PowerPoint Presentation

... ..

:

: ..: 1415 :

. , , . Windows Linux., .

2472/1997: 2867/2000: .. 150/2001: 99/93/ 3115/2003: .. 47/2005:

3471/2006: . 2472/1997 3783/2009: 3917/2011: , 4070/2012: , ,

, . 3 :

, hardware , operating system, file system, . , , .

:EnCase, File Checksum Integrity Verifier, hash Foremost, History Viewer, browsersPsTools, (, , logs, ...)pwdump, hash WindowsStreams, The Sleuth Kit, , file system

EnCase

File Scavenger

Process Explorer

The Sleuth Kit

, . , , .

, :Fport, Nmap, host ( , , ...)Snort, tcpdump Windump, tcptrace, TCP Wireshark,

Nmap

Wireshark

, , smartphone, tablet, PDA GPS. , , SMS/MMS, . , , , . , , Foroboto, MOBILedit!, iPhone Analyzer .

MOBILedit!

, . Linux, open-source . :CAINEKali Linux, BacktrackSIFT

Kali Linux

, email . server, .

1 email , .

1 FCIV checksum , , email.

1 email . Free MBOX File Viewer, Sent-1 Thunderbird.

1 checksum .

1 , . : . .

1

1 , .

1 BMP, .

1 , . MyLastSearch .

1 QuickStego , Registry Windows.

1 QuickStego , batch.

2 web form server.

server:

83.212.100.186. Wireshark interface Ethernet 2.

2 , : client 46.176.104.245. server 11 GET POST HTTP , . , () . 0,3 .

2 client , server No.

2 client , server Success. (4031) 11 , 226 wampp.

2 Hydra Kali Linux wordlist .

- " ", - . , , 2003"Incident Response & Computer Forensics", Second Edition, Kevin Mandia - Chris Posise - Matt Pepe, McGraw-Hill, 2003"How to use Forensic Toolkit v2.0 on Windows NT 4.0 Server", Maarten van Essen - Landis ICT Services & Consultancy, SANS Institute, 2002