Table Of ContentIncident Response & Computer
Forensics, Third Edition
Jason T. Luttgens
Matthew Pepe
New York Chicago San Francisco
Athens London Madrid Mexico City
Milan New Delhi Singapore Sydney Toronto
2
Copyright © 2014 by McGraw-Hill Education (Publisher). All rights reserved. Printed in the United States of America.
Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in
any form or by any means, or stored in a database or retrieval system, without the prior written permission of
Publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but
they may not be reproduced for publication.
ISBN: 978-0-07-179869-3
MHID: 0-07-179869-2
e-Book conversion by Cenveo® Publisher Services
Version 1.0
The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-179868-6, MHID: 0-07-
179868-4.
McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions, or
for use in corporate training programs. To contact a representative, please visit the Contact Us pages at
www.mhprofessional.com.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence
of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no
intention of infringement of the trademark. Where such designations appear in this book, they have been printed with
initial caps.
Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of
the possibility of human or mechanical error by our sources, McGraw-Hill Education, or others, McGraw-Hill
Education does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for
any errors or omissions or the results obtained from the use of such information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education (“McGraw Hill”) and its licensors reserve all rights in and to
the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the
right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce,
modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any
part of it without McGraw-Hill’s prior consent. You may use the work for your own noncommercial and personal use;
any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with
these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR
WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE
OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED
THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY
WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its licensors do not
warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be
uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any
inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill
has no responsibility for the content of any information accessed through the work. Under no circumstances shall
McGraw-Hill and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar
damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility
of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause
arises in contract, tort or otherwise.
3
For Mom and Dad, who bought me my first computer when I was
thirteen years old—a Tandy 1000 SX—in 1988.
—Jason
For Christina.
—Matt
4
About the Authors
Jason T. Luttgens, who has worked in information security for nearly 20 years, is a
former Technical Director for the security consulting firm Mandiant. While at Mandiant,
Jason led dozens of sensitive investigations around the globe involving industrial
espionage, cardholder data theft, and other crimes within environments as large as
250,000 computer systems. Along with Jed Mitten, he created the log file analysis and
visualization tool Highlighter.
Prior to Mandiant, he served in NASA’s Office of Inspector General, Computer
Crimes Division, as a Technical Investigator. While at NASA, Jason’s duties included
computer forensics, incident response, research and development of forensics solutions,
forensics software and hardware testing, and training. During this time, he also
contributed to significant national-level investigations, including the 9/11 investigations.
Jason is a veteran of the United States Air Force who served in the Office of Special
Investigations (OSI) for four years. He was stationed at the Department of Defense’s
Computer Forensics Laboratory in Linthicum, Maryland, and his duties included
research and development of computer crime investigative technologies. As a Team
Chief for a four-person forensic analysis team, he personally performed computer
forensic examinations, incident response, and provided expert courtroom testimony.
Prior to his assignment with the Computer Forensics Laboratory, Jason was stationed at
the 18th Communications Squadron, Kadena Air Base, Okinawa, Japan. While at the
Kadena Air Base, he performed computer operations and systems analysis, network
applications support, network administration, engineering, security, and training
functions.
Jason holds a B.S. degree in computer science from George Mason University.
Matthew Pepe has worked in the digital forensics field since 1995, when a couple
of AFOSI agents saved him from being assigned to the Pentagon. He is currently a
Senior Technical Director and founder at Mandiant. At Mandiant, he has led numerous
investigations, served as a subject matter expert on the odd and unique facets of
Mandiant’s Incident Response program, and developed the forensic capabilities that are
in place today.
Prior to Mandiant, Matt was a technical investigator and forensic examiner at
Foundstone, Trident Data Systems, Sytex, and the United States Air Force Office of
Special Investigations (AFOSI). It was during these initial years at AFOSI that he was
given the opportunity to develop analytical skills and appreciate the process by which
investigative hypotheses are developed and tested. He also learned to love active
termination of differential SCSI.
Matt holds a Bachelor of Science degree in computer engineering from The George
5
Washington University.
Kevin Mandia is the Senior Vice President and Chief Operating Officer of FireEye.
He founded Mandiant in 2004 and had served as the Chief Executive Officer. Prior to
Mandiant, Kevin served as the Director of Computer Forensics at Foundstone. From
1993 to 1998, Kevin was an officer in the United States Air Force, where he served in
various capacities, including as a computer security officer in the 7th Communications
Group at the Pentagon, and later as a Special Agent in the Air Force Office of Special
Investigations (AFOSI). In 2011, Kevin was named Ernst & Young Entrepreneur of the
Year for the Greater Washington area. He holds a Bachelor of Science in computer
science from Lafayette College and earned a Master’s of Science in forensic science
from The George Washington University.
6
About the Contributors
Marshall Heilman has more than 14 years of experience in computer and information
security; more than seven of those years have been at Mandiant. He is currently a
Managing Director at Mandiant, responsible for incident response and security
assessment work. His areas of expertise include enterprise-wide incident response,
high-tech crime investigations, penetration testing, and secure network architecture and
design. He has worked many of the most damaging and public incidents companies have
experienced over the last seven years. He previously served as a Staff Sergeant in the
United States Marine Corps, where he also focused on computer and information
security.
Ryan Kazanciyan is a Technical Director with Mandiant and has 11 years of
experience in incident response, forensic analysis, and penetration testing. Since joining
Mandiant in 2009, he has led incident response and remediation efforts for dozens of
Fortune 500 organizations, focusing on targeted attacks, industrial espionage, and
financial crime. He has also helped develop Mandiant’s investigative methodologies,
forensic analysis techniques, and technologies to address the challenges posed by
skilled intruders in complex environments. As a lead instructor for Mandiant’s incident
response training, Ryan also regularly teaches classes for corporate security teams,
federal law enforcement, and at industry conferences. Prior to his work in incident
response, Ryan led and executed penetration tests for both private- and public-sector
clients. His background included red-team operations in Windows and Unix
environments, web application security assessments, and social engineering. Ryan holds
a Bachelor’s degree in computer science and a minor in economics from Duke
University.
7
About the Technical Editor
Curtis W. Rose is the President and founder of Curtis W. Rose & Associates LLC, a
specialized services company in Columbia, Maryland that provides computer forensics,
expert testimony, litigation support, computer intrusion response, and training to
commercial and government clients. Curtis is an industry-recognized expert with over
20 years of experience in investigations, computer forensics, and information security.
Curtis was a coauthor of Real Digital Forensics: Computer Security and Incident
Response, and was a contributing author or technical editor for many popular
information security books, including Handbook of Digital Forensics and
Investigations, Malware Forensics Field Guide for Windows Systems, Malware
Forensics Field Guide for Linux Systems, Malware Forensics: Investigating and
Analyzing Malicious Code, SQL Server Forensic Analysis, Anti-Hacker Toolkit, First
Edition, Network Security: The Complete Reference, and Incident Response and
Computer Forensics, Second Edition.
8
CONTENTS
Foreword
Acknowledgments
Introduction
Part I Preparing for the Inevitable Incident
1 Real-World Incidents
What Constitutes an Incident?
What Is Incident Response?
Where We Are Now
Why Should You Care About Incident Response?
Case Studies
Case Study #1: Show Me the Money
Case Study #2: Certificate of Authenticity
Concept of the Attack Lifecycle
So What?
Questions
2 IR Management Handbook
What Is a Computer Security Incident?
What Are the Goals of Incident Response?
Who Is Involved in the IR Process?
Finding IR Talent
The Incident Response Process
Initial Response
Investigation
Remediation
9
Tracking of Significant Investigative Information
Reporting
So What?
Questions
3 Pre-Incident Preparation
Preparing the Organization for Incident Response
Identifying Risk
Policies That Promote a Successful IR
Working with Outsourced IT
Thoughts on Global Infrastructure Issues
Educating Users on Host-Based Security
Preparing the IR Team
Defining the Mission
Communication Procedures
Deliverables
Resources for the IR Team
Preparing the Infrastructure for Incident Response
Computing Device Configuration
Network Configuration
So What?
Questions
Part II Incident Detection and Characterization
4 Getting the Investigation Started on the Right Foot
Collecting Initial Facts
Checklists
Maintenance of Case Notes
Building an Attack Timeline
Understanding Investigative Priorities
What Are Elements of Proof?
Setting Expectations with Management
So What?
Questions
5 Initial Development of Leads
Defining Leads of Value
Acting on Leads
10
