Table Of ContentDigital Forensics and Incident
Response
An intelligent way to respond to attacks
Gerard Johansen
BIRMINGHAM - MUMBAI
Digital Forensics and Incident Response
Copyright © 2017 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means, without the prior written permission of the
publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the
information presented. However, the information contained in this book is sold without
warranty, either express or implied. Neither the author, nor Packt Publishing, and its
dealers and distributors will be held liable for any damages caused or alleged to be caused
directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: July 2017
Production reference: 1210717
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN 978-1-78728-868-3
www.packtpub.com
Credits
Author Copy Editor
Gerard Johansen Safis Editing
Reviewer Project Coordinator
Nicole L. Stoneman Judie Jose
Acquisition Editor Proofreader
Rahul Nair Safis Editing
Content Development Editor Indexer
Abhishek Jadhav Aishwarya Gangawane
Technical Editor Graphics
Manish D Shanbhag Kirk D'Penha
Production Coordinator
Aparna Bhagat
About the Author
Gerard Johansen is an information security professional with over a decade of experience
in such areas as penetration testing, vulnerability management, threat assessment
modeling, and incident response. Beginning his information security career while a
cybercrime investigator, Gerard has built on that experience while working as a consultant
and security analyst for clients and organizations ranging from healthcare to finance.
Gerard is a graduate of Norwich University’s Masters of Science in Information Assurance
and a Certified Information Systems Security Professional.
Gerard is currently employed as an Enterprise Security Manager with a large retailer with a
focus on incident detection, response and threat intelligence integration. He has also
contributed to several online publications focused on various aspects of penetration testing.
About the Reviewer
Nicole L. Stoneman is the Director of Digital of Forensics at Vestigant. Ms. Stoneman has
been conducting computer forensic exams since 2005 and has been involved in thousands of
forensic investigations. Ms. Stoneman is a Certified Computer Examiner (CCE) through The
International Society of Forensic Computer Examiners.
www.PacktPub.com
For support files and downloads related to your book, please visit www.PacktPub.com.
Did you know that Packt offers eBook versions of every book published, with PDF and
ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a
print book customer, you are entitled to a discount on the eBook copy. Get in touch with us
at [email protected] for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a
range of free newsletters and receive exclusive discounts and offers on Packt books and
eBooks.
https://www.packtpub.com/mapt
Get the most in-demand software skills with Mapt. Mapt gives you full access to all Packt
books and video courses, as well as industry-leading tools to help you plan your personal
development and advance your career.
Why subscribe?
Fully searchable across every book published by Packt
Copy and paste, print, and bookmark content
On demand and accessible via a web browser
Customer Feedback
Thanks for purchasing this Packt book. At Packt, quality is at the heart of our editorial
process. To help us improve, please leave us an honest review on this book's Amazon page
at https://www.amazon.com/dp/1787288684/.
If you'd like to join our team of regular reviewers, you can e-mail us at
[email protected]. We award our regular reviewers with free eBooks and
videos in exchange for their valuable feedback. Help us be relentless in improving our
products!
Table of Contents
Preface
1
Chapter 1: Incident Response
6
The incident response process 7
The role of digital forensics 10
The incident response framework 11
The incident response charter 11
CSIRT 12
CSIRT core team 13
Technical support personnel 15
Organizational support personnel 16
External resources 18
The incident response plan 19
Incident classification 20
The incident response playbook 22
Escalation procedures 24
Maintaining the incident response capability 25
Summary 27
Chapter 2: Forensic Fundamentals
28
Legal aspects 28
Laws and regulations 29
Rules of evidence 30
Digital forensic fundamentals 31
A brief history 31
The digital forensic process 33
Identification 34
Preservation 34
Collection 35
Proper evidence handling 35
Chain of custody 36
Examination 39
Analysis 40
Presentation 40
Digital forensic lab 41
Physical security 41
Tools 42
Hardware 42
Software 45
Jump kit 51
Summary 53
Chapter 3: Network Evidence Collection
54
Preparation 54
Network diagram 55
Configuration 56
Logs and log management 56
Network device evidence 58
Security information and event management system 60
Security onion 62
Packet capture 63
tcpdump 64
WinPcap and RawCap 67
Wireshark 69
Evidence collection 72
Summary 74
Chapter 4: Acquiring Host-Based Evidence
75
Preparation 75
Evidence volatility 76
Evidence acquisition 76
Evidence collection procedures 78
Memory acquisition 79
Local acquisition 80
FTK Imager 80
Winpmem 83
Remote acquisition 86
Winpmem 86
F-Response 87
Virtual machines 96
Non-volatile data 97
Summary 98
Chapter 5: Understanding Forensic Imaging
99
Overview of forensic imaging 99
Preparing a stage drive 102
Imaging 107
Dead imaging 107
Live imaging 118
Imaging with Linux 120
[ ii ]
