The investigation of a computer system believed to be involved in cybercrime. Forensic software provides a variety of tools for investigating a suspect PC. Such programs may include a function that copies the entire hard drive to another system for inspection, allowing the original to remain unaltered.
Another utility compares file extensions to the data content in order to determine if files have been camouflaged with phony file extensions. For example, an image file might be renamed as a text document and vice versa.
Network Forensics
In order to identify attacks, "network forensics" deals with the capture and inspection of packets passing through a selected node in the network. Packets can be inspected on the fly or stored on disk for later analysis. See forensically clean, slack space, write blocker, file wipe, IDS and security event management software.
NIST Phases
The National Institute of Standards and Technology "Guide to Integrating Forensic Techniques into Incident Responses" covers four phases, which are briefly summarized below. For the complete 121-page NIST publication, download draft SP 800-86 at http://csrc.nist.gov/publications/nistpubs.
1 - Collection: Identify, label, record and acquire data from possible sources, while preserving the integrity of the data.
2 - Examination: Use manual and automated methods to assess and extract data of particular interest, while preserving the integrity of the data.
3 - Analysis: Use legally justifiable methods and techniques to derive useful information.
4 - Reporting: Describe actions used, explain how tools and procedures were selected, determine what other actions need to be performed, including forensic examination of additional data sources, securing identified vulnerabilities and improving existing security controls. Recommend improvements to policies, guidelines, procedures, tools and other aspects of the forensic process.
Another utility compares file extensions to the data content in order to determine if files have been camouflaged with phony file extensions. For example, an image file might be renamed as a text document and vice versa.
Network Forensics
In order to identify attacks, "network forensics" deals with the capture and inspection of packets passing through a selected node in the network. Packets can be inspected on the fly or stored on disk for later analysis. See forensically clean, slack space, write blocker, file wipe, IDS and security event management software.
NIST Phases
The National Institute of Standards and Technology "Guide to Integrating Forensic Techniques into Incident Responses" covers four phases, which are briefly summarized below. For the complete 121-page NIST publication, download draft SP 800-86 at http://csrc.nist.gov/publications/nistpubs.
1 - Collection: Identify, label, record and acquire data from possible sources, while preserving the integrity of the data.
2 - Examination: Use manual and automated methods to assess and extract data of particular interest, while preserving the integrity of the data.
3 - Analysis: Use legally justifiable methods and techniques to derive useful information.
4 - Reporting: Describe actions used, explain how tools and procedures were selected, determine what other actions need to be performed, including forensic examination of additional data sources, securing identified vulnerabilities and improving existing security controls. Recommend improvements to policies, guidelines, procedures, tools and other aspects of the forensic process.
 | Reproduced with permission from Computer Desktop Encyclopedia. Copyright (c) 1981-2008 The Computer Language Company Inc. All rights reserved. |
Additional Resources
- R.I.P. Apple matte screen displays
- The thing that bums me out the most about yesterday's MacBook announcements is Apple's move to all-glossy displays. I'll make no bones about it – I loathe glossy displays – especially on a notebook computer. Apple will spin it that blacks look darker and colors...
- Blog posts 2008-10-15
- ManageFusion 2008
- I'm sitting in the media workroom preparing for today's sessions at Symantec's ManageFusion 2008. The event is being held at the JW Marriott resort and conference center in the land of the Mouse, that is Orlando, FL. I'll be adding things to this post throughout the day as interesting things...
- Blog posts 2008-10-15
- The Future looks very Cloudy
- I've just attended the one day, highly-focused executive 'Cloud Summit' conference. The Cloud—used to describe everything from internet-based computing utilities to Software as a Service — was examined and its future impact explored within the highly appropriate venue of the Silicon Valley Computer History Museum. ...
- Blog posts 2008-10-14
- OLPC and Intel trumped by small-scale virtualization
- I had planned for my next post to be a followup to my interview with Sun's Joe Hartley, but it's going to have to take a back seat to a story about small-scale virtualization in the 1:1 computing market. Maybe, though, this particular story suggests that Sun is headed...
- Blog posts 2008-10-14
- Child predators apparently don't use Gmail
- A few years ago, a piece of popular legislation made its way past Illinois lawmakers (including Barack Obama, who voted in favor of it, as well as teacher unions, public health officials, etc.) offering comprehensive education to school children that, among other things, would have taught them to identify and...
- Blog posts 2008-10-14
- Fake Microsoft Patch Tuesday malware campaign spreading
- Fake Microsoft Patch Tuesday malware campaign spreadingowning a computerthese peeps whom click on the email should not be allow to own a computer. period until they go through security training for 1 year
- Discussion threads 2008-10-14
- Secunia: popular security suites failing to block exploits
- In a recently conducted comparative review, Danish security company Secunia, tested the detection rate of 12 different Internet Security Suites against 300 exploits (144 malicious files and 156 malicious web pages) affecting popular end user applications, to find that even the top performer in the test is in fact performing...
- Blog posts 2008-10-14
- New notebooks: What Apple didn't announce
- New notebooks: What Apple didn't announceWhile I don't completely disagree...[i]...Now why they couldn't keep the last-gen white MacBook and put an $800 price tag on it...[/i]They did keep the last-gen white MacBook... but only dropped the price $100, not $300.I admit to being confused about the 17" model myself, but...
- Discussion threads 2008-10-14
- More on Apple's new Mini DisplayPort
- More on Apple's new Mini DisplayPortDisplayPort is fine...but include the VGA port too so we don't have to carry around an extra cord....duh. It doesn't take up much space and EVERY windows laptop has a VGA port.30"!It's nice that it finally works with 30" even on MacBook (non-Pro).I just...
- Discussion threads 2008-10-14
- IT's challenges: The end of device charging; ROI; Super programmers
- Gartner on Tuesday outlined its grand IT challenges from 2008 to 2033 and it includes a world where you'll never have to charge your device. That was one of the futurama type predictions outlined by Gartner analyst Ken McGhee at the firm's Symposium ITxpo. These prediction presentations...
- Blog posts 2008-10-14
- More on Apple's new Mini DisplayPort (updated)
- One of the announcements coming out of Cupertino is that their MacBooks now ship with a new video out port called the Mini DisplayPort complete with funny capitalization and lack of space between the words. It means that you'll have to remember to bring a US$30 dongle/adapter with...
- Blog posts 2008-10-14
- Jobs: “Blu-ray is just a bag of hurtâ€�
- Jobs: “Blu-ray is just a bag of hurtâ€�I get the feeling that Apple is worried thatif they placed a Blu-Ray disc into the unit that it would cut down on rentals thru iTunes.In that case it would appear that Blu-Ray has little need of Apple.Care to back that up?[i]I get...
- Discussion threads 2008-10-14
- 'I'm a PC. A $999 MacBook still doesn't tempt me' (or does it?)
- 'I'm a PC. A $999 MacBook still doesn't tempt me' (or does it?)MS will have nothing exciting on the OS front for Christmas this year.If you want to do something exciting, you will have to buy a Mac. And, it only gets worse for MS on the MID/NetBook front. That...
- Discussion threads 2008-10-14
- New notebooks: What Apple didn't announce
- While Apple delivered a lot of new features in the new MacBooks today (glass trackpads, unibody contruction) and they also removed one – Firewire from the MacBook. There are some other key features that that were rumored to arrive in Apple's new notebooks that just didn't pan out. ...
- Blog posts 2008-10-14
- Apple's new MacBook line: Affordable enough?
- Apple's new MacBook line: Affordable enough?What are the specsI haven't seen the specs yet (are they published?) but I don't think it's going to be enough. They either need to compete with Windows PC's or not. Don't half ass it. My guess is the lower price will still not match...
- Discussion threads 2008-10-14
- MacBooks: out with the old, in with the new
- MacBooks: out with the old, in with the newMulti-touch trackpad: gimmick or useful feature?The thought of having to use gestures with 4 fingers on a small trackpad as opposed to a touch screen display sounds absolutely nightmarish in terms of UI usefulness. Multi-touch on the iPhone is a total joke...
- Discussion threads 2008-10-14
- LiveBlog: Apple's notebook event
- LiveBlog: Apple's notebook eventThat Jobs fellow always looking out for us![i]Jobs said the licensing for Blu-Ray technology is still too complex to burden customers with the costs associated with it.[/i]Thanks Jobs! I'll be thinking of you while watching Blu-Ray movies on my HTPC Vista machine that cost me ~$60...
- Discussion threads 2008-10-14
- Highlights from the Apple notebook event
- Highlights from the Apple notebook event at Apple headquarters in Cupertino.Steve Jobs takes that stage and introduces Tim Cook who discusses Apple's 2-3x the market growth, Vista and their retail successes. US retail market share grows from single digits to 17.6% From 15 -...
- Blog posts 2008-10-14
- NVIDIA problems spread to desktop PCs
- NVIDIA problems spread to desktop PCs8600GTa couple of months ago, I bought 2 8600GT cards to build an SLI system. One of these failed within 1 month. It was Gigabyte card and they did replace it, however, I have since upgraded to the 8800GT with 1GB memory to avoid problems.RE:...
- Discussion threads 2008-10-14
- Lessig: Five proposals for ending copyright wars
- The Wall Street Journal is running an excerpt from Larry Lessig's upcoming book, Remix (book party in SF, Oct. 29.) In this excerpt, Lessig tells the story of Stephanie Lenz, who taped her infant child with some Prince song playing in the background and uploaded the...
- Blog posts 2008-10-14
Neighboring Terms
Premier Vendor Content Whitepapers, webcasts & resources from our Power Center Sponsors
Fusion
- There’s a new energy coming from the people of AMD. Its the power of Fusion.
- Learn about the power of fusion at work and the industry-changing impact of accelerated computing.
-
- View AMD video, case studies, blogs, forums, and more on ZDNet »
-
