Book Image

Digital Forensics with Kali Linux - Second Edition

By : Shiva V. N. Parasram
Book Image

Digital Forensics with Kali Linux - Second Edition

By: Shiva V. N. Parasram

Overview of this book

Kali Linux is a Linux-based distribution that's widely used for penetration testing and digital forensics. It has a wide range of tools to help for digital forensics investigations and incident response mechanisms. This updated second edition of Digital Forensics with Kali Linux covers the latest version of Kali Linux and The Sleuth Kit. You'll get to grips with modern techniques for analysis, extraction, and reporting using advanced tools such as FTK Imager, hex editor, and Axiom. Updated to cover digital forensics basics and advancements in the world of modern forensics, this book will also delve into the domain of operating systems. Progressing through the chapters, you'll explore various formats for file storage, including secret hiding places unseen by the end user or even the operating system. The book will also show you how to create forensic images of data and maintain integrity using hashing tools. Finally, you'll cover advanced topics such as autopsies and acquiring investigation data from networks, operating system memory, and quantum cryptography. By the end of this book, you'll have gained hands-on experience of implementing all the pillars of digital forensics: acquisition, extraction, analysis, and presentation, all using Kali Linux tools.
Table of Contents (17 chapters)
1
Section 1: Kali Linux – Not Just for Penetration Testing
4
Section 2: Forensic Fundamentals and Best Practices
7
Section 3: Forensic Tools in Kali Linux
12
Section 4: Automated Digital Forensic Suites
16
Other Books You May Enjoy

Using Foremost for file recovery and data carving

Foremost is a simple and effective command line interface (CLI) tool that recovers files by reading their headers and footers. We can start foremost by clicking on Applications | 11 - Forensics | foremost:

Figure 6.1 – Foremost in the Kali menu 

If foremost is not listed in or installed on your version of Kali Linux, install it by typing sudo apt-get install:

Figure 6.2 – Installing foremost in Kali

Once foremost is successfully started, a Terminal opens, displaying the program version, creators, and some of the many switches for usage:

Figure 6.3 – Foremost help options

To have a better understanding of foremost and the switches used, try browsing the foremost system manager's manual. This can be done by entering the following command:

man foremost

The output displays the user manual for foremost along with the...