Hack Like a Pro: Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Lately, much of the discussion here on Null Byte has revolved around evading detection andnot getting caughthacking. Several of you have written me asking for a series on evading detection and forensics, and while Ibegan a series5 months ago on just that, we have changed hacking platforms fromBackTracktoKali, which has a much more highly developed forensic toolset.As a result, we willstart anew with Kaliand I'll try to develop this series in a logical and sequential manner that a forensic investigator would follow. I will also include units in here on anti-forensics, or ways you can stymie the forensic investigator.Although, I know you are all anxious for me to show you how to evade detection, you first need some background in the tools and techniques of the forensic investigator. Without that background information, you will be left at the whim of ever changing and improving forensic techniques. Only by understanding the tools and techniques of the forensic investigator can you stay ahead of the game and, more importantly, stay out of custody.Kali Forensic ToolsKali has a number of forensic tools built into its toolbox. Although many of these tools are outstanding in Kali, there are many more forensic tools available and I will not limit myself to those included in Kali, but we will start with these.We can find those tools atKali Linux->Forensics.As you can see, Kali subdivides its forensic tools into multiple categories. These include the following.Anti-Virus Forensic ToolsDigital Anti-Forensic ToolsDigital ForensicsForensic Analysis ToolsForensic Craving ToolsForensic Hashing ToolsForensic Imaging ToolsForensic SuitesNetwork ForensicsPassword Forensics ToolsPDF Forensic ToolsRAM Forensic ToolsEach one of these areas includes multiple tools for doing similar tasks. I will try to demonstrate the best tools and include the theory behind the techniques.Commercial Forensic ToolsThere are a large number of companies that produce commercial forensic tools, primarily for law enforcement use. The two dominant players areEnCaseand theForensic Tool Kit(FTK). These forensic suites tend to be all-encompassing, with tools for all types of cases and investigations. In addition, they have case management and reporting capabilities that go far beyond those of the open-source tools.Volatile Analysis GUI in AccessData's FTK.Image viaAccessDataThis doesn't mean they are better tools, but it does mean they easier to use (after all, they are designed for law enforcement officers) and they format and manage the information better than some of our open source tools. We will examine these tools a bit in this series, but digital forensics is better learned using open source tools as you really need to know what and how you are doing with these tools, rather than simply point, click, and print.Areas That We Will Address HereIn the real world (anyone ever been there?), Linux systems are attackers and Windows systems are victims. As a result, we will focus our attention on understanding what artifacts the attacker (us?) might leave behind on a Windows system.To be able to benefit from this discussion and tutorials, I have to assume that you havefunctional Linux knowledge and skills, a good understanding of TCP/IP and networking, and have reasonable Windows skills. In addition, to grasp the work of the forensic investigator, you will need to understand the close-grained anatomy of a Windows filesystem (usually NTFS) and the Windows registry.Few hackers, and for that matter, few system admins, have that deep understanding of the NTFS and the registry, so I will have separate tutorials on those two subject matters.I really hope you enjoythis seriesand find it useful, whether you want to make a career of catching hackers or simply want to remain free to hack another day.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 3 (Recovering Deleted Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics)How To:Why You Should Study to Be a HackerHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 20 (Devices Files)News:What to Expect from Null Byte in 2015The Sony Hack:Thoughts & Observations from a Real HackerNews:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Hack Like a Pro:How to Find the Exact Location of Any IP AddressHack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsHow To:Use the Buscador OSINT VM for Conducting Online InvestigationsThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)How To:Links to Help You HackingHack Like a Pro:How to Create a Smartphone Pentesting LabHow To:The Essential Skills to Becoming a Master HackerHow To:Hack WPA WiFi Passwords by Cracking the WPS PINNews:How to Study for the White Hat Hacker Associate Certification (CWA)Linux:Where Do I Start?News:What does Pro Tools HD Native mean for you?Camera Plus Pro:The iPhone Camera App That Does it AllHow To:Don't Get Caught! How to Protect Your Hard Drives from Data Forensics