인터넷보안/보안관련2010. 12. 15. 21:11



Faculty Fellow Rob Lee created the SANSInvestigativeForensic Toolkit(SIFT)Workstationfeatured in the Computer ForensicInvestigationsand Incident Response course (FOR 508) in order to show that advancedinvestigationsand investigating hackers can be accomplished using freely available open-source tools. The SANS SIFTWorkstationis a VMware Appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite. Basic Configuration Information Recommend toincreaseVMware Options for * Download VMworkstation, Player, or Fusion * Memory (Currently 1024K,increaseto add more RAM as needed) * CPUs (Currently 1,increaseas needed for more power) SIFT Login/Password Afterdownloadingthe toolkit, use the credentials below to gain access. * Login "sansforensics" * Password "forensics" * $ sudo su - o Use to elevate privileges to root while mounting disk images. PTK login * Login "admin" * Password "forensics" Host Machine Connectivity Enable SHARED FOLDERS * VM -> SETTINGS -> OPTIONS -> Shared Folders -> Always Enabled (Check) * Access to Host System Found onDesktop* VMware-Shared-Drive Access from a Windows Machine * Filesystem Shares \\SIFTWORKSTATION o or useifconfigandconnectto eth0 IP Address listed (e.g. \\192.168.1.12) o /mnt - Mount point for read-only examination of digital forensic evidence o /cases - Directory to store evidence SIFTWorkstationRecommended Software Requirements * VMware Player,Workstation, or Fusion (Free From www.vmware.com) * SANS SIFTWorkstationCapabilities SIFTWorkstation2.0 Capabilities Ability to securely examine raw disks, multiple file systems, evidence formats. Places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed File system support * Windows (MSDOS, FAT, VFAT, NTFS) * MAC (HFS) * Solaris (UFS) * Linux (EXT2/3) Evidence Image Support * Expert Witness (E01) * RAW (dd) * Advanced Forensic Format (AFF) Software Includes * The Sleuth Kit (File system Analysis Tools) * log2timeline (Timeline Generation Tool) * ssdeep & md5deep (Hashing Tools) * Foremost/Scalpel (File Carving) * WireShark (Network Forensics) * Vinetto (thumbs.db examination) * Pasco (IE Web History examination) * Rifiuti (Recycle Bin examination) * Volatility Framework (Memory Analysis) * DFLabs PTK (GUI Front-End for Sleuthkit) * Autopsy (GUI Front-End for Sleuthkit) * PyFLAG (GUI Log/Disk Examination) Key Directories in SANS SIFTWorkstation* /forensics oLocationof the files used for the Autopsy Toolset * /usr/local/src o Source files for Autopsy, The Sleuth Kit, and other tools * /usr/local/bin oLocationof the forensic pre-compiled binaries * /cases oLocationof your collected evidence * /mnt/hack oLocationof the mount points for the file system images Homepage:
http://computer-forensics.sans.org/



Posted by 라라바스

댓글을 달아 주세요