Recentemente fui convidado a ministrar uma disciplina no Mestrado em Informática Forense da Engenharia Elétrica da UnB.
Trata-se de um convênio da Polícia Federal com a Universidade de Brasília para formação continuada de Peritos da DPF e de algumas Polícias Civis estaduais.
Até o momento já foram abordados - do ponto de vista teórico e prático - os temas Aquisição e Análise de Memória ou "Memory Forensics". Vários alunos possuem um bom nível técnico e interesse, o que torna a atividade de docência especialmente interessante.
Como referência mínima para a comunidade, seguem os livros, papers e ferramentas que utilizei para abordar este tema:
Livros: (links neste outro post)
I - Windows Forensic Analysis v2, Harlan Carvey
Capítulos 3 – Windows Memory Analysis e Capítulo 4 – Registry Analysis
II - Malware Forensics – Investigating and Analyzing Malicious Code, James Aquilina, - Eoghan Casey, Cameron Malin
Capítulos 3 – Memory Forensics: Analyzing Physical and Process Memory Dumps e 9 – Analysis of a Suspect Program
III – Computer Evidence Collection & Preservation, Christopher L.T. Brown
Capítulos 6 – Volatile Data e 11 – Collecting Volatile Data
IV - EnCE – The Official Encase Certified Examiner Study Guide, 2nd Edition, Steve Bunting
Capítulos 3 – First Response e 9 – Windows Operating System Artifacts
V - Undocumented Windows, capítulo 4, Sven B. Schreiber
VI - Windows Internals (4a edição) capítulo 7, Mark Russinovich e David Salomon.
Papers:
Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis
CERT:http://www.cert.org/archive/pdf/08tn017.pdf (Cal Waits, Joseph Ayo Akinyele, Richard Nolan, Larry Rogers)
Collecting Evidence from a Running Computer - SEARCH:
http://www.search.org/files/pdf/CollectEvidenceRunComputer.pdf (Todd Shipley and Henry Reeve)
"A Methodology for the Law Enforcement Collection of Digital Evidence from a Running Computer”
Lest We Remember: Cold Boot Attacks on Encryption Keys: http://citp.princeton.edu/pub/coldboot.pdf
Eletronic Crime Investigation - NIJ: http://www.ncjrs.gov/pdffiles1/nij/187736.pdf
Electronic Evidence – Guide for First Responders – http://www.forwardedge2.usss.gov/pdf/bestPractices.pdf
Papers DFRWS:
Windows Operating System Agnostic Memory Analysis. James Okolica and Gilbert
Extracting Windows Command Line Details from Physical Memory. Richard Stevens and Eoghan
A Novel Time-Memory Trade-Off Method for Password Recovery. Vrizlynn L. L. Thing and Hwei-Ming
Extraction of Forensically Sensitive Information from Windows Physical Memory. Seyed Mahmood Hejazi, Chamseddine Talhi and Mourad Debbabi. http://dfrws.org/2009/proceedings/p121-hedjazi.pdf
The Persistence of Memory: Forensic Identification and Extraction of Cryptographic Keys. Carsten Maartmann-Moe, Andre Arnes and Steffen E. Thorkildsen. http://dfrws.org/2009/proceedings/p132-moe.pdf
Forensic Analysis of the Windows Registry in Memory. Brendan Dolan-Gavitt.
Recovering Deleted Data From the Windows Registry. Timothy Morgan.
Forensic Memory Analysis: Files mapped in memory. Ruud van Baar.
The impact of Microsoft Windows pool allocation strategies on memory forensics. Andreas Schuster.
BodySnatcher: Towards Reliable Volatile Memory Acquisition by Software. Bradley Schatz.
The VAD Tree: A Process-Eye View of Physical Memory. Brendan F Dolan-Gavitt.
Searching for processes and threads in Microsoft Windows memory dumps. Andreas Schuster.
Ferramentas:
1 - VMs:
1.1 - VM SIFT Workstation 2.0: https://computer-forensics2.sans.org/community/siftkit/
1.2 - VM BackTrack 4 R1: http://www.backtrack-linux.org/download.php?fname=bt4r1vm
2 - OpenSource/FreeWare:
2.01 - MoonSols Community Edition - http://www.moonsols.com/component/jdownloads/
2.02 - FastDump - https://www.hbgary.com/community/free-tools/#fastdump
2.03 - FTKImager - http://www.accessdata.com/downloads.html#FTKImager
2.04 - Memoryze - http://www.mandiant.com/products/free_software/memoryze/
2.05 - Volatility - https://www.volatilesystems.com/default/volatility
2.06 - Fget - https://www.hbgary.com/community/free-tools/#fget
2.07 - Microsoft Windows Debugger - http://www.microsoft.com/whdc/devtools/debugging/
2.08 - LiveKD - http://technet.microsoft.com/en-us/sysinternals/bb897415.aspx
2.09 - pdgmail/pdymail - http://jeffbryner.com/code/
2.10 - Ferramentas Sysinternals - http://technet.microsoft.com/en-us/sysinternals/
2.11 - Ferramentas NirSoft - http://www.nirsoft.net/
2.12 - Ferramentas NTSecurity - http://ntsecurity.nu/toolbox/
3) Ferramentas Comerciais:
3.1 – AccessData FTK 3.1
3.3 – HBGary Responder Pro
