Review of Windows Forensic Analysis and Windows Registry Forensics

  

     Both "Windows Forensic Analysis (Third Edition)" and "Windows Registry Forensics" are authored by Harlan Carvey and he is the author of a few other books regarding digital forensics.  This will be a short review of both books.  I really enjoyed both of these books.  If you've ever read anything from Harlan, his writing style is very easy to follow and understand.  Each book is laid out in a manner that makes sense as far as being applied practically.

     Windows Forensic Analysis is the third installment to Harlan's Windows forensics books; however, as he says in the intro you should think of it as a companion to the second edition rather than a re-write replacement. This book includes all the latest and greatest information from the latest Windows 7 release.  Things like volume shadow copies, application analysis, and a summary of registry analysis provide great insight on Windows Artifacts.  Chapters on malware detection and timeline analysis are especially exceptionable.

      Windows Registry Forensics, I like to think of it, is an extension to Windows Forensic Analysis books.  The Windows registry is a treasure trove of evidence for analysis.  Registry forensics does an excellent job of not only outlining most of the artifacts that are known about, but gives you a background on available tools that can be used to analyze these artifacts.  The case studies are especially helpful in relating the discussed artifacts to practical experience.

      Both books are fantastic, and I would highly suggest adding them to your digital forensics library and put them next to at least the second edition of Windows Forensic Analysis.  Honestly, I feel like all three books should be considered one big compendium on Windows digital forensics.  I would also say that, at this point, there isn't a better collection of material on the subject of Windows analysis.  If possible, I would recommend setting up a lab with various Windows machines so you can test and play with all of the artifacts you will learn about.  Also, that will give you a chance to install the various tools mentioned in the text and test them out for yourself.

Review of Digital Evidence and Computer Crime

            Just finished “Digital Evidence and Computer Crime:  Forensic Science, Computers and the Internet” by Eoghan Casey and featuring other contributing authors, and it’s quite good.  I bought this book because I wanted an all-encompassing book that provided insight on the various aspects of an investigation, especially the legal portion.  And in this aspect the book does an excellent job, and is in-depth in area’s I have yet to see in other books.  The book is divided into five portions digital forensics, digital investigations, apprehending offenders, computers and network forensics.  For me the book was worth it for the first three portions; however, the computers and network portions, while a good start, there are more in-depth books that provide better insight. 

            Part I: Digital Forensics, was one of my favorite parts of the book.  It provides the reader with a good background on where digital forensics comes from and how it has evolved.  It details the role of the investigator in a case and the complications with digital evidence (the portion applying to levels of certainty was very enlightening).  I really enjoyed the portions of the book relating to both US and European law.  This was an aspect I was looking to learn more about and the book provides a great overview while outlining the specific important parts of popular cyber law. 

            Part II:  Digital Investigions, is all about the process.  Casey does a good job of applying the tradition scientific method to the digital forefront.  Applying it in this way it provides an easy to apply method to the investigative process.  Not focusing on the specifics but more the outline of the thought process, which allows you to go beyond knowing the specifics.  Methods for conducting investigations, handling crime scenes and reconstruction are discussed, as well as, going into motives.

            Part III:  Apprehending Offenders, was rather unexpected when I looked through the table of contents and even more so when I read the chapters.  However, in this case unexpected was excellent.  Various scenarios of need of investigation are discussed like cyber stalking and computer intrusions, and then delve into the victimology of the scenarios.  This was really interesting to me, as it provides a psychological aspect to the investigative process; something I then realized can really help with an investigation.

            Part IV and V:  Computers and Networking are pretty much what I expected.  The computer portion really does give a great foundation of knowledge, and if this is one of your beginning journeys it’s a great place to start.  It does go over the background of important artifact information like file system structure, basics of file recovery, browser artifacts, and the registry.  It also provides good info on Unix and Mac systems.  The network portion is quite detailed describing the various layers of the network topology. There is a lot of great information in these chapters that was a great review of knowledge. 

            Overall, the book was enjoyable from start to finish and I would recommend it to anyone looking for a great overview of digital forensic investigation process from start to finish.   I am happy to add this book to my growing reference library.  

Coming Up:

So, I have a lot going on.  I have the following books to read (expect reviews):

• Windows Forensic Analysis 3rd Edition
• Practical Malware Analysis
• Digital Triage Forensics
• Windows Internals 6th Edition

I also have some research that I wish to share regarding File Tagging, with maybe a tool to follow eventually.  So look for that as well.  

Review of Metasploit: A Penetration Tester's Guide

     Metaspoit:  A Penetration Tester's Guide (MAPTG) from David Kennedy (@Dave_Rel1k), Jim O'Gorman (@_Elwood_), Devon Kearns (@dookie2000ca), and Mati Aharoni (@backtracklinux) is probably the foremost resource one can obtain for learning the basics of the Metasploit framework.  The book is for those behind the curve a little bit and haven't used Metasploit yet.  I feel like the book does a great job of delivering on what it promises, a foundation knowledge of the ins and outs of the great framework.  By the time you finish the book you should understand how to use the framework; you most likely will not understand all of it, but it gives you great information on how you can figure it out really through utilizing the many utilities within the tool.

     Let me start this review off by stating my personal opinion on how you should utilize this book:  build a test penetration lab and follow the books instructions as you go along.  Take advantage of the appendices!  Appendix A will tell you how to setup your test environments, both your attack machines and your victim machines.  Appendix B is your cheat sheet and quick reference for the numerous commands you'll be using.  I suggest starting here and just familiarize yourself here before you begin.  This is not what I did, but in retrospect I really wish I had.  

     The book doesn't waste time, after going into the basics of what will occur in a standard penetration test.  The authors state that this book is not the best source for understanding all that can occur in a Pen Test and refer to the Penetration Test Execution Standard as a better source of gaining better insight on the subject if you're looking for it.  Next the book cover's the basics of metasploit so you can get around the console with better familiarity, or options you have if you want more information.  These chapters are small and cover the essentials of what you'll need to know to get through the book if you have no prior knowledge about the tool.  The following chapters, which I will not cover in depth, go step-by-step through a basic Pen Test outline.  They start and information gathering and go all the way into creating your own exploits to automating your process with scripts within the framework.  

     Every chapter covers it's subject very well.  They're very concise and to the point, which I enjoy a whole lot.  Also, most of the chapters include examples of how to run the tools, and what output should look like (which is why I suggest you set up a lab environment and run the commands as your read them).  At times, I wish the chapters were a bit more in-depth, especially the creation of exploits chapter; however, that is probably a bit outside the scope of this particular book.  I especially enjoyed the chapters on creating exploits and the power of the Social-Engineering Toolkit.  The final chapter uniquely summarized what was learned in the book by explaining how to simulate a penetration test, and if completed properly will have you exploiting your vulnerable test lab in no time.  

     I highly would recommend this book to anyone who is looking to get into Metasploit a lot more.  It gives you a great base to learn the tool, and if nothing else spawn even more of a desire to learn more (I know it did for me).  I started this book with very base knowledge of the Metasploit framework, and after some testing and the guidance of this book I feel a lot more comfortable with using the amazing power behind Metasploit.  You can pick this book up for about $28 dollars on Amazon, this is an amazing value!  I would suggest if you even have an interest in penetration testing that you pick up this book and read it.

Road to CCE, Pt. 3: Review of Digital Forensics with Open Source Tools

     "Digital Forensics with Open Source Tools" (DFwOST), by Cory Altheide and Harlan Carvey is an excellent resource for a beginning forensics student I feel.  I am so happy that I decided to pick up this book, it has proven to be one of the best resources I now have.  This book reads extremely well, as the information it contains is concise and to the point.  DFwOST is certainly a value and I can see myself returning to it in the coming months.  

     As far as the content of the books is concerned, the authors provide a wealth of knowledge covering the basics of digital forensics.  The beginning chapter goes over what open source is and how its going to relate to the book.  The next chapter then discusses the differences in choosing a host operating system (mainly Windows vs Linux).  Chapters 3 through 8 analyze varying topics of digital forensics like file system analysis, points of analysis for varying operating systems, Internet artifacts, and file analysis.  These chapters hold a lot of information relating to the multiple points of interest in digital forensics; and while discussing the topics the authors provide the reader with examples of analysis with popular open source projects.  The final chapter then offers the reader insight into how to utilize the various discussed tools with better efficiency; as well as, the pros and cons of graphical user interfaces versus command line interfaces.  

     Overall, I feel like this is one of the best resources for learning about digital forensics because it provides great information along with practical knowledge of how to use the information.  It's easy enough to follow along with the reading while testing these tools with your own test lab.  The authors often provide easy to follow installation methods, which can often be valuable with dealing with some open source projects.  If you're looking to get into forensics more or even just learn about current open source projects going on in the forensics world I would recommend you go out and pick up this book.  I feel like this book helped me take the knowledge I've learned from other books I've discussed in this blog and transform it into practical knowledge as it's easy to get access to these tools and test them for myself without spending money (a plus for any college student).  

Road to CCE, Pt. II: Review of Windows Forensic Analysis 2E

“The key to forensic analysis isn’t pushing the button on an application user interface.  After all, as I’ve said time and time again, the age of Nintendo forensics is over!  The key to forensic analysis is understanding what artifacts are available to you and having a logical, reasoned, and comprehensive plan or process for collecting and interpreting data.”  These are the words of Harlan Carvey, the author of Windows Forensic Analysis (as well as other great titles).  Reading that quote within the final part of Carvey’s book really summed up what it was all about, for me.  Truly understanding what information that is available to us through thorough examination and not relying upon a tool, was really the underlying message I got from this book.  That message is spot on to me, and is the reason I picked up this book.  I did not want to become another ‘button monkey’ who had to rely on a program to perform an investigation.  Tools are great when you have the background knowledge necessary to understand what the application is doing in the background, and the value of the information it provides.  That being said this book is FANTASTIC; obviously with recommendations from Eric Huber, Rob Lee, and Richard Bejtlich this really didn’t need to be said.  

The first part (chapters 1, 2, and 3) of this book will cover the importance of live response to an incident.  It’ll give you examples of important places to look for and gather crucial data.  It will then give examples on how to analyze the data collected.  Chapter 3 delves into the truly fascinating world of memory forensics and how this portion of analysis should not be overlooked (memory holds a ton of information).  The next portion of the book goes into the various files that can be used in an investigation.  The fourth chapter of the book dives into the deep pool of information that the registry of a Windows system.  The fifth chapter covers the other various files that can be obtained, such as, event logs, browser history, and other numerous log files available on systems.  These chapters are very technical and provide a vast wealth of knowledge.  The next portion of the text goes over executable files and rootkits; which covers the interesting ways in which a program operates and then can be altered.  And the final portions of this book ‘ties it all together’ with great examples and providing ways to perform an investigation on the cheap (particularly interesting to me as a student).

This book is an excellent source of information if you’re interested in learning more about what a Windows computer has to offer to your investigation.  I will definitely be keeping this book around for all the great information it provides.  Carvey, not only provides a treasure of information but he provides data within the text so you can get a good look at what sort of information you’re going to want.  To go along with all the miscellaneous data sources, you’re provided with suggestions/recommendations on tools that can help you obtain and analyze that data.  On top of this there are also tips, notes, and warnings that can apply to the topic at hand that help put the provided material into better context.

To sum up, this book is a must for anyone interested in the topic, it reads like a dream for such a technically heavy text. 

____________________________________________________

With yet another book completed on my list of texts I wanted to finish, before moving to more of an intensive hands-on approach to learning forensics.  I will be finishing one last book (of which Harlan Carvey is a contributing author to along with Cory Altheide) before applying everything.  I will be reading Digital Forensics with Open Source Tools next for obvious reasons; with more hands on stuff next in what I want to do why not use open source tools?  I am a bit nervous as to the few “not for beginners” mentioned on the Amazon reviews, but I always like a challenge.  However, hopefully it will be as good as a companion to The Sleuth Kit as some reviews say, as well.  Look for a review in a few weeks!   

B-Sides Detroit Security Conference

B-Sides Detroit was this weekend, woke up early and headed out to Detroit with a couple of buddies for the con for the day.  Got there bright and early and I got really excited when I saw this:

The conference was being held in a semi-warehouse/studio apartment building and it was actually really cool.  Considering this conference is FREE, it wasn't a big deal and it actually added a nice bit of personality to the con.  I should mention for free you get the speakers, a super awesome t-shirt (see below), and lunch (at least the day I attended).

The quality of the speakers were kind of hit or miss for me.  All of them had prevalent information; however, I thought that the some of it was kind of basic and others were more technical (which peaks my interest a bit more.).  Again, this con was free and there were a lot of great enthusiastic people around to chat up and socialize with even on the conferences USTREAM.  The event was very low-key and didn't press any vendor products at you, which is always a plus.  To help pay for the event they had a nicely priced snack bar with some excellent beer to choose from.

Overall, I thought my B-Sides experience was amazing!  I would recommend that anyone check one out, as they host them all over the country and they're growing in popularity.  The environment promotes and encourages new ideas as enthusiastic security professionals gather to talk about the subject they hold a deep passion for.  This con had a personality all in its own and you can't help but like it.

________________________________________

A little background on my experience to gain perspective to my review.  As you can guess from reading this blog I am a undergrad student of 'Information Assurance' here in Michigan.  I have come to love the security field over the last year or two.  The only other conference I've attended was the Minnesota High Technology Crime Investigative Association conference a few months back.  I enjoyed that experience quite a bit, but as it was law enforcement centric it lacked the passion I found in Detroit. 

Road to CCE, Pt. I: Review of Handbook of Digital Forensics

                “Handbook of Digital Forensics and Investigation”, by Eoghan Casey is a fantastic read.  I had recently completed Brian Carrier’s, “File System Forensic Analysis,” (also an amazing book) and was looking for something a bit less in-depth and more of a general digital forensics book.  Luckily, I got a recommendation from Eric Huber over at the ‘A Fistful of Dongles’ blog for this book, as well as, a few others; you can read his review of the book at Amazon.  I really enjoyed this book a lot, and it was exactly what I was looking for; an overview of the wide variety of topics that encompass digital forensics.  Casey had accumulated a great text from a wide variety of contributing authors and put it in volume that will take you through common topics in digital forensics including anything from data gathering to embedded systems analysis.

            Casey begins with an introduction that included a brief of what the book will include and the basics of a forensic examination.  Chapter 2 covers the importance of tried and tested methodologies and some of the complications that arise that arise with digital forensics when gathering and maintaining forensically sound evidence.  The electronic discovery chapter includes an overview of what E-discovery is and what it includes and gives you a great look at how large an E-discovery can be both in examination and cost.  Chapter 4 discusses the use of forensics in incidence response, and the importance maintaining files rather than utilizing the “wipe and re-install” mentality. 

            Part 2 of the book breaks away into the nitty-gritty technical end of forensics, at least as much as it can as an intro level book.  Chapter 5 covers the Windows operating systems and what you’re going to want to look for in an investigation, a sort of areas of interest sort of thing and explaining what those files are.  The next chapters do the same thing with the other main operating systems, both UNIX/Linux and Macintosh systems.  Chapter 8, for me, was really interesting.  It goes over the type of methodologies that will be utilized in an embedded system investigation with things like chip-off techniques and such.  The next chapter discusses network investigations and will show you the types of things you can discover through analyzing network traffic in your investigation.  The final chapter will point out areas of interest to be found in mobile devices. 

            This book is great in that it points out key areas you should be looking for within an investigation.  I particularly loved the “From the Case Files:” sections that give you a real world example of where you would use this knowledge that you’re reading about.  Even more, I LOVED the “Practitioner’s Tip,” sections.  For me, as a student, getting these little tips from experienced forensicators are invaluable.  Those tips, to me, were the best part of the book and was the like cherry on top of a sundae.  I felt the book was very well done.  My one criticism were the amount of output files, sometimes they seemed a bit long but appreciate what they were trying to do with it.  Other than that I would recommend this book to anyone looking to get into the digital forensic field, like myself.

________________________________________

I chose this book to begin my road towards gaining my Certified Computer Examiner certification.  I hope to complete the certification by the end of the year.  Right now my plan includes reading the following:

• Handbook of Digital Forensics and Investigation by Eoghan Casey (Completed)
• File System Forensic Analysis by Brian Carrier (Completed)
• Windows Forensic Analysis by Harlan Carvey (In-Progress)
• Digital Forensics by Cory Altheide and Harlan Carvey

Open finishing these works, I plan on working on practical application.  So look for more on these books and possibly some examples from my practice sessions.  Any recommendations and comments are welcome.  Enjoy memorial day weekend! 

Review of "Social Engineering: The Art of Human Hacking"

“Social Engineering:  The Art of Human Hacking”, by Chris Hadnagy is arguably the best book of its kind.  Mitnick’s books were great reads and highly interesting; however, Chris went above and beyond telling a story and applied an amazing framework around the stories.  The framework implements somewhat of a scientific background to a multitude of techniques used by social engineers that allows for a whole new understanding of the inner workings of the topic.  The book is possibly the best insight one can gain on the dangers faced by security environments from these masters of manipulation. 

However, the book takes more of an objective look into the subject and can be appreciated from a wide variety of audiences; not just the security officers of a company.  Hadnagy’s discussion on communication, persuasion, and influence techniques and tactics can be enjoyed by anyone.  I found myself not enjoying this book as a security student trying to learn more about prevention and mitigation of a threat; but, enjoying it more as a learning experience on how I can use the topics discussed in the book to improve my communication ability.  I was able to use techniques in this book in a recent presentation and found that my communication effectiveness was greatly improved just by focusing on small details and choosing my wording better.  Chapters four, five, and six are great for these means; I found learning about micro-expressions and Neuro-Linguistic Programming particularly gripping.

If you are looking at getting this book for improving your security awareness and learning more about how to prevent yourself from these types of attacks, the book delivers these points as well.  The book provides several examples that allow you to analyze how these attacks are put into place and show you what to lookout for.  A look at a wide variety of tools social engineers can use in their attacks, by providing an overview of each tool and how they would be used.  Also, an entire chapter is dedicated on how to protect against these threats; and a plethora of tips are provided that Hadnagy has learned through his vast experience. 

I would recommend this book to anyone; as I mentioned, it can appeal to a wide audience and is a great purchase.

Interested in this topic?  Check out:

http://www.social-engineer.org/ 

Website the author of the book is a part of, as are many other great folks.  Newsletter is great, as well as, the podcast.


http://www.secmaniac.com/


Creator of Social Engineering Toolkit, Dave Kennedy's website.  Interesting Blog.