Let's now explore another I.T. field known as computer forensics
the role of computer forensics is to secure and analyze evidence of computer crimes.
What could constitute a piece of evidence
if you suspect an attack has been launched on your system.
You need to document the current configuration of a targeted computer any sophisticated tools or redundant
it's enough to deploy a script written in the language of your choice power shell command line et cetera.
The script collects data on current configuration launched processes listening ports for your computer
network activity and so on.
Network traffic log has great value as evidence of computer crimes investigation even the local attacks
usually are dependent on a network activity of some kind.
Did it transmitting a launched program communicates with the control center or is updating examining
network traffic is simple and effective method for documenting attacks will show how to do this using
wireshark sniffer.
The gather data will only be legally effective if a court is convinced of its authenticity.
It's not enough to collect some data and testify that has been sent out of your computer.
We need to be able to prove in some way that the log is really the network communications log of your
computer.
A good solution is to assign the gathered communications files learn how to do that in a minute.
Another good practice is creating a low level disk image.
A lot of professional forensics tools set out by performing this action to programs duplicate the whole
logical disk inside the created file.
From that moment on we can access data and meta data in different ways.
Before you report on a cybercrime you need to first secure your evidence
then the collected evidence has to be examined.
This is in practice delegated to professional entities specializing in computer forensics analysis the
erosive views or an administrator are usually limited to securing the gathered evidence.
The role of a person who analyzes the collected data is to document an attack for legal use
Let's discover how to verify the authenticity of files through their signatures the internet is full
of specialist programs that calculate file checksums such as for example exact file.
One of the strengths of this application is that it's capable of calculating a check sum for the entire
directory.
You only need to specify the location of files whose authenticity you're trying to maintain next.
Select checksum format
are usually signed using one of the versions of the M.D 5 and SH algorithms in the Internet
will select S.A.G. one next which is the option that generates file signatures create digest in this
way a signature for all the files that are contained in a specific directory will be created.
The picture below shows checksums for all the files.
This is a great utility for documenting system legacy.
It is better applied to documents than to system files as the latter are often modified on a regular
basis.
Once you've generated a checksum for the files and a modification is understood as an attack this would
end in a flood of false positives.
There has to be another solution for system files.
Checksums are effective for ordinary files.
The best solution would be to verify a checksum for all read files to come from unknown trusted source
a trusted website should also be considered an untrusted source files downloaded from these sites should
be treated as an untrusted source for binary files.
As far as system files are concerned it's good to use the sig check program.
This is a tool that is a component of the system internals package.
It's lunch from the command line run as administrator the tool was developed by Mark Rowsthorn of which
sync check allows us to verify digital signatures for all the files in a selected location.
It covers either all the files or only the Bioneers
system directory should not contain any unsigned files or files that are signed in an incorrect way
or they used an invalid certificate for generating their signatures.
All checksums have to match.
Let's run a quick test for the system directory.
To scan only the binary is select the option
will also check the signers of the files.
The I option
the test results show an example of a correctly sized file.
You can view the issuer of the certificate used to sign the file and see if the certificate is trusted.
I will add the option to the submitted expression
this command should not return any results.
As you can see all files are signed in all signatures are correct.
Using this tool you can check the authenticity of key system files on a regular basis.