Introduction |
|
xvii | |
|
Part 1 Understanding and Exploiting Windows Networks |
|
|
1 | (156) |
|
Chapter 1 Network Investigation Overview |
|
|
3 | (22) |
|
Performing the Initial Vetting |
|
|
3 | (2) |
|
Meeting with the Victim Organization |
|
|
5 | (7) |
|
Understanding the Victim Network Information |
|
|
6 | (2) |
|
Understanding the Incident |
|
|
8 | (1) |
|
Identifying and Preserving Evidence |
|
|
9 | (2) |
|
Establishing Expectations and Responsibilities |
|
|
11 | (1) |
|
|
12 | (3) |
|
|
15 | (3) |
|
Analyzing the Suspect's Computers |
|
|
18 | (3) |
|
Recognizing the Investigative Challenges of Microsoft Networks |
|
|
21 | (1) |
|
|
22 | (3) |
|
Chapter 2 The Microsoft Network Structure |
|
|
25 | (38) |
|
|
25 | (2) |
|
|
27 | (8) |
|
|
29 | (5) |
|
|
34 | (1) |
|
|
35 | (9) |
|
|
36 | (4) |
|
|
40 | (4) |
|
|
44 | (8) |
|
|
45 | (3) |
|
|
48 | (2) |
|
Reconciling Share and File Permissions |
|
|
50 | (2) |
|
|
52 | (9) |
|
|
61 | (2) |
|
Chapter 3 Beyond the Windows GUI |
|
|
63 | (22) |
|
Understanding Programs, Processes, and Threads |
|
|
64 | (3) |
|
|
67 | (11) |
|
|
70 | (4) |
|
|
74 | (4) |
|
Maintaining Order Using Privilege Modes |
|
|
78 | (2) |
|
|
80 | (3) |
|
|
83 | (2) |
|
Chapter 4 Windows Password Issues |
|
|
85 | (52) |
|
Understanding Windows Password Storage |
|
|
85 | (3) |
|
Cracking Windows Passwords Stored on Running Systems |
|
|
88 | (10) |
|
Exploring Windows Authentication Mechanisms |
|
|
98 | (13) |
|
|
99 | (4) |
|
|
103 | (5) |
|
|
108 | (3) |
|
Sniffing and Cracking Windows Authentication Exchanges |
|
|
111 | (10) |
|
Using ScoopLM and BeatLM to Crack Passwords |
|
|
114 | (7) |
|
Cracking Offline Passwords |
|
|
121 | (13) |
|
Using Cain & Abel to Extract Windows Password Hashes |
|
|
122 | (4) |
|
Accessing Passwords through the Windows Password Verifier |
|
|
126 | (1) |
|
Extracting Password Hashes from RAM |
|
|
127 | (1) |
|
Stealing Credentials from a Running System |
|
|
128 | (6) |
|
|
134 | (3) |
|
Chapter 5 Windows Ports and Services |
|
|
137 | (20) |
|
|
137 | (5) |
|
|
142 | (7) |
|
Understanding Windows Services |
|
|
149 | (6) |
|
|
155 | (2) |
|
Part 2 Analyzing the Computer |
|
|
157 | (192) |
|
Chapter 6 Live-Analysis Techniques |
|
|
159 | (20) |
|
Finding Evidence in Memory |
|
|
159 | (2) |
|
Creating a Windows Live-Analysis Toolkit |
|
|
161 | (12) |
|
Using Dumpit to Acquire RAM from a 64-Bit Windows 7 System |
|
|
164 | (2) |
|
Using WinEn to Acquire RAM from a Windows 7 Environment |
|
|
166 | (1) |
|
Using FTK Imager Lite to Acquire RAM from Windows Server 2008 |
|
|
167 | (2) |
|
Using Volatility 2.0 to Analyze a Windows 7 32-Bit RAM Image |
|
|
169 | (4) |
|
Monitoring Communication with the Victim Box |
|
|
173 | (3) |
|
Scanning the Victim System |
|
|
176 | (2) |
|
|
178 | (1) |
|
Chapter 7 Windows Filesystems |
|
|
179 | (36) |
|
Filesystems vs. Operating Systems |
|
|
179 | (4) |
|
Understanding FAT Filesystems |
|
|
183 | (15) |
|
Understanding NTFS Filesystems |
|
|
198 | (10) |
|
Using NTFS Data Structures |
|
|
198 | (7) |
|
Creating, Deleting, and Recovering Data in NTFS |
|
|
205 | (3) |
|
Dealing with Alternate Data Streams |
|
|
208 | (4) |
|
|
212 | (1) |
|
|
213 | (2) |
|
Chapter 8 The Registry Structure |
|
|
215 | (42) |
|
Understanding Registry Concepts |
|
|
215 | (13) |
|
|
217 | (1) |
|
Registry Organization and Terminology |
|
|
217 | (11) |
|
Performing Registry Research |
|
|
228 | (4) |
|
Viewing the Registry with Forensic Tools |
|
|
232 | (2) |
|
Using EnCase to View the Registry |
|
|
234 | (12) |
|
Examining Information Manually |
|
|
234 | (2) |
|
Using EnScripts to Extract Information |
|
|
236 | (10) |
|
Using AccessData's Registry Viewer |
|
|
246 | (5) |
|
|
251 | (3) |
|
|
254 | (3) |
|
Chapter 9 Registry Evidence |
|
|
257 | (68) |
|
Finding Information in the Software Key |
|
|
258 | (9) |
|
|
258 | (6) |
|
|
264 | (1) |
|
|
265 | (2) |
|
Exploring Windows Security, Action Center, and Firewall Settings |
|
|
267 | (9) |
|
Analyzing Restore Point Registry Settings |
|
|
276 | (4) |
|
Windows XP Restore Point Content |
|
|
280 | (4) |
|
Analyzing Volume Shadow Copies for Registry Settings |
|
|
284 | (6) |
|
Exploring Security Identifiers |
|
|
290 | (5) |
|
Examining the Recycle Bin |
|
|
291 | (2) |
|
Examining the ProfileList Registry Key |
|
|
293 | (2) |
|
Investigating User Activity |
|
|
295 | (10) |
|
Examining the PSSP and IntelliForms Keys |
|
|
295 | (1) |
|
|
296 | (2) |
|
Examining the RecentDocs Key |
|
|
298 | (1) |
|
Examining the TypedURLs Key |
|
|
298 | (1) |
|
Examining the UserAssist Key |
|
|
299 | (6) |
|
|
305 | (2) |
|
Using Cain & Abel to Extract LSA Secrets from Your Local Machine |
|
|
306 | (1) |
|
|
307 | (5) |
|
|
307 | (2) |
|
Getting More Information from the GUID-Named Interface |
|
|
309 | (3) |
|
Compensating for Time Zone Offsets |
|
|
312 | (1) |
|
Determining the Startup Locations |
|
|
313 | (9) |
|
Exploring the User Profile Areas |
|
|
316 | (2) |
|
|
318 | (1) |
|
Exploring Scheduled Tasks |
|
|
318 | (2) |
|
Exploring the AppInit_DLL Key |
|
|
320 | (1) |
|
Using EnCase and Registry Viewer |
|
|
320 | (1) |
|
Using Autoruns to Determine Startups |
|
|
320 | (2) |
|
|
322 | (3) |
|
Chapter 10 Introduction to Malware |
|
|
325 | (24) |
|
Understanding the Purpose of Malware Analysis |
|
|
325 | (4) |
|
Malware Analysis Tools and Techniques |
|
|
329 | (19) |
|
Constructing an Effective Malware Analysis Toolkit |
|
|
329 | (2) |
|
|
331 | (7) |
|
Monitoring Malicious Code |
|
|
338 | (8) |
|
Monitoring Malware Network Traffic |
|
|
346 | (2) |
|
|
348 | (1) |
|
Part 3 Analyzing the Logs |
|
|
349 | (188) |
|
Chapter 11 Text-Based Logs |
|
|
351 | (30) |
|
|
351 | (11) |
|
|
362 | (7) |
|
|
369 | (4) |
|
Parsing Windows Firewall Logs |
|
|
373 | (3) |
|
|
376 | (3) |
|
|
379 | (2) |
|
Chapter 12 Windows Event Logs |
|
|
381 | (38) |
|
Understanding the Event Logs |
|
|
381 | (10) |
|
Exploring Auditing Settings |
|
|
384 | (7) |
|
|
391 | (20) |
|
Opening and Saving Event Logs |
|
|
403 | (4) |
|
|
407 | (4) |
|
Searching with Event Viewer |
|
|
411 | (7) |
|
|
418 | (1) |
|
Chapter 13 Logon and Account Logon Events |
|
|
419 | (44) |
|
|
419 | (43) |
|
Comparing Logon and Account Logon Events |
|
|
420 | (2) |
|
Analyzing Windows 2003/2008 Logon Events |
|
|
422 | (11) |
|
Examining Windows 2003/2008 Account Logon Events |
|
|
433 | (29) |
|
|
462 | (1) |
|
Chapter 14 Other Audit Events |
|
|
463 | (42) |
|
The Exploitation of a Network |
|
|
463 | (3) |
|
Examining System Log Entries |
|
|
466 | (7) |
|
Examining Application Log Entries |
|
|
473 | (1) |
|
Evaluating Account Management Events |
|
|
473 | (17) |
|
Interpreting File and Other Object Access Events |
|
|
490 | (10) |
|
Examining Audit Policy Change Events |
|
|
500 | (3) |
|
|
503 | (2) |
|
Chapter 15 Forensic Analysis of Event Logs |
|
|
505 | (32) |
|
Windows Event Log Files Internals |
|
|
505 | (19) |
|
Windows Vista/7/2008 Event Logs |
|
|
505 | (8) |
|
Windows XP/2003 Event Logs |
|
|
513 | (11) |
|
Repairing Windows XP/2003 Corrupted Event Log Databases |
|
|
524 | (3) |
|
Finding and Recovering Event Logs from Free Space |
|
|
527 | (9) |
|
|
536 | (1) |
|
Part 4 Results, the Cloud, and Virtualization |
|
|
537 | (60) |
|
Chapter 16 Presenting the Results |
|
|
539 | (26) |
|
|
539 | (3) |
|
Creating a Narrative Report with Hyperlinks |
|
|
542 | (8) |
|
|
543 | (3) |
|
Creating and Linking Bookmarks |
|
|
546 | (4) |
|
The Electronic Report Files |
|
|
550 | (2) |
|
|
552 | (8) |
|
|
552 | (3) |
|
|
555 | (5) |
|
Testifying about Technical Matters |
|
|
560 | (2) |
|
|
562 | (3) |
|
Chapter 17 The Challenges of Cloud Computing and Virtualization |
|
|
565 | (32) |
|
|
566 | (3) |
|
|
569 | (2) |
|
Preparing for Incident Response in Virtual Space |
|
|
571 | (4) |
|
Forensic Analysis Techniques |
|
|
575 | (12) |
|
Dead Host-Based Virtual Environment |
|
|
576 | (8) |
|
|
584 | (2) |
|
|
586 | (1) |
|
|
587 | (8) |
|
|
587 | (1) |
|
|
588 | (1) |
|
|
589 | (1) |
|
|
589 | (6) |
|
|
595 | (2) |
|
|
597 | (2) |
|
Appendix A The Bottom Line |
|
|
599 | (34) |
|
Chapter 1 Network Investigation Overview |
|
|
599 | (2) |
|
Chapter 2 The Microsoft Network Structure |
|
|
601 | (1) |
|
Chapter 3 Beyond the Windows GUI |
|
|
602 | (2) |
|
Chapter 4 Windows Password Issues |
|
|
604 | (2) |
|
Chapter 5 Windows Ports and Services |
|
|
606 | (2) |
|
Chapter 6 Live-Analysis Techniques |
|
|
608 | (1) |
|
Chapter 7 Windows Filesystems |
|
|
609 | (2) |
|
Chapter 8 The Registry Structure |
|
|
611 | (2) |
|
Chapter 9 Registry Evidence |
|
|
613 | (5) |
|
Chapter 10 Introduction to Malware |
|
|
618 | (2) |
|
Chapter 11 Text-based Logs |
|
|
620 | (2) |
|
Chapter 12 Windows Event Logs |
|
|
622 | (1) |
|
Chapter 13 Logon and Account Logon Events |
|
|
623 | (1) |
|
Chapter 14 Other Audit Events |
|
|
624 | (2) |
|
Chapter 15 Forensic Analysis of Event Logs |
|
|
626 | (2) |
|
Chapter 16 Presenting the Results |
|
|
628 | (2) |
|
Chapter 17 The Challenges of Cloud Computing and Virtualization |
|
|
630 | (3) |
|
Appendix B Test Environments |
|
|
633 | (14) |
|
|
633 | (2) |
|
|
635 | (1) |
|
Setting Up Test Environments in Training Laboratories |
|
|
636 | (11) |
|
Chapter 1 Network Investigation Overview |
|
|
636 | (1) |
|
Chapter 2 The Microsoft Network Structure |
|
|
636 | (1) |
|
Chapter 3 Beyond the Windows GUI |
|
|
637 | (1) |
|
Chapter 4 Windows Password Issues |
|
|
637 | (2) |
|
Chapter 5 Windows Ports and Services |
|
|
639 | (1) |
|
Chapter 6 Live-Analysis Techniques |
|
|
639 | (1) |
|
Chapter 7 Windows Filesystems |
|
|
640 | (1) |
|
Chapter 8 The Registry Structure |
|
|
640 | (2) |
|
Chapter 9 Registry Evidence |
|
|
642 | (1) |
|
Chapter 10 Introduction to Malware |
|
|
643 | (1) |
|
Chapter 11 Text-Based Logs |
|
|
643 | (1) |
|
Chapter 12 Windows Event Logs |
|
|
644 | (1) |
|
Chapter 13 Logon and Account Logon Events |
|
|
644 | (1) |
|
Chapter 14 Other Audit Events |
|
|
644 | (1) |
|
Chapter 15 Forensic Analysis of Event Logs |
|
|
645 | (1) |
|
Chapter 16 Presenting the Results |
|
|
645 | (1) |
|
Chapter 17 The Challenges of Cloud Computing and Virtualization |
|
|
645 | (2) |
Index |
|
647 | |