN network security scanner and the Coroner�s Toolkit.



"Don't look now, but your fingerprints are all over the cover of this book. Simply picking it up off the shelf to read the cover has left a trail of evidence that you were here.

    "If you think book covers are bad, computers are worse. Every time you use a computer, you leave elephant-sized tracks all over it. As Dan and Wietse show, even people trying to be sneaky leave evidence all over, sometimes in surprising places.

    "This book is about computer archeology. It's about finding out what might have been based on what is left behind. So pick up a tool and dig in. There's plenty to learn from these masters of computer security."
   --Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software and Building Secure Software

"A wonderful book. Beyond its obvious uses, it also teaches a great deal about operating system internals."
   --Steve Bellovin, coauthor of Firewalls and Internet Security, Second Edition, and Columbia University professor

"A must-have reference book for anyone doing computer forensics. Dan and Wietse have done an excellent job of taking the guesswork out of a difficult topic."
   --Brad Powell, chief security architect, Sun Microsystems, Inc.

"Farmer and Venema provide the essential guide to 'fossil' data. Not only do they clearly describe what you can find during a forensic investigation, they also provide research found nowhere else about how long data remains on disk and in memory. If you ever expect to look at an exploited system, I highly recommend reading this book."
   --Rik Farrow, Consultant, author of Internet Security for Home and Office

"Farmer and Venema do for digital archaeology what Indiana Jones did for historical archaeology. Forensic Discovery unearths hidden treasures in enlightening and entertaining ways, showing how a time-centric approach to computer forensics reveals even the cleverest intruder."
   --Richard Bejtlich, technical director, ManTech CFIA, and author of The Tao of Network Security Monitoring

"Farmer and Venema are 'hackers' of the old school: They delight in understanding computers at every level and finding new ways to apply existing information and tools to the solution of complex problems."
   --Muffy Barkocy, Senior Web Developer, Shopping.com

"This book presents digital forensics from a unique perspective because it examines the systems that create digital evidence in addition to the techniques used to find it. I would recommend this book to anyone interested in learning more about digital evidence from UNIX systems."
   --Brian Carrier, digital forensics researcher, and author of File System Forensic Analysis

The Definitive Guide to Computer Forensics: Theory and Hands-On Practice

Computer forensics--the art and science of gathering and analyzing digital evidence, reconstructing data and attacks, and tracking perpetrators--is becoming ever more important as IT and law enforcement professionals face an epidemic in computer crime. In Forensic Discovery, two internationally recognized experts present a thorough and realistic guide to the subject.

Dan Farmer and Wietse Venema cover both theory and hands-on practice, introducing a powerful approach that can often recover evidence considered lost forever.

The authors draw on their extensive firsthand experience to cover everything from file systems, to memory and kernel hacks, to malware. They expose a wide variety of computer forensics myths that often stand in the way of success. Readers will find extensive examples from Solaris, FreeBSD, Linux, and Microsoft Windows, as well as practical guidance for writing one's own forensic tools. The authors are singularly well-qualified to write this book: They personally created some of the most popular security tools ever written, from the legendary SATAN network scanner to the powerful Coroner's Toolkit for analyzing UNIX break-ins.

After reading this book you will be able to

  • Understand essential forensics concepts: volatility, layering, and trust
  • Gather the maximum amount of reliable evidence from a running system
  • Recover partially destroyed information--and make sense of it
  • Timeline your system: understand what really happened when
  • Uncover secret changes to everything from system utilities to kernel modules
  • Avoid cover-ups and evidence traps set by intruders
  • Identify the digital footprints associated with suspicious activity
  • Understand file systems from a forensic analyst's point of view
  • Analyze malware--without giving it a chance to escape
  • Capture and examine the contents of main memory on running systems
  • Walk through the unraveling of an intrusion, one step at a time

The book's companion Web site contains complete source and binary code for open source software discussed in the book, plus additional computer forensics case studies and resource links.



View a Sample Chapter PDF:

Pearson Higher Education offers special pricing when you choose to package your text with other student resources. If you're interested in creating a cost-saving package for your students, contact your Pearson Higher Education representative for pricing and ordering information.

This title is a member of the Addison-Wesley Professional Computing Series, which also contains the titles below . You can also visit the Addison-Wesley Professional Computing Series page.

  • 0201379279Advanced CORBA® Programming with C++
    Henning & Vinoski
    © 1999 | Addison-Wesley Professional | Paper; 1120 pages | Instock
    ISBN-10: 0201379279 | ISBN-13: 9780201379273
    Brief Description | Buy from myPearsonStore

  • 0321525949Advanced Programming in the UNIX Environment: Paperback Edition, 2/E
    Stevens & Rago
    © 2008 | Addison-Wesley Professional | Paper; 960 pages | Instock
    ISBN-10: 0321525949 | ISBN-13: 9780321525949
    Buy from myPearsonStore

  • 0201433079Advanced Programming in the UNIX® Environment, 2/E
    Stevens & Rago
    © 2005 | Addison-Wesley Professional | Cloth; 960 pages | Instock
    ISBN-10: 0201433079 | ISBN-13: 9780201433074
    Brief Description | Buy from myPearsonStore

  • 0131411543Advanced UNIX Programming, 2/E
    Rochkind
    © 2004 | Addison-Wesley Professional | Paper; 736 pages | Instock
    ISBN-10: 0131411543 | ISBN-13: 9780131411548
    Brief Description | Buy from myPearsonStore

  • 0131429019The Art of UNIX Programming
    Raymond
    © 2004 | Addison-Wesley Professional | Paper; 560 pages | Instock
    ISBN-10: 0131429019 | ISBN-13: 9780131429017
    Brief Description | Buy from myPearsonStore

  • 020172152XBuilding Secure Software: How to Avoid Security Problems the Right Way
    Viega & McGraw
    © 2002 | Addison-Wesley Professional | Cloth; 528 pages | Instock
    ISBN-10: 020172152X | ISBN-13: 9780201721522
    Brief Description | Buy from myPearsonStore

  • 0201498413C Interfaces and Implementations: Techniques for Creating Reusable Software
    Hanson
    © 1997 | Addison-Wesley Professional | Paper; 544 pages | Instock
    ISBN-10: 0201498413 | ISBN-13: 9780201498417
    Buy from myPearsonStore

  • 0201634988Design Patterns CD: Elements of Reusable Object-Oriented Software
    Gamma, Helm, Johnson & Vlissides
    © 1998 | Addison-Wesley Professional | CD-ROM Only; 2 pages | Instock
    ISBN-10: 0201634988 | ISBN-13: 9780201634983
    Brief Description | Buy from myPearsonStore

  • 0201633612Design Patterns: Elements of Reusable Object-Oriented Software
    Gamma, Helm, Johnson & Vlissides
    © 1995 | Addison-Wesley Professional | Cloth; 416 pages | Instock
    ISBN-10: 0201633612 | ISBN-13: 9780201633610
    Brief Description | Buy from myPearsonStore

  • 0321334876Effective C++: 55 Specific Ways to Improve Your Programs and Designs, 3/E
    Meyers
    © 2005 | Addison-Wesley Professional | Paper; 320 pages | Instock
    ISBN-10: 0321334876 | ISBN-13: 9780321334879
    Brief Description | Buy from myPearsonStore

  • 0201749629Effective STL: 50 Specific Ways to Improve Your Use of the Standard Template Library
    Meyers
    © 2001 | Addison-Wesley Professional | Paper; 288 pages | Instock
    ISBN-10: 0201749629 | ISBN-13: 9780201749625
    Brief Description | Buy from myPearsonStore

  • 020163466XFirewalls and Internet Security: Repelling the Wily Hacker, 2/E
    Cheswick, Bellovin & Rubin
    © 2003 | Addison-Wesley Professional | Paper; 464 pages | Instock
    ISBN-10: 020163466X | ISBN-13: 9780201634662
    Brief Description | Buy from myPearsonStore

  • 020163497XForensic Discovery
    Farmer & Venema
    © 2005 | Addison-Wesley Professional | Cloth; 240 pages | Instock
    ISBN-10: 020163497X | ISBN-13: 9780201634976
    Brief Description | Buy from myPearsonStore

  • 0321618092Forensic Discovery
    Farmer & Venema
    © 2005 | Addison-Wesley Professional | On-line Supplement | Estimated Availability: 12/27/2004
    ISBN-10: 0321618092 | ISBN-13: 9780321618092
    URL: http://safari.informit.com


  • 0201563339Gigabit Networking
    Partridge
    © 1994 | Addison-Wesley Professional | Paper; 416 pages | Estimated Availability: 10/30/1993
    ISBN-10: 0201563339 | ISBN-13: 9780201563337
    Brief Description | Buy from myPearsonStore

  • 0201634481Interconnections: Bridges, Routers, Switches, and Internetworking Protocols, 2/E
    Perlman
    © 2000 | Addison-Wesley Professional | Cloth; 560 pages | Instock
    ISBN-10: 0201634481 | ISBN-13: 9780201634488
    Buy from myPearsonStore

  • 0201633620Large-Scale C++ Software Design
    Lakos
    © 1996 | Addison-Wesley Professional | Paper; 896 pages | Instock
    ISBN-10: 0201633620 | ISBN-13: 9780201633627
    Buy from myPearsonStore

  • 020163371XMore Effective C++: 35 New Ways to Improve Your Programs and Designs
    Meyers
    © 1996 | Addison-Wesley Professional | Paper; 336 pages | Instock
    ISBN-10: 020163371X | ISBN-13: 9780201633719
    Buy from myPearsonStore

  • 020161586XThe Practice of Programming
    Kernighan & Pike
    © 1999 | Addison-Wesley Professional | Paper; 288 pages | Instock
    ISBN-10: 020161586X | ISBN-13: 9780201615869
    Brief Description | Buy from myPearsonStore

  • 0201379236STL Tutorial and Reference Guide: C++ Programming with the Standard Template Library, 2/E
    Musser, Derge & Saini
    © 2001 | Addison-Wesley Professional | Cloth; 560 pages | Instock
    ISBN-10: 0201379236 | ISBN-13: 9780201379235
    Brief Description | Buy from myPearsonStore

  • 0201633469TCP/IP Illustrated, Volume 1: The Protocols
    Stevens
    © 1994 | Addison-Wesley Professional | Cloth; 600 pages | Instock
    ISBN-10: 0201633469 | ISBN-13: 9780201633467
    Brief Description | Buy from myPearsonStore

  • 020163354XTCP/IP Illustrated, Volume 2: The Implementation
    Wright & Stevens
    © 1995 | Addison-Wesley Professional | Cloth; 1200 pages | Instock
    ISBN-10: 020163354X | ISBN-13: 9780201633542
    Brief Description | Buy from myPearsonStore

  • 0201634953TCP/IP Illustrated, Volume 3: TCP for Transactions, HTTP, NNTP, and the UNIX® Domain Protocols
    Stevens
    © 1996 | Addison-Wesley Professional | Cloth; 352 pages | Instock
    ISBN-10: 0201634953 | ISBN-13: 9780201634952
    Buy from myPearsonStore

  • 020163337XTcl and the Tk Toolkit
    Ousterhout
    © 1994 | Addison-Wesley Professional | Paper; 480 pages | Out of Stock
    ISBN-10: 020163337X | ISBN-13: 9780201633375
    Brief Description

  • 0201633388UNIX® Systems for Modern Architectures: Symmetric Multiprocessing and Caching for Kernel Programmers
    Schimmel
    © 1994 | Addison-Wesley Professional | Paper; 432 pages | Instock
    ISBN-10: 0201633388 | ISBN-13: 9780201633382
    Brief Description | Buy from myPearsonStore

  • 0131411551Unix Network Programming, Volume 1: The Sockets Networking API, 3/E
    Stevens, Fenner & Rudoff
    © 2004 | Addison-Wesley Professional | Cloth; 1024 pages | Instock
    ISBN-10: 0131411551 | ISBN-13: 9780131411555
    Brief Description | Buy from myPearsonStore

Pearson Higher Education offers special pricing when you choose to package your text with other student resources. If you're interested in creating a cost-saving package for your students, browse our available packages below, or contact your Pearson Higher Education representative to create your own package.



Copyright ©2008 Pearson Education. All rights reserved. Legal Notice | Privacy Policy | Permissions