Remote Forensic Investigations For The Win

Comments, chapters, ... Slides Search
Loading Click here to add:
Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

55 views

If you’re performing incident handling, you probably already faced this situation: “Friday, 5PM, your phone rings because a customer detected some suspicious activity on a server or a workstation. Of course, it must be investigated “as soon as possible”. The server is physically located 500km away, not easy to start to investigate. Why not use a toolbox that can be booted on any system (server, workstation, physical, virtual, cloud, …) and launch some investigations in a safe way but under the customer’s control and supervision?

During this talk, I’ll present you “Bitscout”, a customizable live CD based on free tools and created to perform remote forensic investigations. This project was created by Vitaly Kamluk but I already submitted some pull requests to improve the project and used it in real cases!

After a quick review of an incident handling process and its classic issues, I will present the tool itself and compare it to classic solutions based on agents. The architecture will be described and several use cases will be demonstrated (ex: booting the compromized server, take a memory image, scanning the filesystem, etc). Several demos will be prepared (crossing fingers ;-)

Speaker

Xavier Mertens

Creation date: July 1, 2020
Speakers: Xavier Mertens
License: CC BY-SA v4
Links:

Other media in the channel "2020"