Next Generation Data Forensics & Linux

Presented at DEF CON 10 (2002), Aug. 4, 2002, 1 p.m. (50 minutes).

The field of data forensics ('computer forensics' as commonly referred to) is rapidly changing. Historically data forensics was focused on the imaging, analysis, and reporting of a stand-alone personal computer (PC) hard drive perhaps 1 gigabyte (GB) in size using DOS-based tools. However, due to a number of changes and advances in technology an evolution has begun in the field of data forensics. So where do we stand today? Increasingly, forensic examiners are faced with analyzing 'non-traditional' PCs, corporate security professionals are doubling as in-house forensic examiners and incident first responders, and critical data is residing in volatile system memory. This is the 'Next Generation of Data Forensics.' What is the Next Generation Data Forensics platform of choice? Linux. Why Linux? There are a number of key functionalities within the Linux operating system environment that make it the best platform for data forensics. Among them: everything, including hardware, is recognized as a file support for numerous filesystem types ability to mount a file via the 'loopback driver' ability to analyze a live system in a safe and minimally invasive manner ability to redirect standard output to input, or 'chaining' ability to monitor and log processes and commands ability to review source code for most utilities ability to create bootable media, including floppies and compact discs


Presenters:

  • Thomas Rude aka Farmerdude, CISSP - RedHat, Inc.
    farmerdude is a Security Consultant for Red Hat, Inc. When not performing vulnerability assessments, penetration tests, or designing security technologies such as firewalls and VPNs, he can be found in the lab testing various security tools, applications, and operating systems for weaknesses and flaws. farmerdude has presented on topics ranging from steganography, data forensics, and social engineering, at various Cyber Crime and INFOSEC conferences. In addition to serving as the current Vice President for the Atlanta Chapter High Technology Crime Investigation Association (HTCIA), he is also a member of the Atlanta Metropolitan Crime Commission.

Links:

Similar Presentations: