Title: 4. Using Network Tools
Course: IN 2005 Digital Forensics > Section: Module 11: Chapter 11 - Virtual Machines, Network Forensics, and Live Acquisitions

Using Network Tools

1. Sysinternals is a collection of free tools for examining Windows products.  See Figure 11-4.
2. Some of the Sysinternals tools, including:
  - RegMon shows Registry data in real time
  - Process Explorer shows what is loaded
  - Handle shows open files and processes using them
  - Filemon shows file system activity
3. The main functions or commands from the PsTools suite developed by Sysinternals, including:
  - RegMon shows Registry data in real time
  - Process Explorer shows what is loaded
  - Handle shows open files and processes using them
  - PsExec runs processes remotely
  - PsGetSid displays security identifier (SID)
  - PsKill kills process by name or ID
  - PsList lists details about a process
  - PsLoggedOn shows who’s logged locally
  - PsPasswd changes account passwords
  - PsService controls and views services
  - PsShutdown shuts down and restarts PCs
  - PsSuspend suspends processes

Using UNIX/Linux Tools

1. Knoppix Security Tools Distribution (STD) is a bootable Linux CD intended for computer and network forensics.
2. The main tools for Knoppix, including:
  - dcfldd, the U.S. DoD dd version
  - memfetch forces a memory dump
  - photorec grabs files from a digital camera
  - snort, an intrusion detection system
  - oinkmaster helps manage your snort rules
  - john, latest version of John the Ripper
  - chntpw resets passwords on a Windows PC
  - tcpdump and ethereal are packet sniffers (see Figures 11-5 and 11-6)
3. With the Knoppix STD tools on a portable CD, you can examine almost any network system.
4. The main tool categories for The Auditor, another tool based on Knoppix with more than 300 tools:
  - Network scanning
  - Brute-force attack
  - Bluetooh and wireless
  - Autopsy and Sleuth Kit
  - Word lists with more than 64 million entries

Using Packet Sniffers

1. Packet sniffers are devices or software that monitor network traffic.  Most sniffers work at layer 2 or 3 of the OSI model.  In addition, most packet sniffer tools follow the PCAP format.
2. Network sniffers work. Some packets can be identified by examining the flags in their TCP headers.  See Figure 11-8.
3. Some of the most common network sniffer tools, including:
  - Tcpdump
  - Tethereal
  - Snort
  - Tcpslice
  - Tcpreplay
  - Tcpdstat
  - Ngrep
  - Etherape
  - Netdude
  - Argus
  - Ethereal (see Figures 11-9 through 11-11)