Home > Security Tips > Scott Sidel's Downloads > Digital forensics tool Helix 'does no harm'
Security Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

SCOTT SIDEL'S DOWNLOADS

Digital forensics tool Helix 'does no harm'


Scott Sidel
04.20.2007
Rating: --- (out of 5)


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


Around 5,300 years ago, a man traveled through the Otz Valley in the Austrian Alps. High up in the icy mountains, he met his death. He laid buried beneath a glacier for millennia, until the melting glacier revealed his body in 1991. Sixteen years later, forensics discovered that the Glacier Mummy (nicknamed "Otzi") had been murdered.

I viewed "Otzi" myself in Bolzano, Italy, and gained a new respect for forensics' ability to tell how Otzi had met his end. While digital forensics is a different skill set, it's one that every information security team should develop for investigating security events. Digital forensics reveals attack methods, highlights defense weaknesses and suggests which countermeasures to put in place to avoid a repeat attack.

For more information on digital forensics

Feds are seeking new digital forensics tools. Executive Editor Dennis Fisher explains why. 

Learn more about the "CSI" approach to information security.
Forensics toolkits probe potentially compromised systems while respecting Hippocrates's dictum, "First, do no harm." To forensically probe without altering key systems or data, I suggest turning to Helix. Helix is an incident response and computer forensics toolkit based on the popular Knoppix Live bootable CD. It contains dozens of tools for incident response on Windows and Linux systems.

Helix is easy to use; just put the Helix Live CD into a machine and boot from the CD drive. The Helix CD provides the OS and tools to audit and copy data from a suspect machine. Booting into Helix provides a graphical menu for accessing forensics tools. The tools allow for bit-for-bit copies of data to other media, providing the ability to recover deleted files, detect viruses (hacked systems are often booby-trapped to destroy evidence), search out rootkits (used to hide hacker tracks) and look for hidden data using stegonographic methods.

Considering the last documented update of Helix was in October 2006, its writing tools are becoming dated. New obstacles are arising as a result of the challenges posed by Windows Vista's BitLocker's AES-encrypted drive volumes. They create the need for new tools that capture memory states for assessment. Disk encryption creates the need for new tools that can capture memory states in order to recover executable strings unpacked into RAM and copy them for later analysis.

Most important to the success of a digital forensics investigation is the ability to understand and interpret the recovered data. That means not only keeping forensics tools on hand, but also continuously training our teams to decipher and understand what is meaningful within the data. All in all, Helix is a solid tool for enabling the digital forensics process.

  • Read Sidel's previous article: BackTrack is one forward-thinking penetration testing tool.

    About the author:
    Scott Sidel is an Information Systems Security Officer (ISSO) with Lockheed Martin.

    Rate this Tip
    To rate tips, you must be a member of SearchSecurity.com.
    Register now to start rating these tips. Log in if you are already a member.




    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Information Security Incident Response
    Product review: Mandiant Intelligent Response 1.0
    Worst practices: Bad security incidents to avoid
    Incident response success in five quick steps
    The forensics mindset: Making life easier for investigators
    What are the roles of a liaison officer?
    Data breach costs soar
    What are the proper procedures for handling a potential insider threat?
    Black Hat 2007: Estonian attacks were a cyber riot, not warfare
    Endpoint Security
    The cost of data breaches: Looking at the hard numbers
    Information Security Incident Response Research

    Open Source Security Tools
    Using Nessus Attack Scripting Language (NASL) to find application vulnerabilities
    What are best practices for creating an IDS and maintaining a signature database?
    How to install and configure Nessus
    How to run a Nessus system scan
    Nessus: Vulnerability scanning in the enterprise
    Nessus 3 Tutorial
    Screencasts: On-screen demonstrations of today's IT tools
    Screencast: An introduction to the Open Source Security Testing Methodology Manual (OSSTMM)
    Ophcrack: Password cracking made easy
    Will Cisco's plan to open access to the IOS improve network security?

    Scott Sidel's Downloads
    Ophcrack: Password cracking made easy
    Nipper audits routers, reveals insecure settings
    Enigmail: Wrapping email in a digital security blanket
    Secure file copying with WinSCP
    FreeRADIUS: Acing a secure connection
    Spiceworks: Free network monitoring and management with a little zest
    VirusTotal: On-demand antivirus service scans malicious files
    Shining a spotlight on rootkits
    Closing the case on network firewall security with IPCop
    Eliminating the threat of spam email attacks

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    disaster recovery plan  (SearchSecurity.com)
    incident response  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary

    DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

  • TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineWebcastsWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts