Home > Security Tips > Scott Sidel's Downloads > Digital forensics tool Helix 'does no harm'
Security Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

SCOTT SIDEL'S DOWNLOADS

Digital forensics tool Helix 'does no harm'


Scott Sidel
04.20.2007
Rating: --- (out of 5)


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


Around 5,300 years ago, a man traveled through the Otz Valley in the Austrian Alps. High up in the icy mountains, he met his death. He laid buried beneath a glacier for millennia, until the melting glacier revealed his body in 1991. Sixteen years later, forensics discovered that the Glacier Mummy (nicknamed "Otzi") had been murdered.

I viewed "Otzi" myself in Bolzano, Italy, and gained a new respect for forensics' ability to tell how Otzi had met his end. While digital forensics is a different skill set, it's one that every information security team should develop for investigating security events. Digital forensics reveals attack methods, highlights defense weaknesses and suggests which countermeasures to put in place to avoid a repeat attack.

For more information on digital forensics

Feds are seeking new digital forensics tools. Executive Editor Dennis Fisher explains why. 

Learn more about the "CSI" approach to information security.
Forensics toolkits probe potentially compromised systems while respecting Hippocrates's dictum, "First, do no harm." To forensically probe without altering key systems or data, I suggest turning to Helix. Helix is an incident response and computer forensics toolkit based on the popular Knoppix Live bootable CD. It contains dozens of tools for incident response on Windows and Linux systems.

Helix is easy to use; just put the Helix Live CD into a machine and boot from the CD drive. The Helix CD provides the OS and tools to audit and copy data from a suspect machine. Booting into Helix provides a graphical menu for accessing forensics tools. The tools allow for bit-for-bit copies of data to other media, providing the ability to recover deleted files, detect viruses (hacked systems are often booby-trapped to destroy evidence), search out rootkits (used to hide hacker tracks) and look for hidden data using stegonographic methods.

Considering the last documented update of Helix was in October 2006, its writing tools are becoming dated. New obstacles are arising as a result of the challenges posed by Windows Vista's BitLocker's AES-encrypted drive volumes. They create the need for new tools that capture memory states for assessment. Disk encryption creates the need for new tools that can capture memory states in order to recover executable strings unpacked into RAM and copy them for later analysis.

Most important to the success of a digital forensics investigation is the ability to understand and interpret the recovered data. That means not only keeping forensics tools on hand, but also continuously training our teams to decipher and understand what is meaningful within the data. All in all, Helix is a solid tool for enabling the digital forensics process.

  • Read Sidel's previous article: BackTrack is one forward-thinking penetration testing tool.

    About the author:
    Scott Sidel is an Information Systems Security Officer (ISSO) with Lockheed Martin.

    Rate this Tip
    To rate tips, you must be a member of SearchSecurity.com.
    Register now to start rating these tips. Log in if you are already a member.




    BROWSE BY TAG
    Network Intrusion Detection and Analysis,   Enterprise Network Security,   Information Security Incident Response,   Application and Platform Security,   Open Source Security Tools and Applications,   Scott Sidel's Downloads,   VIEW ALL TAGS

    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Information Security Incident Response
    Data breach notification legislation: What info must be released?
    Incident response planning
    Mature SIMs do more than log aggregation and correlation
    New partnerships, creative thinking help security bust recession
    Senators hear call for federal cybersecurity restructuring
    Tying log management and identity management shortens incident response
    Tabletop exercises sharpen security and business continuity
    Security incident response 101
    Firms muddle security breach response, expert says
    Microsoft Conficker worm offers attack prevention lesson
    Information Security Incident Response Research

    Open Source Security Tools and Applications
    PuTTY configuration tips: How to connect to remote network systems
    Screencast: Find rogue wireless access points with Vistumbler
    Screencasts: On-screen demonstrations of security tools
    H.D. Moore on future of Metasploit attack platform
    H.D. Moore speaks about Metasploit Project deal, Release 3.3
    Screencast: How to launch an OpenVAS scan
    Could Metasploit popularity erode?
    Metasploit Project acquired by vulnerability management firm Rapid7
    SSH key compromise shuts down Apache website
    Screencast: Smoothwall offers firewall defense in lean times

    Scott Sidel's Downloads
    Use BotHunter for botnet detection
    Review system event logs with Splunk
    FISMA compliance made easier with OpenFISMA
    Ophcrack: Password cracking made easy
    Enigmail: Wrapping email in a digital security blanket
    Secure file copying with WinSCP
    FreeRADIUS: Acing a secure connection
    Spiceworks: Free network monitoring and management with a little zest
    VirusTotal: On-demand antivirus service scans malicious files
    Shining a spotlight on rootkits

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    incident response  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary

    DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.



  • Research Solutions for Network Security, Access Control and Security Threats
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2010, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts