Linux Forensics - Softcover

Philip Polstra

Softcover

ISBN 10: 1515037630 ISBN 13: 9781515037637

Publisher: CreateSpace Independent Publishing Platform, 2015

Synopsis

Linux Forensics is the most comprehensive and up-to-date resource for those wishing to quickly and efficiently perform forensics on Linux systems. It is also a great asset for anyone that would like to better understand Linux internals.

Linux Forensics will guide you step by step through the process of investigating a computer running Linux. Everything you need to know from the moment you receive the call from someone who thinks they have been attacked until the final report is written is covered in this book. All of the tools discussed in this book are free and most are also open source.

Dr. Philip Polstra shows how to leverage numerous tools such as Python, shell scripting, and MySQL to quickly, easily, and accurately analyze Linux systems. While readers will have a strong grasp of Python and shell scripting by the time they complete this book, no prior knowledge of either of these scripting languages is assumed. Linux Forensics begins by showing you how to determine if there was an incident with minimally invasive techniques. Once it appears likely that an incident has occurred, Dr. Polstra shows you how to collect data from a live system before shutting it down for the creation of filesystem images.

Linux Forensics contains extensive coverage of Linux ext2, ext3, and ext4 filesystems. A large collection of Python and shell scripts for creating, mounting, and analyzing filesystem images are presented in this book. Dr. Polstra introduces readers to the exciting new field of memory analysis using the Volatility framework. Discussions of advanced attacks and malware analysis round out the book.

Book Highlights

• 370 pages in large, easy-to-read 8.5 x 11 inch format
• Over 9000 lines of Python scripts with explanations
• Over 800 lines of shell scripts with explanations
• A 102 page chapter containing up-to-date information on the ext4 filesystem
• Two scenarios described in detail with images available from the book website
• All scripts and other support files are available from the book website

Chapter Contents

1. First Steps
   • General Principles
   • Phases of Investigation
   • High-level Process
   • Building a Toolkit
2. Determining If There Was an Incident
   • Opening a Case
   • Talking to Users
   • Documenation
   • Mounting Known-good Binaries
   • Minimizing Disturbance to the Subject
   • Automation With Scripting
3. Live Analysis
   • Getting Metadata
   • Using Spreadsheets
   • Getting Command Histories
   • Getting Logs
   • Using Hashes
   • Dumping RAM
4. Creating Images
   • Shutting Down the System
   • Image Formats
   • DD
   • DCFLDD
   • Write Blocking
   • Imaging Virtual Machines
   • Imaging Physical Drives
5. Mounting Images
   • Master Boot Record Based Partions
   • GUID Partition Tables
   • Mounting Partitions In Linux
   • Automating With Python
6. Analyzing Mounted Images
   • Getting Timestamps
   • Using LibreOffice
   • Using MySQL
   • Creating Timelines
7. Extended Filesystems
   • Basics
   • Superblocks
   • Features
   • Using Python
   • Finding Things That Are Out Of Place
   • Inodes
   • Journaling
8. Memory Analysis
   • Volatility
   • Creating Profiles
   • Linux Commands
9. Dealing With More Advanced Attackers
10. Malware
    • Is It Malware?
    • Malware Analysis Tools
    • Static Analysis
    • Dynamic Analysis
    • Obfuscation
11. The Road Ahead
    • Learning More
    • Communities
    • Conferences
    • Certifications

About this title

From the Author

Linux Forensics is the most up-to-date and comprehensive book on performing Linux forensics period.  It has been a real labor of love to produce such a complete book.  If you ever think you might need to investigate a Linux system or just want to learn more about how Linux works under the covers, this book is for you.  This book will also have you well on your way to performing forensic investigations of other systems (Windows, OS X) from a Linux forensics workstation.

While there are over 9000 lines of Python and 800 lines of shell script in this book, I make no assumptions about the readers expertise in these scripting languages.  In other words, in addition to being a book on forensics this book is also a good primer on Python and bash scripting.  By the time you finish this book you will know how Linux systems work, how to investigate them, and also how to automate tedious tasks with Python and shell scripts.
The 102 page chapter of current and comprehensive information concerning the ext4 filesystem makes the book a must have all on its own.  The other chapters on live response, filesystem analysis, memory analysis with Volatility, image creation, advanced attacks, and malware further solidify the must-have status of this book.

See for yourself why readers are saying "Dr. Phil covers all the topics in a lot of detail and talks about automating stuff with Python. This is really helpful as this allows to automate a lot of mundane and painful tasks, which would otherwise take a lot of time. I've already recommended this to my colleagues at work and have ordered more now from Amazon for them." - WiFi Hacker

From the Back Cover

A practical guide to performing forensic investigations on Linux systems.
Linux Forensics will guide you step by step through the process of investigating a computer running Linux. Everything you need to know from the moment you receive the call from a client who thinks they have been attacked until the final report is written is covered in this book. All of the tools discussed in this book are free and most are also open source.
Dr. Philip Polstra shows how to leverage numerous tools such as Python, shell scripting, and MySQL to quickly, easily, and accurately analyze Linux systems. Linux Forensics begins by showing you how to determine if there was an incident with minimally invasive techniques. Once it appears likely that an incident has occurred, Dr. Polstra shows you how to collect data from a live system before shutting it down for the creation of filesystem images.
Linux Forensics contains extensive coverage of Linux ext2, ext3, and ext4 filesystems. A large collection of Python and shell scripts for creating, mounting, and analyzing filesystem images are presented in this book. Dr. Polstra introduces readers to the exciting new field of memory analysis using the Volatility framework. Discussions of advanced attacks and malware analysis round out the book.

Edition details

• Publisher: CreateSpace Independent Publishing Platform
• Publication date: 2015
• ISBN 10: 1515037630
• ISBN 13: 9781515037637
• Binding: Paperback
• Language: English
• Number of pages: 370