이 콘텐츠는 선택한 언어로 제공되지 않습니다.

10.4. Investigating the Incident


Investigating a computer breach is like investigating a crime scene. Detectives collect evidence, note any strange clues, and take inventory on loss and damage. An analysis of a computer compromise can either be done as the attack is happening or post-mortem.
Although it is unwise to trust any system log files on an exploited system, there are other forensic utilities to aid in the analysis. The purpose and features of these tools vary, but they commonly create bit-image copies of media, correlate events and processes, show low level file system information, and recover deleted files whenever possible.
It is also a good idea to record of all of the investigatory actions executed on a compromised system by using the script command, as in the following example:
 script -q <file-name>
Replace <file-name> with file name for the script log. Always save the log file on media other than the hard drive of the compromised system — a floppy disk or CD-ROM works particularly well for this purpose.
By recording all your actions, an audit trail is created that may prove valuable if the attacker is ever caught.

10.4.1. Collecting an Evidential Image

Creating a bit-image copy of media is a feasible first step. If performing data forensic work, it is a requirement. It is recommended to make two copies: one for analysis and investigation, and a second to be stored along with the original for evidence in any legal proceedings.
You can use the dd command that is part of the coreutils package in Red Hat Enterprise Linux to create a monolithic image of an exploited system as evidence in an investigation or for comparison with trusted images. Suppose there is a single hard drive from a system you want to image. Attach that drive as a slave to the system and then use dd to create the image file, such as the following:
 dd if=/dev/hdd bs=1k conv=noerror,sync of=/home/evidence/image1 
This command creates a single file named image1 using a 1k block size for speed. The conv=noerror,sync options force dd to continue reading and dumping data even if bad sectors are encountered on the suspect drive. It is now possible to study the resulting image file or even attempt to recover deleted files.
Red Hat logoGithubRedditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

© 2024 Red Hat, Inc.