Fundamentals of Digital Forensics: Theory, Methods, and Real-Life Applications

Preface
	Overview and Audience
	Motivation and Features
Contents
Part I: Theory
	1: What Is Digital Forensics?
		1.1 A Forensic Examination
		1.2 How Forensics Has Been Used
		1.3 Questions and Tasks
		References
	2: Ethics and Integrity
		2.1 Tracing Online Users
		2.2 Key Disclosure Law(s)
		2.3 Police Hacking
		2.4 Ethical Guidelines
		2.5 Questions and Tasks
		References
	3: Computer Theory
		3.1 Secondary Storage Media
		3.2 The NTFS File Systems
		3.3 File Structure
		3.4 Data Representation
		3.5 User Accounts in Windows 10
		3.6 Windows Registry
		3.7 Encryption and Hashing
		3.8 SQLite Databases
		3.9 Memory and Paging
		3.10 Questions and Tasks
		References
	4: Notable Artifacts
		4.1 Metadata
		4.2 EXIF Data
		4.3 Prefetch
		4.4 Shellbags
		4.5 .LNK Files
		4.6 MRU-Stuff
		4.7 Thumbcache
		4.8 Windows Event Viewer
		4.9 Program Log Files
		4.10 USB Device History
		4.11 Questions and Tasks
		References
	5: Decryption and Password Enforcing
		5.1 Password Theory
		5.2 Decryption Attacks
		5.3 Password Guessing Attacks
		5.4 Questions and Tasks
		References
Part II: The Forensic Process
	6: Cybercrime, Cyber Aided Crime, and Digital Evidence
		6.1 Cybercrime
		6.2 Cyber Aided Crime
		6.3 Crimes with Digital Evidence
		6.4 Questions and Tasks
		References
	7: Incident Response
		7.1 Why and When?
		7.2 Establishing Capabilities
		7.3 Incident Handling
		7.4 Questions and Tasks
		References
	8: Collecting Evidence
		8.1 When the Device Is Off
		8.2 When the Device Is On
		8.3 Live Investigation: Preparation
		8.4 Live Investigation: Conducting
		8.5 Live Investigation: Afterthoughts
		8.6 Questions and Tasks
		References
	9: Triage
		9.1 Specific Examinations
		9.2 White and Blacklisting
		9.3 Automated Analysis
		9.4 Field Triage
		9.5 Questions and Tasks
		References
	10: Analyzing Data and Writing Reports
		10.1 Setting the Stage
		10.2 Forensic Analysis
		10.3 Reporting
			10.3.1 Case Data
			10.3.2 Purpose of Examination
				Summary
			10.3.3 Findings
				Findings
			10.3.4 Conclusions
				Conclusions
		10.4 Final Remarks
		10.5 Questions and Tasks
Part III: Get Practical
	11: Collecting Data
		11.1 Imaging
		11.2 Collecting Memory Dumps
		11.3 Collecting Registry Data
		11.4 Collecting Network Data
		11.5 Collecting Video from Surveillance
		11.6 Process of a Live Examination
		11.7 Questions and Tasks
		References
	12: Indexing and Searching
		12.1 Indexing
		12.2 Searching
			12.2.1 Questions and Tasks
	13: Cracking
		13.1 Password Cracking Using PRTK
		13.2 Password Cracking Using Hashcat
		13.3 Questions and Tasks
	14: Finding Artifacts
		14.1 Install Date
		14.2 Time Zone Information
		14.3 Users in the System
		14.4 Registered Owner
		14.5 Partition Analysis and Recovery
		14.6 Deleted Files
			14.6.1 Recovering Files Deleted from MFT
			14.6.2 File Carving
		14.7 Analyzing Compound Files
		14.8 Analyzing File Metadata
			14.8.1 NTFS Time Stamps
			14.8.2 EXIF Data
			14.8.3 Office Metadata
		14.9 Analyzing Log Files
		14.10 Analyzing Unorganized Data
		14.11 Analyzing SQLite Databases
		14.12 Questions and Tasks
		References
	15: Some Common Questions and Tasks
		15.1 Was the Computer Remote Controlled?
			15.1.1 Analysis of Applications
			15.1.2 Scenario Testing
		15.2 Who Was Using the Computer?
		15.3 Was This Device Ever at Site X?
		15.4 What Device Took the Picture and Where?
		15.5 Where Were the Documents Created?
		15.6 Application Analysis: The Windows Firewall
		15.7 Questions and Tasks
	16: FTK Specifics
		16.1 FTK: Create a Case
		16.2 FTK: Preprocessing
		16.3 FTK: Overview
		16.4 Registry Viewer: Overview
	17: Open-Source or Freeware Tools
		17.1 Prefetch Parser by Erik Zimmerman
		17.2 Shellbags Explorer by Erik Zimmerman
		17.3 .lnk File Parser by Erik Zimmerman
		17.4 Thumbcache Viewer
		17.5 USBDevview by NirSoft
		17.6 Autopsy
			17.6.1 Get Going
			17.6.2 Autopsy Overview
			17.6.3 The Image Gallery
			17.6.4 Communications
			17.6.5 Timeline
		17.7 Registry Explorer
Part IV: Memory Forensics
	Reference
	18: Memory Analysis
		18.1 Data Storage
		18.2 Processes
		18.3 Forensic Techniques
		18.4 Questions and Tasks
		Reference
	19: Memory Analysis Tools
		19.1 Volatility
			19.1.1 What Is Volatility Made Up from?
			19.1.2 How to Get Volatility
			19.1.3 Basic Usage
			19.1.4 Volshell
		19.2 Redline
			19.2.1 Components of Redline
			19.2.2 Redline Usage
		References
	20: Memory Analysis in Criminal Investigations
		20.1 Questions and Tasks
	21: Malware Analysis
		21.1 Malware Analysis with Volatility
		21.2 Malware Analysis with Redline
		21.3 Questions and Tasks
Appendices
	Appendix A
		Solutions
			Chapter 1
			Chapter 2
			Chapter 3
			Chapter 4
			Chapter 5
			Chapter 6
			Chapter 7
			Chapter 8
			Chapter 9
			Chapter 10
			Chapter 11
			Chapter 12
			Chapter 13
			Chapter 14
			Chapter 15
			Chapter 18
			Chapter 20
			Chapter 21
	Appendix B
		Useful Scripts
			Capturing Basic Computer Information on Mac and Linux
			Capturing Basic Computer Information on Windows
			Convert Autopsy Text Index to Useable Dictionary for Password Cracking
			Parse Jitsi Chat Logs
	Appendix C
		Sample Report (Template)
			Protocol of Forensic Examination of Computer 1234567-32
				Summary
				Findings
				Conclusions
				Word List
		Sample Report (Example Case in Chap. 7)
			Protocol of Forensic Examination of Computer 1234567-32
				Summary
				Findings
				Conclusions
				Word List
	Appendix D
		List of Time Zones
		Reference
	Appendix E
		Complete Jitsi Chat Log
Index