Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


June 21, 2004

Performing Forensic Analyses, Part 2

Dissecting the damaged disk
RSS
View this exclusive article with VIP access -- click here to join |
See More Security Articles Here | Reprints | Or sign up for our VIP Monthly Pass!

In "Performing Forensic Analyses, Part 1," June 2004, InstantDoc ID 42445, I showed you how to create a bootable CD-ROM that contains the Penguin Sleuth Kit and how to use that CD-ROM to create a digital copy, or image, of a compromised hard disk. Now let's look at how to perform a forensic analysis on that image by using the Penguin Sleuth Kit on your CD-ROM.

The Penguin Sleuth Kit includes two extremely useful utilities: the Sleuth Kit, which is a collection of forensic command-line tools, and Autopsy, which is the Web browser-based front end for the command-line tools. The Sleuth Kit and Autopsy use an evidence locker to store collected data and documentation. Thus, you need an external or writable hard disk for the evidence locker.

Forensic analysis is a time- and resource-intensive operation. If you'll be performing forensic analyses often, I recommend that you use a dedicated machine with Linux installed to do this work. However, if you'll be performing forensic analyses only on occasion, you can run the bootable CD-ROM from your workstation instead of installing Linux on a dedicated machine because the tools on the CD-ROM are Linux-based. . . .


Already a VIP member?
Please log on to view the full article

Why become a VIP member?

VIP-only online access
VIP CD delivered twice a year: offline access to the entire Windows IT Pro article library
Monthly issue of your choice of Windows IT Pro or SQL Server Magazine

Subscribe Now
Top Viewed ArticlesView all articles
Kon-Boot Lets You Bypass Logon for Windows and Linux

Kon-Boot looks like a very interesting tool since it can get you into a system without having to logon first. ...

Google to Take On Windows with New OS

It's official: Google will compete head-to-head with Microsoft's dominant Windows OS with a new system called Google Chrome OS. Based on the Google Chrome browser and not its previous OS effort, the smart phone-based Android system, Google Chrome OS will ...

Q. How can I continually check a performance counter from Windows PowerShell?

...


Security Whitepapers Sustainable Compliance: How to reconnect compliance, security and business goals

The Impact of Messaging and Web Threats

Why SaaS is the Right Solution for Log Management

Related Events Security Summit

Data retention mandates. Volumes of critical aging data. What’s your IT plan?

Concrete Ways to Make Sure Your SharePoint Deployment Doesn't Blow Up

Check out our list of Free Email Newsletters!

Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys

Related Security Resources Introducing Left-Brain.com, the online IT bookstore
Looking for books, CDs, toolkits, eBooks? Prime your mind at Left-Brain.com

Discover Windows IT Pro eLearning Series!
Clear & detailed technical information and helpful how-to's, all in our trademark no-nonsense format

Test Drive IT Solutions and Get Free Music Downloads
Solve your toughest IT problems with these free downloads and receive 5 free music downloads!


Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement | Reprints and Licensing