The primary objective of incident forensics for an organization is to answer the following questions:
- Is the host infected with a malicious program?
- How did the host get infected?
- What can be improved to avoid the infection?
The NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response defines four major phases to perform digital forensics on a compromised computer:
- Collection: Collect all the relevant logs of the compromised computer or networking activities logs
- Examination: Extract and correlate the information that may highly relate to suspicious behaviors
- Analysis: Analyze all the information for root causes of the malicious infection
- Reporting: Conclude the summary results
The forensics techniques require the capability of the incident response team to perform the analysis. In the following table, we have listed some...