Book Image

Digital Forensics with Kali Linux - Third Edition

By : Shiva V. N. Parasram
Book Image

Digital Forensics with Kali Linux - Third Edition

By: Shiva V. N. Parasram

Overview of this book

Kali Linux is a Linux-based distribution that's widely used for penetration testing and digital forensics. This third edition is updated with real-world examples and detailed labs to help you take your investigation skills to the next level using powerful tools. This new edition will help you explore modern techniques for analysis, extraction, and reporting using advanced tools such as FTK Imager, Hex Editor, and Axiom. You’ll cover the basics and advanced areas of digital forensics within the world of modern forensics while delving into the domain of operating systems. As you advance through the chapters, you'll explore various formats for file storage, including secret hiding places unseen by the end user or even the operating system. You’ll also discover how to install Windows Emulator, Autopsy 4 in Kali, and how to use Nmap and NetDiscover to find device types and hosts on a network, along with creating forensic images of data and maintaining integrity using hashing tools. Finally, you'll cover advanced topics such as autopsies and acquiring investigation data from networks, memory, and operating systems. By the end of this digital forensics book, you'll have gained hands-on experience in implementing all the pillars of digital forensics: acquisition, extraction, analysis, and presentation – all using Kali Linux's cutting-edge tools.

Related Content you might be interested in

Current Title:

Small book image
Digital Forensics with Kali Linux - Third Edition
Shiva V. N. Parasram
Apr, 2023 | 414 pages
Small book image
Windows Forensics Analyst Field Guide
Muhiballah Mohammed
Oct, 2023 | 318 pages
Small book image
Digital Forensics and Incident Response.
Gerard Johansen
Dec, 2022 | 532 pages
Small book image
Kali Linux 2018: Assuring Security by Penetration Testing
Lee Allen | Alex Samm | Shakeel Ali | Gerard Johansen | Shiva V N Parasram | Damian Boodoo | Tedi Heriyanto
Oct, 2018 | 528 pages
Table of Contents (24 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Download the color images
Conventions used
Get in touch
Share Your Thoughts
Download a free PDF copy of this book
1
Part 1: Blue and Purple Teaming Fundamentals
Part 1: Blue and Purple Teaming Fundamentals
Free Chapter
2
Chapter 1: Red, Blue, and Purple Teaming Fundamentals
Chapter 1: Red, Blue, and Purple Teaming Fundamentals
How I got started with Kali Linux
What is Kali Linux?
Understanding red teaming
Understanding blue teaming
Understanding purple teaming
Summary
3
Chapter 2: Introduction to Digital Forensics
Chapter 2: Introduction to Digital Forensics
What is digital forensics?
The need for blue and purple teams
Digital forensics methodologies and frameworks
Comparison of digital forensics operating systems
The need for multiple forensics tools in digital investigations
Summary
4
Chapter 3: Installing Kali Linux
Chapter 3: Installing Kali Linux
Technical requirements
Downloading Kali Linux
Installing Kali Linux on portable storage media for 
live DFIR
Installing Kali as a standalone operating system
Installing Kali in VirtualBox
Installing Kali Linux on the virtual machine
Summary
5
Chapter 4: Additional Kali Installations and Post-Installation Tasks
Chapter 4: Additional Kali Installations and Post-Installation Tasks
Installing a pre-configured version of Kali Linux in VirtualBox
Installing Kali Linux on Raspberry Pi4
Updating Kali
Enabling the root user account in Kali
Adding the Kali Linux forensics metapackage
Summary
6
Chapter 5: Installing Wine in Kali Linux
Chapter 5: Installing Wine in Kali Linux
What Wine is and the advantages of using it in Kali Linux
Installing Wine
Testing our Wine installation
Summary
7
Part 2: Digital Forensics and Incident Response Fundamentals and Best Practices
Part 2: Digital Forensics and Incident Response Fundamentals and Best Practices
8
Chapter 6: Understanding File Systems and Storage
Chapter 6: Understanding File Systems and Storage
History and types of storage media
File systems and operating systems
Data types and states
Volatile and non-volatile data and the order of volatility
The importance of RAM, the paging file, and cache in DFIR
Summary
9
Chapter 7: Incident Response, Data Acquisitions, and DFIR Frameworks
Chapter 7: Incident Response, Data Acquisitions, and DFIR Frameworks
Evidence acquisition procedures
Incident response and first responders
Evidence collection and documentation
Live versus post-mortem acquisition
The CoC
The importance of write blockers
Data imaging and maintaining evidence integrity
Data acquisition best practices and DFIR frameworks
Summary
10
Part 3: Kali Linux Digital Forensics and Incident Response Tools
Part 3: Kali Linux Digital Forensics and Incident Response Tools
11
Chapter 8: Evidence Acquisition Tools
Chapter 8: Evidence Acquisition Tools
Using the fdisk command for partition recognition
Creating strong hashes for evidence integrity
Drive acquisition using DC3DD
Drive acquisition using DD
Drive acquisition using Guymager
Drive and memory acquisition using FTK Imager in Wine
RAM and paging file acquisition using Belkasoft RAM Capturer
Summary
12
Chapter 9: File Recovery and Data Carving Tools
Chapter 9: File Recovery and Data Carving Tools
File basics
Downloading the sample files
File recovery and data carving with Foremost
Image recovery with Magicrescue
Data carving with Scalpel
Data extraction with bulk_extractor
NTFS recovery using scrounge-ntfs
Image recovery using Recoverjpeg
Summary
13
Chapter 10: Memory Forensics and Analysis with Volatility 3
Chapter 10: Memory Forensics and Analysis with Volatility 3
What’s new in Volatility 3
Downloading sample memory dump files
Installing Volatility 3 in Kali Linux
Memory dump analysis using Volatility 3
Summary
14
Chapter 11: Artifact, Malware, and Ransomware Analysis
Chapter 11: Artifact, Malware, and Ransomware Analysis
Identifying devices and operating systems with p0f
Looking at the swap_digger tool to explore Linux artifacts
Password dumping with MimiPenguin
PDF malware analysis
Using Hybrid Analysis for malicious file analysis
Ransomware analysis using Volatility 3
Summary
15
Part 4: Automated Digital Forensics and Incident Response Suites
Part 4: Automated Digital Forensics and Incident Response Suites
16
Chapter 12: Autopsy Forensic Browser
Chapter 12: Autopsy Forensic Browser
Introduction to Autopsy – The Sleuth Kit
Downloading sample files for use and creating a case in the Autopsy browser
Evidence analysis using the Autopsy forensic browser
Summary
17
Chapter 13: Performing a Full DFIR Analysis with the Autopsy 4 GUI
Chapter 13: Performing a Full DFIR Analysis with the Autopsy 4 GUI
Autopsy 4 GUI features
Installing Autopsy 4 in Kali Linux using Wine
Downloading sample files for automated analysis
Creating new cases and getting acquainted with the Autopsy 4 interface
Analyzing directories and recovering deleted files and artifacts with Autopsy 4
Summary
18
Part 5: Network Forensic Analysis Tools
Part 5: Network Forensic Analysis Tools
19
Chapter 14: Network Discovery Tools
Chapter 14: Network Discovery Tools
Using netdiscover in Kali Linux to identify devices on a network
Using Nmap to find additional hosts and devices on a network
Using Nmap to fingerprint host details
Using Shodan.io to find IoT devices including firewalls, CCTV, and servers
Summary
20
Chapter 15: Packet Capture Analysis with Xplico
Chapter 15: Packet Capture Analysis with Xplico
Installing Xplico in Kali Linux
Installing DEFT Linux 8.1 in VirtualBox
Starting Xplico in DEFT Linux
Using Xplico to automatically analyze web, email, and voice traffic
Summary
21
Chapter 16: Network Forensic Analysis Tools
Chapter 16: Network Forensic Analysis Tools
Capturing packets using Wireshark
Packet analysis using NetworkMiner
Packet capture analysis with PcapXray
Online PCAP analysis using packettotal.com
Online PCAP analysis using apackets.com
Reporting and presentation
Summary
22
Index
Index
Why subscribe?
23
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share Your Thoughts
Download a free PDF copy of this book

Red, Blue, and Purple Teaming Fundamentals

Welcome to the third edition of Digital Forensics with Kali Linux, and for those of you who may have purchased the previous editions, welcome back. I’d also like to sincerely thank you for once again choosing this exciting title. As with the second edition, this third edition has been updated with new tools, easy-to-follow labs, and a couple of new chapters. We have an exciting journey ahead of us, and I’m pleased to announce the inclusion of some major additions, including the installation of Wine, which will allow us to run Windows tools within Kali Linux and will be covered in its entirety in Chapter 5, Installing Wine in Kali Linux. Chapter 10, Memory Forensics and Analysis with Volatility 3, is also brand-new and shows how to perform RAM artifact analysis on newer operating systems. Another new chapter on using the Autopsy v4 Graphical User Interface (GUI) to perform full Digital Forensics and Incident Response (DFIR) analysis and investigations can be found in Chapter 13, Performing a Full DFIR Analysis with the Autopsy 4 GUI.

Besides these major additions, we will also look at some new topics, such as creating a portable Kali Linux box using Raspberry Pi 4 and learning about tools such as DD-rescue, scrounge-ntfs, Magic Rescue, PDF-Parser, Timeliner, netdiscover, and introduce Shodan.io and apackets.com for Internet of Things (IoT) discovery and packet analysis.

For this book, we take a very structured approach to digital forensics, as we would in forensic science. First, we will stroll into the world of digital forensics, its history, and some of the tools and operating systems used for forensics, and we will immediately introduce you to the concepts involved in evidence preservation.

With that said, we have a lot to cover and will start by learning about Kali and the various cybersecurity teams and the differences between red, blue, and purple teaming. For our returning and advanced readers who may have prior knowledge of Kali Linux and the respective teams, feel free to skim through the first two chapters and get straight into the practical aspects in Chapter 3, Installing Kali Linux, Chapter 4, Additional Kali Installations and Post-Installation Tasks, and Chapter 5, Installing Wine in Kali Linux, which detail the installations of Kali and Wine.

In this chapter we will cover the following key topics:

  • What is Kali Linux?
  • Understanding red teaming
  • Understanding blue teaming
  • Understanding purple teaming

Before we get started with these topics, the following is a sneak peek at how I got into the world of Kali Linux, as I feel some of you will be able to relate to my story!

Previous Section
End of Section 1
Next Section