# SANS InfoSec Reading Room - Forensics

<<Reading Room Home
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

##### Featuring 20 papers as of Feb 12, 2012

iPhone Backup Files. A Penetration Tester's Treasure
  By: Darren Manners (posted on February 7, 2012)
  One of the noticeable changes in recent technology history is the emergence of the smart phone. Technological advances in these fields have created devices that have almost the equivalent power and functionality of desktop computers.

What's in a Name: Uncover the Meaning behind Windows Files and Processes
  By: Larisa Long (posted on February 7, 2012)
  When a system has been compromised, forensic analysts have to be part researcher and part investigator. They must be able to parse out known or healthy files to eliminate them as possible clues. Like the old saying goes: know what you don&#8223;t know, but know where to find the answers.

Computer Forensic Timeline Analysis with Tapestry
  By: Derek Edwards (posted on November 29, 2011)
  One question commonly asked of investigators and incident responders is, "What happened?" The answer often takes the form of a story designed to convey understanding of complex mechanisms and interactions in a simple, straightforward way.

Identifying Malicious Code Infections Out of Network
  By: Ken Dunham (posted on August 29, 2011)
  Forensics is a complex subject, where details matter greatly. Even more complicated are investigations where forensic methods are used to further understand, identify, capture, and mature and understanding of a malicious attack that may have taken place on a computer.

Wireless Networks and the Windows Registry - Just where has your computer been?
  By: Jonathan Risto (posted on May 6, 2011)
  The Windows Registry stores all of the information that is needed by the host operating system. This database contains all of the configurations, settings and options that are both created initially by the operating system, as well as user configuring settings and installed software.

Grow Your Own Forensic Tools: A Taxonomy of Python Libraries Helpful for Forensic Analysis
  By: T.J. OConnor (posted on September 13, 2010)
  Forensics tools exist in abundance on the Web. Want to find a tool to dump the Windows SAM database out of volatile memory? Google and you will quickly find out that it exists. Want to mount and examine the contents of an iPhone backup? A tool exists to solve that problem as well. But what happens when a tool does not already exist? Anyone who has recently performed a forensic investigation knows that you are often left with a sense of frustration, knowing data existed only you had a tool that could access it.

Integrating Forensic Investigation Methodology into eDiscovery
  By: Colin Chisholm (posted on September 8, 2010)
  The intent of this paper is twofold; to provide a primer on the eDiscovery process for forensic analysts and to provide guidance on the application of forensic investigative methodology to said process. Even though security practitioners such as forensic analysts operate in the legal vertical, they necessarily view and approach eDiscovery from a different perspective than legal professionals. This paper proposes that both parties can benefit when they integrate their processes; forensic tools and techniques have been used in the collection, analysis and presentation of evidence in the legal system for years. The history, and precedent, of applying forensic science to the legal process can be leveraged into the eDiscovery process. This paper will also detail how the scope and work for a forensic investigator during the eDiscovery process differs from a typical forensic investigation.

Reverse Engineering the Microsoft exFAT File System
  By: Robert Shullich (posted on February 18, 2010)
  As Technology pushes the limits of removable media - so drives the need for a new file system in order to support the larger capacities and faster access speeds being designed. Microsoft's answer to this need is the new Extended FAT File System (exFAT) which has been made available on its newer operating systems and which will be supported on the new secure digital extended capacity (SDXC) storage media. This new file system is proprietary and requires licensing from Microsoft and little has been published about exFAT's internals. Yet in order to perform a full and proper digital forensics examination of the media, the file system layout and organization must be known. This paper takes a look under the hood of exFAT and demystifies the file system structure in order to be an aid in the performance of a digital investigation.

Remotely Accessing Sensitive Resources
  By: Jason Ragland (posted on February 18, 2010)
  Often travelers require access to digital resources to perform work from off-site locations such as conferences, hotels, and homes. These resources can include emails, research, medical, financial data, server management applications, or any number of other things that may have a very high need for confidentiality and integrity. The acceptable methods for access vary based on a variety of factors such as size, complexity, available types of network connectivity, and bandwidth. Access to email is often easily provided via a secure website and a password, for example. If the resource consists of gigabytes of research data, it isn’t as simple.

Mac OS X Malware Analysis
  By: Joel Yonts (posted on September 8, 2009)
  As Apple's market share raises so will the Malware! Will incident responders be ready to address this rising threat? Leveraging the knowledge and experience from the mature windows based malware analysis environment, a roadmap will be built that will equip those already familiar with malware analysis to make the transition to the Mac OS X platform. Topics covered will include analysis of filesystem events, network traffic capture & analysis, live response tools, and examination of OS X constructs such as executable file structure and supporting configuration files.

Techniques and Tools for Recovering and Analyzing Data from Volatile Memory
  By: Kristine Amari (posted on March 26, 2009)
  There are many relatively new tools available that have been developed in order to recover and dissect the information that can be gleaned from volatile memory, but because this is a relatively new and fast-growing field many forensic analysts do not know or take advantage of these assets.

Data Carving Concepts
  By: Antonio Merola (posted on November 19, 2008)

Mobile Device Forensics
  By: Andrew Martin (posted on September 5, 2008)

A Forensic Primer for Usenet Evidence
  By: Mark Lachniet (posted on June 25, 2008)

Ex-Tip: An Extensible Timeline Analysis Framework in Perl
  By: Michael Cloppert (posted on May 21, 2008)

Taking advantage of Ext3 journaling file system in a forensic investigation
  By: Gregorio Narvaez (posted on December 11, 2007)

Forensic Analysis of a SQL Server 2005 Database Server
  By: Kevvie Fowler (posted on September 28, 2007)

Forensic Analysis of a Compromised Intranet Server
  By: Roberto Obialero (posted on June 8, 2006)
  This document details the forensic analysis process of a compromised Intranet server, from the verification stage to the dissection of malware code, supported by an explanation of the followed methodology.

Becoming a Forensic Investigator
  By: Mark Maher (posted on August 15, 2004)
  One of the forensic analyst's primary functions is the dissemination of the forensic process to the intended audience. To do their jobs successfully, they must write forensic reports that are both technically accurate and easy to read.

A Case for Forensics Tools in Cross-Domain Data Transfers
  By: Dwane Knott (posted on October 31, 2003)
  Corporate and government organizations dependence on computers and networks for storage and movement of data raises significant security issues. This paper presents three options, the most practical is more fully discussed.

###### Check Them Out!

- SANS 2012
- Security Awareness Training
- Top Cyber Security Risks
- SANS Reading Room
- Career Roadmap
- Storm Center
- WhatWorks™
- Newsletters

##### Fight Crime.
Unravel Incidents.... One Byte at a Time.

Visit the NEW Forensics & E-Discovery Site >>

It was, overall, the most in-depth training on securing Windows I've attended!
-Matt Hurst, Madison City Schools