Abstract:In the analysis of a compromised system, it is important to identify what has been compromised, recover as much useful state information as possible, and restore the system to a usable, but less vulne...In the analysis of a compromised system, it is important to identify what has been compromised, recover as much useful state information as possible, and restore the system to a usable, but less vulnerable state. The purpose of this paper is to demonstrate the utility of system baselining as a technique that supports these goals. From a forensic point of view, the ability to detect change correctly and consistently is a top priority. When computers are accessed in an unauthorized manner, the state of various file objects will change. This change can manifest itself in various ways ‐ slow system response, additional daemons in the process table, lost or damaged data, et cetera. Unfortunately, without the tools and techniques to detect and evaluate such change, systems could operate for quite some time, perhaps indefinitely, without exceeding operational limits generally considered to be abnormal. Using tools and techniques that are “court worthy” will get the job done without ruling out the possibility of pursuing legal remedies. FTimes ‐ a system baselining and evidence collection tool ‐ addresses these specific problems and goals and is well-suited to handle the types of applications and environments incident handler’s are likely to encounter.Read More
Publication Year: 2006
Publication Date: 2006-01-01
Language: en
Type: article
Access and Citation
Cited By Count: 2
AI Researcher Chatbot
Get quick answers to your questions about the article from our AI researcher chatbot