c2b_default

Bruce Nikkel App_forensic_artifacts.pdf

Bruce Nikkel App_forensic_artifacts.pdf

Bruce Nikkel App_forensic_artifacts.pdf

15
0.0 (0)
R. Z.
Étudier
R. Z.
This flashcard set delves into the intricate world of application forensic artifacts, tailored for university-level computer science students. It focuses on the analysis of files, data, and images, using various tools and programs to dissect applications and their meta-information. The set covers dynamic and static analysis techniques, the examination of executable files, and the extraction of metadata from different file types. It is particularly useful for those interested in digital forensics, malware analysis, and understanding the hidden layers of application data, providing insights into how to uncover and interpret these artifacts effectively.
Cartes-fiches
15
Utilisateurs
2
Langue
Anglais
Catégorie
Informatique
Niveau
Université
Créé / Mis à jour
20.06.2019 / 01.07.2020
  • 1  / 15

Cartes-fiches

What meta data can be found in files? (not from filesystem)

 

  • hidden information (visually redacted text)
  • deleted text / images form office docs
  • user infromation (who created? who edited?)
  • original file location (directory path)
  • timestamps and loaction info (GPS)
  • application used to create file
  • device used to record/capture images, sound, or video
  • edit history ("track changes")
  • technical details

What is EXIF data?

EXIF - EXchangeable Imagefile Format

  • standard metadata format for media files
  • extensible, most common compatible standard
  • many tools to extract info

What is the goal of deeper analysis of executable files?

The goal is to understand exactly what th program is doing (without having the original source code)

What could be gained from a deep analysis of an executable and what could be a problem in doing so?

Problem:

  • obfuscation
    • phishing kits and browser injects may us obfuscated javascript

What could be gained:

  • binaries could be malware samples form an attack (identification)
  • all binaries contain some meta information (segments, sections)
  • binaries like malware can be "reverse engineered"

What is static analysis?

Static analysis is when you:

  • anayze binary without exection
  • dissassembling (convert machine code to assemly language)
  • decompiling (convert to high level language like C)
  • IDA Pro, ollydbg are programs that can be used for static analysis

What is dynamic analysis?

Dynamic analysis is when you:

  • analyze binary during execution
  • dangerous, use sandboxes
  • Joebox, Cuckoo are tools that can be used.

Why is malware analysis not always done?

Malware analysis is a time consuming task requiring good knowledge of operating systems and how programs are compiled into assembly language.

Étudier