Chapter 1, Introduction to Digital Forensics, gives an introduction to the various aspects of the science of digital forensics.

Chapter 2, Installing Kali Linux, shows how to we install, configure, and update Kali Linux. The installation process will be followed on both physical and virtual machines to the benefit of users with both single and multiple machines for running Kali Linux. Once installed, we explore the Forensics menu in Kali Linux.

Chapter 3, Understanding Filesystems and Storage Media, dives into the realm of operating systems and the various formats for file storage, including secret hiding places not seen by the end user or even the operating system. We also inspect data about the data, known as metadata, and look at its volatility.

Chapter 4, Incident Response and Data Acquisition, asks what happens when an incident is reported or detected? Who are the first responders and what are the procedures for maintaining the integrity of the evidence? In this chapter, we look at best practices and procedures in data acquisition and evidence collection.

Chapter 5, Evidence Acquisition and Preservation with DC3DD and Guymager, focuses on one of the most important aspects of forensic acquisition. Learn to create forensic images of data and maintain integrity using hashing tools.

Chapter 6, File Recovery and Data Carving with Foremost, Scalpel, and Bulk Extractor, states that data disappears, whether accidentally, intentionally, or just hidden from plain sight and the operating system. In this chapter, we look at two powerful tools used to perform file recovery and learn about advanced search features.

Chapter 7, Memory Forensics with Volatility, states that in today's digital world we sometimes encounter scenarios that require the use of live memory forensics. Learn to use this powerful memory forensics tool to view running processes, programs, and live artifacts.

Chapter 8, Autopsy – The Sleuth Kit, introduces Autopsy which is recognized as one of the very few available tools to rival commercial forensic tools, this powerful tool takes forensic abilities and investigations to a professional level, catering for all aspects of full digital forensics investigations from hashing to reporting.

Chapter 9, Network and Internet Capture Analysis with Xplico, investigates and analyzes captured network and internet traffic using this powerful tool.

Chapter 10, Revealing Evidence Using DFF, shows how two tools are better than one. Use another advanced forensic framework tool to carry out full and professional digital forensics investigations, ensuring the integrity of your findings by comparing the results found.

To follow the exercises in this book, readers will need to download the following:

This book is intended for network, systems, and security administrators; information security officers; auditors; IT managers; and also students, researchers, security enthusiasts, and anyone interested in the field of digital forensics or interested in learning about specific tools for various stages of investigations, from evidence acquisition and preservation to analysis, using powerful forensic suites.

In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning. Code words in the text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "To begin installing DFF, we first need to update the sources.list with the repository used in Kali Sana."

A block of code is set as follows:

deb http://http.kali.org/kali kali-rolling main contrib non-free
deb src http://http.kali.org/kali kali-rolling main contrib non-free
deb http://http.kali.org/kali sana main contrib 

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

deb http://http.kali.org/kali kali-rolling main contrib non-free
deb src http://http.kali.org/kali kali-rolling main contrib non-free
deb http://http.kali.org/kali sana main contrib 

Any command-line input or output is written as follows:

dc3dd if=/dev/sdb hash=sha1 log=dd_split_usb ofsz=500M ofs=split_test_usb.img.ooo

New terms and important words are shown in bold.

Feedback from our readers is always welcome. Let us know what you think about this book-what you liked or disliked. Reader feedback is important to us as it helps us develop titles that you will really get the most out of. To send us general feedback, simply email [email protected], and mention the book's title in the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.