CYBER CRIME INVESTIGATOR'S FIELD GUIDE

Description

Cover Half Title Title Page Copyright Page Dedication Table of Contents Preface About the Author Chapter 1 The initial contact Chapter questions Chapter 2 Client site arrival Chapter questions Chapter 3 Evidence collection procedures You Are Now Sitting in Front of the victim’s system – What Should Your Approach Be? Let’s step back for a minute and look at the big network picture Malware Virus Encrypted Program Boot sector Multipartite Macro Stealth Hoax Polymorphic Armored Metamorphic Worm Trojan horse Ransomware Spyware Rootkit Spam Terminology Infection warning signs Network devices Microsoft Windows Operating Systems and file system types Detailed procedures for obtaining a bitstream backup of a hard drive Kali Linux Questions Chapter 4 Evidence collection and analysis tools Safe back GetTime FileList, FileCnvt, and Excel GetFree Swap files and GetSwap GetSlack Temporary files Filter_I Filter Intel Names Key word generation TextSearch Plus CRCMD DiskSig Doc Mcrypt Micro-Zap Map M-Sweep Net Threat Analyzer AnaDisk Seized Scrub Spaces NTFS FileList NTFS GetFree NTFS GetSlack NTFS VIEW NTFS Check NTIcopy DiskSearch 32 Magnet Forensics Chapter questions Chapter 5 AccessData’s Forensic Toolkit Creating a case Working on an existing case Chapter questions Chapter 6 Guidance Software’s EnCase Chapter questions Chapter 7 ILook Investigator Chapter questions Chapter 8 Password recovery Chapter questions Chapter 9 Questions and answers by subject area Evidence collection Legal Evidence analysis Military Hackers BackTracing (TraceBack) Logs Encryption Government Networking E-Mail Chapter 10 Recommended: Reference materials PERL and C Scripts UNIX, Windows, NetWare, and Macintosh Computer internals Computer networking Websites of interest Chapter 11 Case study Travel security Wireshark and Python The Fallout Vendor status The target Let’s dance Recommendations Passwords SAM file Intrusion Detection Systems Insecure CGI Scripts BO/BO2K Chapter 12 Rail transportation Chapter 13 Transhumanism, robotics, and medical devices Chapter 14 Memory and incident response system commands Chapter 15 Making use of open-source intelligence (OSINT) Appendix A: Glossary Appendix B: Port numbers of interest Appendix C: Attack signatures Appendix D: UNIX/Linux commands Appendix E: Cisco firewall commands Appendix F: Discovering unauthorized access to your computer Appendix G: Electromagnetic field analysis (EFA) Appendix H: The intelligence community since 9/11 Appendix I: Answers to chapter questions Index