Windows Forensics and Incident Recovery
Harlan Carvey · CERN Document Server (European Organization for Nuclear Research) · 2004
Preface. 1. Introduction. Definitions. Intended Audience. Book Layout. Defining the Issue. The Pervasiveness and Complexity of Windows Systems. The Pervasiveness of High-Speed Connections. The Pervasiveness of Easy-to-Use Tools. Purpose. Real Incidents. Where To Go For More Information. Conclusion. 2. How Incidents Occur. Definitions. Purpose. Incidents. Local vs. Remote. Manual vs. Automatic. Lowest Common Denominator. Attacks Are Easy. Summary. 3. Data Hiding. File Attributes. The Hidden Attribute. File Signatures. File Times. File Segmentation. File Binding. NTFS Alternate Data Streams. Hiding Data in the Registry. Office Documents. OLE Structured Storage. Steganography. Summary. 4. Incident Preparation. Perimeter Devices. Host Configuration. NTFS File System. Configuring the System with the SCM. Group Policies. Getting Under the Hood. User Rights. Restricting Services. Permissions. Audit Settings and the Event Log. Windows File Protection. WFP and ADSs. Patch Management. Anti-Virus. Monitoring. Summary. 5. Incident Response Tools. Definitions. Tools for Collecting Volatile Information. Logged On User(s). Process Information. Process Memory. Network Information and Connections. Clipboard Contents. Command History. Services and Drivers. Group Policy Information. Tools for Collecting Non-Volatile Information. Collecting Files. Contents for the Recycle Bin. Registry Key Contents and Information. Scheduled Tasks. User Information. Dumping the Event Logs. Tools for Analyzing Files. Executable files. Process Memory Dumps. Microsoft Word Documents. PDF Documents. Summary. 6. Developing a Methodology. Introduction. Prologue. First Dream. Second Dream. Third Dream. Fourth Dream. Fifth Dream. Summary. 7. Knowing What to Look For. Investigation Overview. Infection Vectors. Malware Footprints and Persistence. Files and Directories. Registry Keys. Processes. Open Ports. Services. Rootkits. AFX Windows Rootkit 2003. Detecting Rootkits. Preventing Rootkit Installations. Summary. 8. Using the Forensic Server Project. The Forensic Server Project. Collecting Data Using FSP. Launching the Forensic Server. Running the First Responder Utility. File Client Component. Correlating and Analyzing Data Using FSP. Infected Windows 2003 System. A Rootkit on a Windows 2000 System. A Compromised Windows 2000 System. Future Directions of the Forensic Server Project. Summary. 9. Scanners and Sniffers. Port Scanners. Netcat. Portqry. Nmap. Network Sniffers. NetMon. Netcap. Windump. Analyzer. Ethereal. Summary. Appendix A. Installing Perl on Windows. Installing Perl and Perl Modules. Perl Editors. Running Perl Scripts. Setting Up Perl for Use with this Book. Win32::Lanman. Win32::TaskScheduler. Win32::File::Ver. Win32::API::Prototype. Win32::Perms. Win32::GUI. Win32::FileOp. Win32::DriveInfo. Win32::IPConfig. Summary. Appendix B. Web Sites. Searching. Sites for Information about Windows. Anti-Virus Sites. Program Sites. Security Information Sites. Perl Programming and Code Sites. General Reading. Appendix C. Answers to Chapter 9 Questions. FTP Traffic Capture. Netcat Traffic Capture. Null Session Traffic Capture. IIS Traffic Capture. Nmap Traffic Capture. Appendix D. CD Contents. Index.