Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!So many readers in theNull Bytecommunity have been asking me questions about evading detection and hacking undetected that I decided to start a new series ondigital forensics.I applaud each of you for your concern, as the last thing I want to see is one of you getting caught and spending years locked up in a 8 x 8 concrete room with a violent and lascivious cellmate. You can never be too cautious in this field of endeavor.The best way to evade detection is to understand what the other side is doing and using. So, this series will focus on the tools and techniques that law enforcement and the security engineers are using to detect and prosecute hackers around the world.What Is Digital Forensics?Digital forensics is the field of determining who was responsible for a digital intrusion or other computer crime. It uses a wide-range of techniques to gain attribution to the perpetrator.It relies upon the fundamental concept that whenever a digital intrusion or crime is committed, the perpetrator inadvertently leaves a bit of themselves behind for the investigator to find. These "bits" could be entries in log files, changes to the registry, hacking software, malware, remnants of deleted files, etc. All of these can provide clues and evidence to determine their identity and lead to the capture and arrest of the hacker.As a hacker, the more you know and understand about digital forensics, the better you can evade the standard forensic techniques and even implement anti-forensic measures to throw off the investigator.The Digital Forensic ToolsJust like in hacking, there are a number of software tools for doing digital forensics. For the hacker, becoming familiar with these tools and how they work is crucial to evading them. Most digital forensic investigators rely upon three major commercial digital forensic suites.Guidance Software's EnCase ForensicAccess Data's Forensic Tool Kit (FTK)ProdiscoverThese three suites are comprised of multiple tools and reporting features and can be fairly expensive. While these suites are widely used by law enforcement, they use the same or similar techniques as the free open-source suites without the fancy interfaces.By using the open source and free suites, we can come to understand how such tools as EnCase work without the expense. EnCase is the most widely used tool by law enforcement, but not necessarily the most effective and sophisticated. These tools are designed for user-friendliness, efficiency, certification, good training, and reporting.There are a number of the free, open-source forensic suites, including the following three.The Sleuthkit Kit (TSK)HelixKnoppixWe will look at each of these suites to better understand what digital forensic investigators can see and find about an intrusion and the perpetrator.The Forensic Tools Available in BackTrackIn addition, there are a large number of individual tools that are available for digital forensics, some of which are available in ourBackTrackand Kali distributions.Some of the better tools in BackTrack include the following, among many others.sleuthkittruecrypthexeditautopsyiphoneanalyzerrifiuti2ptkexiftoolevtparse.plfatbackscalpeldc3dddriftnettimestompWhat Can Digital Forensics Do?Digital forensics can do many things, all of which the aspiring hacker should be aware of. Below is a list of just some of the things.Recovering deleted files, including emailsDetermine what computer, device, and/or software created the malicious file, software, and/or attackTrail the source IP and/or MAC address of the attackTrack the source of malware by its signature and componentsDetermine the time, place, and device that took a pictureTrack the location of a cell phone enabled device (with or without GPS enabled)Determine the time a file was modified, accessed or created (MAC)Crack passwords on encrypted hard drives, files, or communicationDetermine which websites the perpetrator visited and what files he downloadedDetermine what commands and software the suspect has utilizedExtract critical information from volatile memoryDetermine who hacked the wireless network and who the unauthorized users areAnd that' just some of the things you can do with digital forensics!What Is Anti-Forensics?Anti-forensics are techniques that can be used to obfuscate information and evade the tools and techniques of the forensic investigator. Some of these techniques include the following.Hiding Data:Hiding data can include such things as encryption and stegonography.Artifact wiping:Every attack leaves a signature or artifact behind. Sometimes it's wise to attempt to wipe these artifacts from the victim machine so as to leave no tell-tale trail for the investigator.Trail Obfuscation:A decent forensic investigator can trail nearly any remote attack to a IP address and/or MAC address. Trail obfuscation is a technique that leads them to another source of the attack, rather than the actual attack.Change the timestamp:Change the file timestamp (modify, access, and change) to evade detection by forensic tools.Stay Tuned for More on Digital ForensicsWe will spend some of my future Null Byte tutorials looking at the most widely-used techniques in digital forensics, using both commercial and open-source tools, and then advance to anti-forensics, or ways to evade detection from these tools and the forensic investigator.So, to learn the techniques law enforcement and security engineers are using to track hackers, along with how to avoid and evade, keep coming back here!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseMagnifying glassimage via ShutterstockRelatedHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)News:Why YOU Should Study Digital ForensicsHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)News:What to Expect from Null Byte in 2015News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)How To:Why You Should Study to Be a HackerHack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Community Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsNews:What does Pro Tools HD Native mean for you?Community Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCamera Plus Pro:The iPhone Camera App That Does it AllHow To:Don't Get Caught! How to Protect Your Hard Drives from Data Forensics