In the beginning...
The first computer incident I was involved in was the ILOVEYOU virus in May 2000 and that directly lead me into forensics, with my first investigation being in 2004.
I started out with a script from a book called “Windows Forensics and Incident Recovery” written by Harlan Carvey (@keydet89) https://windowsir.blogspot.com/
Thank you Harlan for all the books since and creating RegRipper https://github.com/keydet89/RegRipper3.0
While I started out with a humble script, the modern forensicator/Incident Responder has a huge variety of FOSS tools to choose from. The need for Windows deadbox forensics still exists, but the focus has shifted to incident response (IR), with the need for speedy accurate triage, to stop Ransomware. Given the rise in ransomware, data breaches and malware attacks, the need for IR is only increasing. The good news is the basics for Forensics and IR fields (DFIR) are basically the same – paraphrasing the experts:
1) critical thinking – there is no “find evil” button; know what you are looking for BEFORE starting
2) use a documented, defensible, explainable process (expecting the case to go to court)
3) understand your environment (Windows, MAC, Android)
4) understand the threat actors and their TTP’s
5) understand your tools, their usage and limitations
6) test, document and sharing back to the community
7) master related topics like Linux, bash shell scripting, Python, TCP/IP
Comments
Post a Comment