I-forensics yezinhlelo: umhlahlandlela ophelele nosebenzayo

Informatec Digital » Izinsiza » I-forensics yezinhlelo: umhlahlandlela ophelele nosebenzayo

Ukuhlolwa kwe-computer forensics kanye nokuphepha kwe-cybersecurity sekuyinto ebalulekile emabhizinisini, ezikhungweni zomthetho, kanye nochwepheshe be-forensic. Sihlala sinamathele kumafoni ethu, amakhompyutha, nazo zonke izinhlobo zamadivayisi axhunyiwe, ngakho-ke noma yisiphi isigameko sishiya umkhondo wedijithali, uma uhlaziywa kahle, ongabaluleka ophenyweni lobuchwepheshe noma lwezomthetho.

Nakuba kungase kuzwakale njengomkhakha othuthuke kakhulu namuhla, i-digital forensics yaqala ukubonakala ngawo-1980 ngokuthandwa kwamakhompyutha omuntu siqu, yaba ngochwepheshe ngawo-1990, futhi kwaze kwaba sekuqaleni kwekhulu lama-21 lapho amazwe afana ne-United States aqala khona ukwenza izinqubo zibe zijwayelekile, ikakhulukazi lapho kubhekene nokwanda okunonya kobugebengu be-inthanethi kanye nokusabalalisa ukuphoqelelwa komthetho.

Kuyini ukuhlolwa kwe-forensics kwezinhlelo futhi kungani kubaluleke kangaka?

Uma sikhuluma nge-systems forensics, sibhekisela emkhakheni wezobuchwepheshe-wesayensi othola, ulondoloze, ukhiphe futhi uhlaziye ubufakazi bedijithali kunoma iyiphi idivayisi ekwazi ukugcina noma ukucubungula idatha: amakhompyutha, omakhalekhukhwini, amaphilisi, ama-hard drive angaphandle, izinhlelo ze-IoT, ama-drones, izimoto ezixhunyiwe, amaseva amafu, amanethiwekhi, njll.

Umgomo akukhona nje ukubuyisa amafayela noma ukubona "okwenzekile," kodwa ukwakha kabusha amaqiniso ahlobene nesigameko ngokuthembekile : ukuthi yiziphi izinhlelo eziye zaphazamiseka, yiluphi uhlobo lobuchwepheshe olusetshenzisiwe, yiluphi ulwazi olukhishwe, ukuthi ubani owayenokufinyelela futhi ngasiphi isikhathi, futhi konke lokhu ngendlela engavikelwa enkantolo uma kudingeka.

Lolu hlobo lokuhlaziya luncike ezindleleni eziqinile zokuthola nokucubungula ubufakazi be-elekthronikhi ukuze kugwenywe ukushintsha isimo sabo sokuqala. Ngakho-ke kugcizelelwa ubuqotho, uchungechunge lokugcinwa, kanye nokwamukelwa: uma ubufakazi buphathwa kabi, bungcolisiwe, noma bungabhalwanga kahle, bungenqatshwa yijaji futhi buqede wonke umsebenzi wangaphambilini.

Njengoba umphakathi usuqhubekele phambili ku-inthanethi, ngokukhula kwe- cloud computing, umsebenzi osebenza kude, namadivayisi axhunyiwe , inani ledatha ekhiqizwa ngomuntu ngamunye liye landa kakhulu. Lokhu kuletha inselelo enkulu kubahlaziyi, kodwa futhi nethuba: lapho umkhondo wedijithali ukhula, amathuba okwakha kabusha ngokunembile isigameko sokuphepha kwe-inthanethi noma ubugebengu bezobuchwepheshe ayanda.

Yingakho i-digital forensics ibhekwa njengegatsha elibalulekile lamaphoyisa esayensi kanye nokuphepha kwe-inthanethi kwesimanje . Isekela uphenyo lobugebengu kanye nolwezombangazwe, isiza ekunqumeni icala ezimweni zokukhwabanisa ubuchwepheshe, izingxabano zabasebenzi, ukwephulwa kwedatha, kanye nokuhlaselwa kwe-ransomware , futhi isebenza nasekuthuthukiseni ukuzivikela kwangaphakathi kanye nezinqubomgomo.

Ukusetshenziswa okusebenzayo kokuhlaziywa kwe-forensic kwezokuphepha kwe-cyber

Emkhakheni wezokuphepha kwe-inthanethi, i-digital forensics isetshenziselwa ukuphenya izehlakalo ezifana nokungena ngenkani, ukwebiwa kweziqinisekiso, ubunhloli bezimboni, ukucekelwa phansi, noma ukwephulwa kwedatha . Umqondo uwukuthi, uma isigameko sesitholakele noma sisolwa, indawo ivikelekile futhi inqubo elawulwayo yokuqoqa nokuhlola ubufakazi bedijithali iyaqalwa.

Lo msebenzi wenzeka endaweni ehlukanisiwe, elawulwayo, futhi ebhalwe ngokucophelela , kusetshenziswa amathuluzi akhethekile avumela ukuhlolwa kwamadiski, ama-memory dumps , ama-system log, ithrafikhi yenethiwekhi, nezinye izinto zobuciko ngaphandle kokushintsha okwangempela. Umgomo ukuphendula imibuzo ebalulekile: ukuthi umhlaseli uthole kanjani ukufinyelela, yini ngempela ayenzile, idatha ayifinyelele, ukuthi bahlala isikhathi esingakanani ngaphakathi, nokuthi ngabe kukhona yini iminyango yangemuva esele.

Ngaphezu kokucacisa okwenzekile, ukuhlolwa kwe-cybersecurity kubalulekile ekuchazeni noma ekulungiseni izindlela zokuvikela : imithetho yomlilo, ukucushwa kwe-EDR, ukuhlukaniswa kwenethiwekhi, izinqubomgomo zephasiwedi, ukuqeqeshwa kwabasebenzisi, njll. Izinhlangano eziningi zisebenzisa okutholakele kokuhlaziywa kochwepheshe ukuze zibuyekeze i-ISMS yazo, zibukeze ukuhambisana kwazo nomthetho (isibonelo, ne-ISO 27001), noma ziqinise izilawuli ezibalulekile.

Futhi inesici esicacile sezomthetho: okutholakele kungavezwa embikweni wekhompyutha we-forensic ongasetshenziswa njengobufakazi ezinqubweni zomthetho, kungaba ubugebengu, umphakathi, abasebenzi, noma ezokuphatha. Lo mbiko uvame ukufaka indlela esetshenzisiwe, ubufakazi obubuyekeziwe, imiphumela etholakele, kanye neziphetho zobuchwepheshe ezichazwe ngendlela eqondakalayo kubahluleli nakubameli.

Ngaphezu kwalokho, i-cybersecurity forensics inikeza inzuzo eyengeziwe: ikhuthaza ukugenca ngokuziphatha kanye nemikhuba yokuhlola ukungena . Ukuqonda ukuthi izigebengu ze-cyber zihlasela kanjani ngempela kuvumela ukwakheka kwezivivinyo zokungena ezingokoqobo kakhulu kanye nezinhloso ezingcono zokuthuthukisa ingqalasizinda yenhlangano.

Ukuvela kwemvelo kanye nokukhula kobungcweti kwe-forensics yedijithali

Ukukhula kwe-digital forensics akugcini nje ngobuchwepheshe, kodwa futhi kubuchwepheshe. Izinkampani eziningi, izinkampani zomthetho, kanye nezinhlangano zomphakathi zidinga izinsizakalo ezikhethekile ze-computer forensics ngezigameko eziyinkimbinkimbi: ukukhwabanisa kwe-cryptocurrency, ukwebiwa kobunikazi, ubugebengu benzondo ezinkundleni zokuxhumana, ubunhloli phakathi kwabancintisana nabo, njalo njalo.

Izinhlangano zamazwe ngamazwe ezifana ne-INTERPOL zithuthukise ama-laboratories e-reference digital forensic , iziqondiso zomhlaba wonke zokusungula ama-laboratories kazwelonke, kanye nemikhuba emihle yokusingatha ubufakazi be-elekthronikhi. Ziphinde zikhuthaze izinhlelo zokuqeqesha, ukwakha amandla, kanye namanethiwekhi ochwepheshe ababelana ngolwazi kanye nezifundo zamacala.

Okwamanje, isidingo sochwepheshe abafanelekayo siyanda kakhulu. Izilinganiso ezifana nalezo ezivela e-U.S. Bureau of Labor Statistics zikhomba ukukhula okuphindwe kabili kwemisebenzi ye-computer forensics eminyakeni ezayo, ngamaphrofayili ahlanganisa ulwazi olujulile lobuchwepheshe kanye nokuqonda uhlaka lwezomthetho olusebenzayo.

Ukuze kuhlangatshezwane nalesi sidingo, kuye kwavela ama-bootcamps kanye nezinhlelo zokuphepha kwe-cyber ezijulile kanye nokugenca ngokuziphatha , kanye nezitifiketi zobuchwepheshe (i-CPHE, i-CSFPC, i-CSIO, i-CSCE, phakathi kwezinye) kanye nokuqeqeshwa okuthuthukisiwe ezindinganisweni zokuphepha kolwazi njenge-ISO 27001. Izinkampani eziningi zokuphepha kwe-cyber zinamaqembu ochwepheshe abagunyaziwe kanye nama-laboratory azo okuhlaziya ihadiwe, isofthiwe, amanethiwekhi, kanye nezinhlelo zokusebenza.

Kulesi simo, kuvela nezinsizakalo ezithile kakhulu, njengokubonisana nge-digital forensics okugxile ebhizinisini , lapho kuhlaziywa khona isigameko esithile (ubugebengu bokweba imininingwane ebucayi, ukuvuza kwedatha, ukukhwabanisa kwangaphakathi, ukucekelwa phansi, njll.), idatha esusiwe noma eyonakele iyatholakala, inkampani isekelwa enkambisweni yezomthetho futhi izinyathelo zokulungisa zenzelwe ukuvimbela isimo ukuthi singaphinde sivele.

Izinhlobo zokuhlaziywa kwe-forensic emkhakheni wezobuchwepheshe

Ngaphakathi kwesambulela esibanzi se-digital forensics, ubuchwepheshe obuningana buvame ukuhlukaniswa ngokusekelwe ohlotsheni lwemidiya noma indawo ehlaziywayo. Ngayinye inamasu namathuluzi ayo athile, yize zonke zinefilosofi efanayo: ukulondoloza, ukuhlaziya, nokuveza ubufakazi bedijithali ngokuthembekile.

Ngakolunye uhlangothi, kunezindlela zokuhlaziya zedijithali zendabuko zamakhompyutha edeskithophu nama-laptop , okuhloswe ngazo ukubuyisa amafayela, ukutadisha umsebenzi wabasebenzisi, kanye nokwakha kabusha izikhathi zemicimbi. Lokhu kuhilela izinhlelo zamafayela, amalogi esistimu yokusebenza, izinhlelo zokusebenza zehhovisi, iziphequluli zewebhu, njalo njalo.

Elinye igatsha elibalulekile ukuhlaziywa kwamadivayisi eselula (ama-smartphone, amaphilisi, ama-PDA, namadivayisi afanayo). Lawa madivayisi agcina inani elikhulu ledatha ebucayi: imiyalezo esheshayo, ama-imeyili, indawo, izithombe, izinhlelo zokusebenza zasebhange, nokuningi. Amathuluzi okuhlola ulwazi lweselula avumela ukukhishwa nokubhalwa kolwazi ngisho noma umsebenzisi ezama ukususa izingxoxo noma ukufometha idivayisi, noma ngisho nokubuyisa amafayela asusiwe ku-Android.

Kukhona futhi ukuhlaziywa kwesofthiwe , okugxila ekuphenyeni ikhodi yohlelo lokusebenza ukuze kutholakale ukuthi yebiwe, ishintshiwe, noma isengozini. Kubalulekile ezimweni zempahla yobuhlakani, ukuhlaziywa kwe-malware, noma ukuqinisekisa ubuqotho bezinhlelo zokusebenza ezibalulekile.

Ekugcineni, ukuhlaziywa kwememori nesitoreji kuyagqama , kugxile ekutadisheni okuqukethwe yi-hard drive, ama-USB drive, ama-SSD, kanye ne-RAM uqobo. Lokhu kuhlanganisa ukubuyisa idatha esusiwe, ukuhlaziya amavolumu abethelwe, ukuthola izinsalela ze-malware ehlala khona, kanye nokuhlonza idatha engakaze ibhalwe kudiski kodwa ehlala kumemori isikhathi esithile.

Izinto ezibalulekile zobuciko bezobunhloli ezinhlelweni ze-Windows

Ngokwezinto ezingokoqobo, izehlakalo eziningi zezinkampani zithinta izindawo ze-Windows. Lezi zinhlelo zikhiqiza inani elikhulu lezinto zobuciko zokuhlola : iminonjana emincane yomsebenzi, lapho ihlaziywa kahle, ivumela abaphenyi ukuthi banqume ukuthi umsebenzisi noma umhlaseli wenzeni kukhompyutha ethile.

I-forensics yedijithali ku-Windows igxile ekuboneni , ekulondolozeni, nasekufundeni lezi zinto zobuciko ngaphandle kokubeka engcupheni ubuqotho bazo . Nakuba idatha isakazeke ezindaweni ezahlukene zesistimu futhi eminye iyashintshashintsha, iningi layo lingaqoqwa kalula futhi linikeza ulwazi olunenani elikhulu lobufakazi.

Phakathi kwezinto ezibaluleke kakhulu yizingodo zemicimbi, amafayela e-Prefetch, izinqamuleli (i-LNK), i-Windows Registry enezinto zobuciko ezifana ne-Shimcache, i-Amcache kanye ne-ShellBags, kanye nolwazi mayelana namadivayisi axhunyiwe, izinhlelo zokuqala kanye namafayela asanda kuvulwa.

Abahlaziyi bahlanganisa lezi zinto zobuciko nedatha yenethiwekhi, ama-memory dumps, ama-application logs, kanye namapulatifomu e-SIEM afana ne-Wazuh ukuze bakhe kabusha izikhathi eziningiliziwe , bahlole ukusetshenziswa kwamathuluzi anonya, babonise ukusetshenziswa kwama-akhawunti athile, noma balandelele ukukhishwa kolwazi kumadivayisi angaphandle.

Kokubili ophenyweni lobugebengu nolwangaphakathi, lezi zinto zisiza ukuxhumanisa izenzo zobuchwepheshe nabantu kanye nemithwalo yemfanelo , into ebalulekile uma kukhulunywa ngokuxoshwa emsebenzini, izingxabano zesivumelwano, ukwephulwa kwezinqubomgomo noma izinqubo zokwahlulela ngokujwayelekile.

Amalogi Emicimbi kanye nenani lawo lobufakazi

Amalogi emicimbi ye-Windows angomunye wemithombo ecebile yolwazi. Agcina umlando onemininingwane yemicimbi yesistimu, ukuphepha, kanye nezinhlelo zokusebenza , aqoshwe kumafayela anesandiso se-.evtx esitholakala ku-C:\Windows\System32\winevt\Logs\.

Ngokombono wezobunhloli, izingodo zokuphepha zithakazelisa kakhulu , lapho imizamo yokungena ngemvume ehlulekile (umcimbi 4625), ukungena ngemvume okuphumelelayo (umcimbi 4624), izinguquko ezibalulekile ezinqubweni zokuphepha (umcimbi 4719) kanye nezinye izenzo eziningi ezihlobene nokuqinisekiswa nokulawulwa kokufinyelela ziqoshwa khona.

Ukuhlaziya lezi zenzakalo kukuvumela ukuthi ubone imizamo yokungena, ukuhlaselwa ngamandla amakhulu, ukwanda kwamalungelo, noma ukufinyelela ngemva kwamahora okusebenza . Kuwusizo kakhulu futhi ekuboneni ukuthi yimaphi ama-akhawunti asetshenziswe ngesikhathi sesigameko, ukuthi yimaphi amakheli e-IP axhumene nawo, noma ukuthi amapharamitha okuhlola ashintshiwe yini ukuze azame ukumboza amathrekhi awo.

Amalogi esistimu nezinhlelo zokusebenza nawo ahlinzeka ngezinkomba: ukuqala kabusha okungalindelekile, amaphutha esevisi, ukufakwa kwabashayeli abasolisayo, ukwehluleka kohlelo lokusebenza lokuphepha… Ngamathuluzi anjenge-Windows Event Viewer (eventvwr.msc), amathuluzi e-Sysinternals noma izikripthi ze-PowerShell, umhlaziyi angakwazi ukuhlunga, ukuthumela ngaphandle nokuhlanganisa ulwazi oluningi.

Ezimweni eziningi, izinsiza noma izinhlaka ezithile ezifana ne-Plaso (Log2Timeline) zisetshenziselwa ukuguqula la marekhodi abe umugqa wesikhathi ohlanganisiwe , obuyekezwa ngamathuluzi afana ne-Timeline Explorer, okwenza kube lula ukuhlonza amaphethini asolisayo kanye nokuxhumana nezinye izinto zobuciko.

Ukulanda kusengaphambili: umkhondo wezinhlelo ezisetshenzisiwe

Indlela ye-Windows' Prefetch yaklanywa ukuthuthukisa ukusebenza kwesistimu, kodwa ngokombono we-forensic, igolide elicwengekile. Njalo lapho uhlelo lokusebenza lusebenza, i-Windows ingadala ifayela le-Prefetch ngesandiso se-.pf kufolda ye-C:\Windows\Prefetch\.

Lawa mafayela aqukethe idatha mayelana nokuthi iyiphi i-executable eqaliswe, kusukela kuyiphi indlela, kangaki, nokuthi zingaki izikhathi ezilinganiselwe . Ngisho noma uhlelo lokuqala lususiwe kudiski, umkhondo walo ungase ube khona ku-Prefetch, okusiza ukufakazela ukuthi lusebenza ohlelweni.

Ukuziphatha kwe-Prefetch kushintshile: ezinguqulweni ezifana ne-Windows XP kuya ku-Windows 7 kwakulinganiselwe kumafayela angu-128; kusukela ku-Windows 8 kuqhubeke kuhlanganiswe ne-Superfetch (SysMain) futhi usayizi omkhulu uyandiswa, okuvumela umlando ocebile noningiliziwe wezinhlelo zokusebenza ezisetshenzisiwe.

Empeleni, abahlaziyi basebenzisa amathuluzi anjenge -PECmd noma i-WinPrefetchView ukukhipha nokubona ulwazi oluvela kulawa mafayela: amagama asebenzisekayo, izindlela, izitembu zesikhathi ezihambisanayo, namafayela ahlobene alayishwe ngesikhathi sokusebenza, kanye nezinsiza ezifana ne -Process Explorer ukuphenya izinqubo ezihlobene.

Lolu lwazi lungasetshenziswa ukuhlonza ukwenziwa kwe-malware, amathuluzi okuphatha akude, izikripthi zokuhamba ezisemaceleni, noma izinsiza ezisolisayo ezisetshenziswa umhlaseli wangaphakathi. Ngaphezu kwalokho, lungaqinisekisa imibiko yabasebenzisi mayelana nokuthi yiziphi izinhlelo zokusebenza abazisebenzisile nokuthi nini, okuwusizo kakhulu ekuphenyweni kwangaphakathi noma ukwephulwa kwedatha.

Amafayela e-LNK: izinqamuleli ezitshela cishe konke

Amafayela e-LNK, aziwa kakhulu ngokuthi izinqamuleli ze-Windows, angenye into yobuciko ebaluleke kakhulu. Isinqamuleli ngasinye sigcina imethadatha mayelana nefayela noma ifolda eqondiwe : indlela yokuqala, idivayisi yokugcina, izinsuku ezihambisanayo, nezinye izakhiwo.

Lawa mafayela adalwe, isibonelo, kudeskithophu yomsebenzisi noma kufolda yamadokhumenti akamuva (C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\), okuvumela ukwakhiwa kabusha kwamafayela avulwe muva nje nokuthi avela kuphi.

Ezindaweni zokuhlola, amafayela e-LNK awusizo kakhulu ekutholeni ukukhishwa kwedatha kuma-drive angaphandle , njengoba engagcina imininingwane yamadivayisi e-USB, njengezinombolo zochungechunge noma izinhlamvu ze-drive. Ngisho noma ifayela eliqondiwe lisusiwe noma i-USB drive ingasaxhunyiwe, isinqamuleli singagcina ulwazi oluyisihluthulelo.

Amathuluzi afana ne -LECmd noma i-ShellBagsExplorer akuvumela ukuthi ukhiphe futhi uhlaziye le datha ngobuningi, okusiza ekuboneni izindlela zenethiwekhi ezifinyelelwe, amagama amafayela abucayi, kanye nemikhuba yokusebenza yabasebenzisi. Izikripthi ze-PowerShell zingasetshenziswa futhi ukufaka uhlu nokuhlunga izinqamuleli ngosuku lokugcina lokuguqulwa.

Konke lokhu kusiza ekwakheni kabusha ukulandelana kwezenzo zomsebenzisi ngaphambi, ngesikhathi nangemva kwesigameko: ukuthi yimaphi amadokhumenti awavulile, ukuthi bawakopishe kudrayivu ye-USB, ukuthi ngabe basebenzise izinhlelo kusuka kufolda engajwayelekile, njll., ukuqinisa noma ukuphikisana nezinguqulo zemicimbi engqubuzaneni yangaphakathi noma inqubo yezomthetho.

I-Windows Registry: Ukucushwa, Ukuphikelela, kanye Nezindlela Zokusebenzisa

I-Windows Registry iyisizindalwazi esinohlu lwezinhlelo lapho uhlelo lokusebenza kanye nezinhlelo zokusebenza eziningi zigcina khona izilungiselelo, uhlu lwezinto zakamuva, kanye nedatha ephathelene namadivayisi . Ngokombono we-forensic, iyinqwaba yolwazi lokuqonda ukuthi ikhompyutha iziphatha kanjani nokuthi kwenzekeni kuyo.

Phakathi kwezinye izinto, iRegistry iqukethe izinhlelo eziqala ngokuzenzakalelayo ngohlelo , ezifanele ukuthola i-malware eqhubekayo noma amathuluzi okuphatha akude alayisha ebhuthini ngayinye. Iphinde ifake okhiye abaqoqa izigxivizo zeminwe zamadivayisi e-USB axhunyiwe, okusiza ukulandelela amadrayivu angaphandle asetshenziselwa ukukopisha idatha.

Elinye iqembu lezinto zobuciko ezifanele yiShimcache kanye ne-Amcache . Eyokuqala ikuvumela ukuthi wazi ukuthi yiziphi izinhlelo zokusebenza ezisebenze ohlelweni (nakuba kungenjalo ngaso sonke isikhathi ngesikhathi esiqondile), kanti eyesibili inikeza imininingwane enembile kakhulu: igama lefayela, indlela, i-SHA1 hash, kanye nezitembu zesikhathi ezahlukahlukene ezihlobene nokusebenza.

Ngaphezu kwalokho, amaShellBag agcinwe ngaphansi kwezinkinobho ezithile zeRegistry akuvumela ukuthi wakhe kabusha ukuthi yimaphi amafolda umsebenzisi awazulazulile ku-file explorer, noma ngabe lawo mafolda asusiwe kamuva. Lokhu kunikeza isithombe esicacile sokuthi yiziphi izindawo ezivakashelwe futhi kungaveza imizamo yokufihla noma yokulawula idatha.

Ukuze kuhlaziywe iRegistry, kusetshenziswa amathuluzi anjengeRegistry Explorer, i-RECmd, noma i-RegRipper , azenzakalela ukukhipha izingxenye ezifanele futhi ethule ulwazi ngendlela efundekayo kumhlaziyi. Futhi, lokhu kuvame ukuhlanganiswa neminye imithombo ukuqinisekisa okutholakele nokuqinisa iziphetho.

Izigaba zokuhlaziywa kwe-forensic kwekhompyutha okwenziwe kahle

Ngale kwamathuluzi nemishini, okubalulekile ukulandela inqubo ehlelekile nehlelekile . Ukuhlaziywa kwe-forensic okungahlelekile kungenza ubufakazi bungasebenzi, kudale ukungabaza ecaleni, noma kuholele ekuchazeni kabi.

Empeleni, izigaba eziningana zivame ukuhlukaniswa. Okokuqala, ucwaningo lokuqala lwesigcawu sedijithali , lapho izinhlelo ezihilelekile zitholakala khona, indawo ezungezile ivikelekile ukuze kuvinjelwe umonakalo owengeziwe, futhi kunqunywe ububanzi bokuhlaziywa. Lesi yisikhathi sokuvimba ukufinyelela okungadingekile, ukulondoloza izingodo, nokuvumelana nenhlangano ngokuthi umsebenzi uzokwenziwa kanjani.

Okulandelayo kuza ukuhlonza nokufaka ubufakazi ohlwini : uhlu lwamadivayisi, ama-akhawunti, izinsizakalo, ama-backup, nanoma yiziphi ezinye izinto ezingase zibe nedatha efanele. Lapha, kubalulekile ukunquma ukuthi yiziphi izinhlelo ezizothathwa ngeso lengqondo futhi uzibeke phambili ngokuya ngobucayi kanye nokuguquguquka kolwazi.

Isigaba sokuthola idatha sihilela ukukhiqiza amakhophi e-forensic ama-bit-by-bit ama-disk, ama-partitions, imemori, noma ama-container, ngokuvamile kusetshenziswa ama-write blockers ukuze kugwenywe ukushintsha okwangempela. Lesi yisisekelo sakho konke; uma lesi sigaba senziwa ngendlela engafanele, umsebenzi osele ungase ungamukeleki.

Uma idatha isivikelwe, ukuhlaziywa kwangempela kuyaqala : ukubuyekeza amafayela, amalogi, amarekhodi, ama-memory dumps, izinto zobuciko ze-Windows, nanoma yimiphi eminye imithombo efanele. Amathuluzi azenzakalelayo ahlanganiswa nokubuyekezwa ngesandla, kwakhiwa izikhathi, futhi izingcezu ziyahlanganiswa kuze kube yilapho kuvela isithombe esicacile sesigameko.

Isinyathelo sokugcina ukulungiselela umbiko wochwepheshe , ochaza ngezinyathelo ezithathiwe, indlela esetshenzisiwe, ubufakazi obubuyekeziwe, kanye neziphetho zobuchwepheshe. Kumele ubhalwe ngokunembile, kodwa futhi ngolimi olufinyeleleka kubantu abangebona ochwepheshe, ngoba uzovame ukwethulwa kubahluleli, abameli, noma amakomidi aqondisayo.

Izindlela ezinhle kakhulu zokuhlaziya i-forensic ezinhlelweni ze-Windows

Ukuze uphenyo lwe-forensic ku-Windows lube luhle, akwanele ukwazi izinto zobuciko; kubalulekile ukuhlonipha uchungechunge lwemikhuba emihle enciphisa amathuba okuba namaphutha futhi iqinisekise ukuthi iziphetho zilungile.

Isinyathelo sokuqala ukuthola isithombe sobunhloli esithembekile, esingaqinisekiswa, nesiphindaphindwayo sohlelo oluhlaziyiwe ngokubala nokubhala phansi ama-hashes ngaphambi nangemva kwekhophi. Lokhu kuvumela ukusebenza kuma-duplicate ngaso sonke isikhathi, kushiye okwangempela kuphelele uma kwenzeka kudingeka ukuqinisekiswa okuzimele.

Esinye isincomo esibalulekile ukwakha izikhathi zesikhathi ezinemininingwane ezihlanganisa ulwazi oluvela ku-Event Logs, Prefetch, Registry, amafayela e-LNK, ShellBags, njll. Amathuluzi afana ne-Plaso (Log2Timeline) asiza ukudala ukulandelana kwezikhathi okukodwa, okube sekubuyekezwa ukuze kutholakale ukuhlobana okusolisayo phakathi kwemicimbi.

Kubalulekile futhi ukubeka phambili ukuhlaziywa ngokusekelwe kumongo wesigameko . Akuzona zonke izinto zobuciko ezifaneleka ngokulinganayo kuzo zonke izimo: ekuhlaselweni kwe-ransomware, izinhlelo zokuqala kanye nomsebenzi wokubethela kuzoba nesithakazelo esikhulu; ekuphulweni kwedatha, umlando wamadivayisi e-USB kanye nezinqamuleli zakamuva kuzoba okubaluleke kakhulu.

Ukwenza imisebenzi ephindaphindwayo ngokuzenzakalela kungenye iphuzu elibalulekile. Ukusebenzisa amathuluzi nezikripthi ukuqoqa, ukuhlunga, nokufingqa idatha ye-forensic kusindisa isikhathi, kunciphisa amaphutha abantu, futhi kuvula isikhala esengeziwe sokuhlaziywa kwezinga eliphezulu. Noma kunjalo, akukho mbiko ongathi sína okufanele uthembele kuphela emiphumeleni ezenzakalelayo: ukubuyekezwa okubucayi ngumhlaziyi kuyadingeka njalo.

Okokugcina, kubalulekile ukubhala phansi isinyathelo ngasinye senqubo ku-log yokuhlaziya . Ukurekhoda ukuthi yimiphi imiyalo ekhishwayo, yiziphi izithombe ezikhiqizwayo, yiziphi amathuluzi asetshenziswayo nokuthi yiziphi izinguqulo, kanye nanoma yiziphi izehlakalo ngesikhathi senqubo, kusiza ukugcina uchungechunge olucacile lokugcinwa futhi kuvumela ukuvikelwa komsebenzi ezimweni zomthetho noma zokuhlolwa kwamabhuku.

Indima yochwepheshe bezobunhloli kanye nama-laboratory akhethekile

Lonke lolu hlelo lobuchwepheshe ludinga ochwepheshe abanenhlanganisela eyinkimbinkimbi yamakhono. Uchwepheshe omuhle wezokuphepha kwe-inthanethi akazi nje kuphela ukuthi asetshenziswa kanjani amathuluzi, kodwa futhi unokuqonda okujulile kwezinhlelo zokusebenza, amanethiwekhi, ihadiwe, imithethonqubo yezomthetho, kanye nezinqubo zokwahlulela.

Izinkampani eziningi zokuphepha kwe-inthanethi zisungule amalabhu ocwaningo lwe-forensic asezingeni eliphezulu , ahlonyiswe ngesofthiwe ekhethekile yokuhlaziya amadivayisi eselula, ukukhipha nokukhipha idatha, amathuluzi okuhlaziya inethiwekhi, amapulatifomu okuhlaziya i-malware, kanye nezixazululo ezithile zobuhlakani be-cyber.

Lawa ma-laboratory anikeza izinsizakalo zokuhlaziya ulwazi lwangaphambili kuzo zonke izinhlobo zehadiwe nesofthiwe : amakhompyutha, amaphilisi, omakhalekhukhwini (i-Windows, i-Android, i-iOS), ama-hard drive, ama-USB drive, izinhlelo zokusebenza zemiyalezo ezifana ne-WhatsApp, i-imeyili, izizindalwazi, amakhasi ewebhu, amanethiwekhi angaphakathi nokuningi.

Ngaphezu kokwenza ukuhlaziywa ngokwako, balungiselela imibiko yochwepheshe ephelele ehlangabezana nezidingo zenqubo futhi banikeze ukwesekwa emacaleni, ekuxazululeni amacala, noma ekuxazululeni amacala ngaphandle kwenkantolo. Amaningi ala maqembu anezitifiketi eziqashelwayo zokuphepha kolwazi kanye nokugenca ngobugebengu, okwengeza ekwethembekeni kwawo kobuchwepheshe.

Okwamanje, izinkampani ezinolwazi oluningi ezinhlelweni kanye nezinhlelo zigcwalisa izinsizakalo zazo zokuhlaziya i-forensic ngokuhlolwa kokungena kanye nokubonisana ngokuvimbela . Ngale ndlela, aziphenduli nje kuphela ezigamekweni ezedlule kodwa futhi zisebenzisa ulwazi olutholwe ukuqinisa ukuzivikela, ukuqeqesha abasebenzi, kanye nokunciphisa indawo yokuhlasela yesikhathi esizayo.

Uma sibheka lo mkhakha uwonke, i-forensics yezinhlelo isibe ithuluzi elibalulekile lokuqonda kahle ukuhlaselwa kwe-cyber, ukunquma umthwalo wemfanelo, ukubuyisa ulwazi, kanye nokuthuthukisa ukuphepha . Endaweni lapho ubugebengu be-cyber budlangile khona futhi idatha isibe yimpahla ebalulekile, ukuba nochwepheshe nezinqubo eziqinile kwenza umehluko omkhulu phakathi kokusabela ngokungaboni nokwenza izinqumo ezinolwazi, ezisebenzayo, nezivikelekile ngokomthetho.