Kali Linux is a Linux-based distribution that's widely used for penetration testing and digital forensics. This third edition is updated with real-world examples and detailed labs to help you take your investigation skills to the next level using powerful tools.
This new edition will help you explore modern techniques for analysis, extraction, and reporting using advanced tools such as FTK Imager, Hex Editor, and Axiom. You’ll cover the basics and advanced areas of digital forensics within the world of modern forensics while delving into the domain of operating systems. As you advance through the chapters, you'll explore various formats for file storage, including secret hiding places unseen by the end user or even the operating system. You’ll also discover how to install Windows Emulator, Autopsy 4 in Kali, and how to use Nmap and NetDiscover to find device types and hosts on a network, along with creating forensic images of data and maintaining integrity using hashing tools. Finally, you'll cover advanced topics such as autopsies and acquiring investigation data from networks, memory, and operating systems.
By the end of this digital forensics book, you'll have gained hands-on experience in implementing all the pillars of digital forensics: acquisition, extraction, analysis, and presentation – all using Kali Linux's cutting-edge tools.
Install Kali Linux on a Raspberry Pi4 and various other platforms
Run Windows applications in Kali Linux using Windows Emulator as WINE
Learn the importance of RAM, filesystem, data, and Cache in DFIR
Perform file recovery, data carving, and extraction using Magic Rescue
Explore the latest Volatility 3 framework and analyze the memory dump
Explore various ransomware types and discover artifacts for DFIR investigation
Perform full DFIR automated analysis with Autopsy 4
Become familiar with Network Forensic Analysis Tools (NFAT)
Become well-versed in incident response procedures and best practices