Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

More documents

Recommendations

Info

Data Reduction • Determine what is “normal” • Eliminate “normal” from your view • What’s left over is abnormal • Provides good ole fashioned “leads” • Document what you did, why you did it, and the results • Answer the new questions Copyright Trustwave 2009 Confidential
Volatile Data Gathering Critical to the investigation • Likely your only chance to review the live system − Attackers may still be present − Malware is running in its original state − THIS is the crime scene • Gather as much as you can − Use “trusted” tools − No such thing a “court approved” − Know your footprint, and be able to account for it • Review during image acquisition − Major developments in minutes − Customer is good source of intel − Feeds back into the investigation plan Copyright Trustwave 2009 Confidential
Page 1 and 2: Sniper Forensics “One Shot, One K
Page 3 and 4: Who Am I? • Senior Security Consu
Page 5 and 6: Shotgun Forensics The process of ta
Page 7 and 8: Three Round Shot Group Infiltration
Page 9 and 10: What Others are Saying (cont.) “Y
Page 11 and 12: Locard’s Exchange Principle • E
Page 13 and 14: The Alexiou Principle Documented by
Page 15: Create an Investigation Plan This i
Page 19 and 20: Volatile Data Analysis (cont.) Even
Page 21 and 22: Volatile Data Analysis (cont.) RAM
Page 23 and 24: Timeline Analysis • Can help prov
Page 25 and 26: Case Studies All Your Registry Entr
Page 27 and 28: All Your Registry Entries and Belon
Page 29 and 30: Don’t Count Your Keylogger B4 It
Page 31 and 32: Bring it all together (cont.) What
Page 33: Questions? cepogue@trustwave.com

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?