John Wiley & Sons Practical Cyber Intelligence Cover Overview of the latest techniques and practices used in digital forensics and how to apply them to t.. Product #: 978-1-394-25609-9 Regular price: $91.50 $91.50 Auf Lager

Practical Cyber Intelligence

A Hands-on Guide to Digital Forensics

Jakobsen, Adam Tilmar

Cover

1. Auflage Juli 2024
240 Seiten, Hardcover
Wiley & Sons Ltd

ISBN: 978-1-394-25609-9
John Wiley & Sons

Weitere Versionen

epubmobipdf

Overview of the latest techniques and practices used in digital forensics and how to apply them to the investigative process

Practical Cyber Intelligence provides a thorough and practical introduction to the different tactics, techniques, and procedures that exist in the field of cyber investigation and cyber forensics to collect, preserve, and analyze digital evidence, enabling readers to understand the digital landscape and analyze legacy devices, current models, and models that may be created in the future. Readers will learn how to determine what evidence exists and how to find it on a device, as well as what story it tells about the activities on the device.

Over 100 images and tables are included to aid in reader comprehension, and case studies are included at the end of the book to elucidate core concepts throughout the text.

To get the most value from this book, readers should be familiar with how a computer operates (e.g., CPU, RAM, and disk), be comfortable interacting with both Windows and Linux operating systems as well as Bash and PowerShell commands and have a basic understanding of Python and how to execute Python scripts.

Practical Cyber Intelligence includes detailed information on:

* OSINT, the method of using a device's information to find clues and link a digital avatar to a person, with information on search engines, profiling, and infrastructure mapping
* Window forensics, covering the Windows registry, shell items, the event log and much more
* Mobile forensics, understanding the difference between Android and iOS and where key evidence can be found on the device

Focusing on methodology that is accessible to everyone without any special tools, Practical Cyber Intelligence is an essential introduction to the topic for all professionals looking to enter or advance in the field of cyber investigation, including cyber security practitioners and analysts and law enforcement agents who handle digital evidence.

About the Author xviii

Preface xix

Acknowledgments xx

Introduction xxi

1 Intelligence Analysis 1

1.1 Intelligence Life Cycle 1

1.2 Cyber Threat Intelligence Frameworks 10

1.3 Summary 13

2 Digital Forensics 15

2.1 Device Collection 16

2.2 Preservation 17

2.3 Acquisition 18

2.4 Processing 19

2.5 Analysis 20

2.6 Documentation and Reporting 21

2.7 Summary 22

3 Disk Forensics 23

3.1 Acquisition 23

3.2 Preparation 25

3.3 Analysis 25

3.4 File and Data Carving 31

3.5 Summary 32

4 Memory Forensics 33

4.1 Acquisition 34

4.2 Analysis 35

4.3 Summary 38

5 SQLite Forensics 39

5.1 Analyzing 40

5.2 Summary 43

6 Windows Forensics 45

6.1 New Technology File System (NTFS) 45

6.2 Acquisition 51

6.3 Analysis 52

6.4 Evidence Location 60

6.5 Summary 93

7 macOS Forensics 95

7.1 File System 95

7.2 Security 97

7.3 Acquisition 98

7.4 Analysis 100

7.5 Evidence Location 100

7.6 Summary 104

8 Linux Forensics 105

8.1 File System 105

8.2 Security 107

8.3 Acquisition 108

8.4 Analysis 109

8.5 Evidence Location 109

8.6 Summary 115

9 iOS 117

9.1 File System 117

9.2 Security 118

9.3 Applications 119

9.4 Acquisition 120

9.5 iCloud 122

9.6 Analysis 122

9.7 Evidence of Location 124

9.8 Summary 134

10 Android 137

10.1 File Systems 137

10.2 Security 137

10.3 Application 138

10.4 Acquisition 138

10.5 Analysis 145

10.6 Evidence of Location 146

11 Network Forensics 153

11.1 Acquisition 153

11.2 Analysis 158

11.3 Summary 165

12 Malware Analysis 167

12.1 Acquiring Malware Samples 168

12.2 Handling Malware Samples 169

12.3 Analysis 170

12.4 Summary 174

13 OSINT 177

13.1 Methodology 178

13.2 Documentation 179

13.3 Securing Yourself (OPSEC) 180

13.4 Search Engines 182

13.5 Profiling 184

13.6 Hunt for Data 189

13.7 Infrastructure Mapping 194

13.8 Automation of OSINT Tasks 208

13.9 Summary 209

14 Case Studies 211

14.1 Case of "The Missing Author" 211

14.2 The Insider Threat 212

15 Ending 213

15.1 What's the Next Step? 213

Index 215
Adam Tilmar Jakobsen works for the Danish National Police Agency's special crime unit hunting down cyber criminals. Throughout his career he has worked on international cases with Europol and the FBI. Adam's journey into cybersecurity and intelligence began in the Danish Army Intelligence, where he honed his skills in SIGINT, OSINT, HUMINT, and all-source intelligence. In this role, he executed a wide range of defense, intelligence, and attack missions. Transitioning to Bluewater Shipping, Adam initially served as a Solution Architect before pivoting towards information security, where he oversaw critical security operations.

A. T. Jakobsen, National Cybercrime Centre (NC3), Denmark