Key Features
*A condensed hand-held guide complete with on-the-job tasks and checklists
*Specific for Windows-based systems, the largest running OS in the world
*Authors are world-renowned leaders in investigating and analyzing malicious code
Description
Dissecting the dark side of the Internet with its infectious worms, botnets, rootkits, and Trojan horse programs (known as malware) is a treaterous condition for any forensic investigator or analyst. Written by information security experts with real-world investigative experience, Malware Forensics Field Guide for Windows Systems is a "tool" with checklists for specific tasks, case studies of difficult situations, and expert analyst tips.
Malware Forensics Field Guide for Windows Systems, 1st Edition
Chapter 1: Malware Incident Response: Volatile Data Collection and Examination on a Live Windows System
-Introduction
-Building Your Live Response Toolkit
-Volatile Data Collection Methodology
-Non-Volatile Data Collection from a Live Windows System
-Incident Response Tool Suites for Windows
-Malware Discovery and Extraction from a Live Windows System
-Conclusions
-Malware Incident Response Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Chapter 2: Memory Forensics: Analyzing Physical and Process Memory Dumps for Malware Artifacts
-Introduction
-Memory Forensics Methodology
-Old School Memory Analysis
-Windows Memory Forensic Tools
-Active , Inactive and Hidden Processes
-How Windows Memory Forensic Tools Work
-Process Memory Dumping and Analysis on a Live Windows System
-Conclusions
-Windows Memory Forensics Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Chapter 3: Post-Mortem Forensics: Discovering and Extracting Malware and Associated Artifacts from Windows Systems
-Introduction
-Forensic Examination of a Compromised Windows System
-Functional Analysis: Resuscitating a Windows Computer
-Malware Discovery and Extraction from a Windows System
-Advanced Malware Discovery and Extraction from a Windows System
-Conclusions
-Windows Post-Mortem Forensics Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Chapter 4: Legal Considerations
-Introduction
-Framing the issues
-Sources of Investigative Authority
-Statutory Limits of Authority
-Tools for Acquiring Data
-Acquiring Data across Borders
-Involving Law Enforcement
-Improving Chances for Admissibility
-Conclusions
-Legal Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Chapter 5: File Identification and Profiling Initial Analysis of a Suspect File on a Windows System
-Introduction
-Case Scenario: "Hot New Video!"
-Overview of the File Profiling Process
-Working with Executables
-File Similarity Indexing
-File Signature and Classification
-Embedded Artifact Extraction: Strings, Symbolic Information, and File Metadata
-Inspecting File Dependencies
-File Obfuscation: Packing and Encryption Identification
-Embedded Artifact Extraction Revisited
-The Windows Portable Executable File Format
-Profiling Other Malicious File Types
-Conclusions
-File Identification and Profiling Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Chapter 6: Analysis of a Suspect Program
-Introduction
-Goals
-Guidelines for Examining a Malicious Executable Program
-Establishing the Environment Baseline
-Pre-Execution Preparation: System and Network Monitoring
-System and Network Monitoring: Observing File System, Process, Network and API Activity
-Environment Emulation and Adjustment
-Defeating Obfuscation
-Embedded Artifact Extraction Revisited
-Exploring and Verifying Specimen Functionality and Purpose
-Event Reconstruction and Artifact Review: File System, Registry, Process and Network Activity Post-run Data Analysis
-Summary
-Conclusions
- Analysis of a Suspect Program Checklist
-The Toolbox
-Pitfalls to Avoid
-Selected Readings
Appendix A: Tool Glossary
