Digital Forensics 8 Flashcards
A packet is sent with the FIN flag turned on. If the port is open, this generates an error message. Remember that FIN indicates the communication is ended. Because there was no prior communication, an error is generated telling the hacker that this port is open and in use.
Fin Scan
sends a TCP packet to the target with the URG, PUSH, and FIN flags set. The alternating bits turn on and off in the flags byte.
Christmas Tree Scan
turns off all flags, creating a lack of TCP flags in the packet. This would never happen with real communications. It, too, normally results in an error packet being sent.
Null Scan
GET Request to read a webpage
HEAD Request to read just the head section of a webpage
PUT Request to write a webpage
POST Request to append to a page
DELETE Remove the webpage
LINK Connect two existing resources
UNLINK Break an existing connection between two resources
HTTP Commands
Even though a router is just a special-purpose computer running a routing program, getting evidence from a router is quite different from getting evidence from a PC, laptop, or server. The first major difference is that with a router, you do not shut down the device and image it. The reason is that once you shut it down, you will have potentially lost valuable evidence.
info …
he predicted that the trend would continue for at least 10 more years. In other words, he predicted, the number of transistors on an integrated circuit would double every 2 years for the next 10 years.
Moore’s Law
a protected computer is any computer at a financial institution or a government agency. This provision basically means that if someone hacks into a protected system, law enforcement officials can track down and intercept all that perpetrator’s communications if they reasonably believe it is relevant to the investigation.
USA Patriot Act
(For Papers) Must state sources can use : CERT, the Federal Bureau of Investigation (FBI), the Secret Service, and the Cornell University Law School are all very reputable sources.
Whatever tool you choose to use, the index.dat file is a fantastic source of forensic information that cannot be overlooked in your forensic investigation.
info …
