Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 25 guests and 1 member online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Looking to get into the forensics field, few questions.
EH-Net
May 25, 2013, 09:01:08 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: 1 [2]   Go Down
  Print  
Author Topic: Looking to get into the forensics field, few questions.  (Read 14297 times)
0 Members and 1 Guest are viewing this topic.
H0nd0CSI
Newbie
*
Offline Offline

Posts: 17


H0nd0


View Profile WWW
« Reply #15 on: September 23, 2010, 09:12:42 AM »

Great point! Let me offer a double edge sword response since one side the blade is sharper than the other, yet both will in the end cut down that tree. It is all about silently whetting your axe before you go out to cut that tree.
There is a way to guaranteed success in life. Most people don't take it because they are too impatient to even try it. They think it will take too long when in reality it is an effective REAL shortcut.

So the focus for most is to pass that darn exam, but in reality once you pass the exam, very few gained the 2nd objective which is probably the most important. Gain the practical experience to perform the Pen Test or Digital Forensics investigation.

You need to weigh the pros and cons here:

Let’s say you choose to take the CHFI first, the question you need to ask yourself is? Would you have the ability to truly think like a hacker in order to catch a hacker? If you spend more time learning about how and what techniques /  tools the nefarious evil hacker will use? Your investigations will be far more successful because you have better knowledge to make a more precise technical guess-timate.

After acquiring an image of your evidence the contents of image files are analyzed to identify evidence that either supports or contradicts a hypothesis or for signs of tampering (to hide data)

I taught a lady that was certified as an FTK or Encase investigator having never learnt anything about hacking etc, and after her training she was so thankful that she could improve her investigations many times over. Cause she was able to grasp a much deeper and broader understanding of how the break-in happened so she knew more precisely where to look for the evidence.

We need to think outside the box here. Rather than cramming so much material into a very short period of time like when you attend ILT classes next year perhaps look at a Blended Learning Approach for CEH and them continue with your plan of attending CHFI next year.

One of the biggest challenges when I teach ILT classes which is not very often anymore!  Is HOW THE HELL AM I GOING TO GET THROUGH SO MUCH MATERIAL in 5 days? And end with a result that I am confident the learner will go-out and succeed. It’s for this reason that I created CEH, CHFI etc SWAT, Blended Learning style.

Firstly you get the entire lecture and demo based video’s, plus weekly live 2 hour mentoring sessions by me. Most importantly you have the time to gain the much needed practical skills by slowing down your learning pace to a more comfortable level. Mastering each topic, from a theoretical and practical hands-on approach.

http://www.sequrit.org/study-options.html

We have been beta testing this model for a long time now and I can honestly say the end results are like way beyond expectations! 40 to 50% improvements of the learners understanding and practical know how to get the job done.

We are offering for a very limited time and low cost an opportunity for those who are still skeptical about blended learning the chance to experience the difference it will make to your ultimate goals.

Hope this will help you folks? Adios

Wayne
Logged

"If the only tool you have is a hammer, you tend to see every problem as a nail"
Abraham Maslow
H0nd0CSI
Newbie
*
Offline Offline

Posts: 17


H0nd0


View Profile WWW
« Reply #16 on: September 23, 2010, 09:40:17 AM »

Hey folks, I noticed I messed up on a URL for our LMS which is:

www.secureia.com/portal

"If anyone is interested to learn more about these topics send us an email info@sequrit.org and we can arrange a few free video modules from each course. That way you don't take my word but rather test the waters yourself. Our LMS web address is www.secure.com/portal"

I want to just check with Don if he approves I will make available to EH Net subscribers a few free modules from our library. Like I said before my aim is to help everyone learn with the least amount of time and effort LOW COST....  Peace-Out
Logged

"If the only tool you have is a hammer, you tend to see every problem as a nail"
Abraham Maslow
Joshsevo
Sr. Member
****
Offline Offline

Posts: 278


View Profile
« Reply #17 on: September 23, 2010, 01:40:37 PM »

Wayne,

Thanks for taking time out of your day and explaining it to me.  I appreciate it.  I spoke the guys at my interne and after I explained what you are telling me to do they completly agree, "become a hacker and think like one, before you can try and figure out what they did to a network or file etc".

They are just worried about when I can get my CHFI because then I will be worth more to them and can then handle evidence and such.

Logged

Security+, Network+, C|EH, CHFI, CPT
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #18 on: September 24, 2010, 10:37:22 AM »

Let’s say you choose to take the CHFI first, the question you need to ask yourself is? Would you have the ability to truly think like a hacker in order to catch a hacker? If you spend more time learning about how and what techniques /  tools the nefarious evil hacker will use? Your investigations will be far more successful because you have better knowledge to make a more precise technical guess-timate.

Sorry but I have to disagree with you here. Forensics and hacking are completely separate arenas and while it may help to understand hacking, hacking overall has less to do with forensics than you make out to be. Forensics from my perspective consist of determining what occurred on an machine/network/device and you don't necessarily have to know how to hack in order to determine what occurred and how it occurred.

After acquiring an image of your evidence the contents of image files are analyzed to identify evidence that either supports or contradicts a hypothesis or for signs of tampering (to hide data)

Either supports or contradicts? No. Your role as a forensics investigator is to determine in an unbiased fashion what occurred period. You're not focused on "supporting" or "contradicting" anyone. You're goal is to provide solid evidentiary information which at some point may be used in a court of law. You're not a judge, you're not a lawyer's or DA's assistant. You're role is to provide your expertise on the events that occurred on the evidence in question.

I taught a lady that was certified as an FTK or Encase investigator having never learnt anything about hacking etc, and after her training she was so thankful that she could improve her investigations many times over. Cause she was able to grasp a much deeper and broader understanding of how the break-in happened so she knew more precisely where to look for the evidence.

Being a systems administrator or a network administrator would yield the same amount of experience. Should a RHCE shoot for the CHFI, EnCE, CCE? Forensics and hacking are two different arenas period. I understand where you're coming from but if you're going to focus on forensics, there is a LOT MORE you will need to know that you should be focusing your time on. I know "uber" pentesters with enough certifications to fill a page who know little about file system formats. Yet their certified, they've read books, but haven't gotten a clue. I don't think at any point in time someone NEEDS to learn hacking in order to become a good forensics investigator.

I also know people who work at Fortune 10's (not 50's, not 100's, not 500's but the top 10) who do incident response, forensics, who've taught in Universities, learned under Eugene Spafford, etc., and they can't hack their way out of a wet paper bag with a chainsaw.

One of the biggest challenges when I teach ILT classes which is not very often anymore!  Is HOW THE HELL AM I GOING TO GET THROUGH SO MUCH MATERIAL in 5 days? And end with a result that I am confident the learner will go-out and succeed. It’s for this reason that I created CEH, CHFI etc SWAT, Blended Learning style.

One my pet peeves is, "take this X day course!", "you'll be an expert!" I've read and had the opportunities over the years to correspond with people like Dan Farmer when he made Titan (as I was creating a BSD version), Wietse Venema and others who are legends in the forensics industry. Guess what, not one hacks. It takes a lot more than just "take this bootcamp...", "EC-Council" and other things you've mentioned in your post.

While I (again), understand why you would *think* someone may benefit from learning C|EH content, the reality is *drum roll* studying C|EH material is mainly useless and the time and money could be well spent elsewhere.  *posters note* I hold the C|EH and CHFI... Have had them for years now... Have been tinkering slash dealing with security before EC-Council was even an idea.

My suggestion would be to learn A+ content, understand filesystem structures, how memory works, how and where cache and virtualized memory work and where do they store data. Focus on networking and operating systems. You'll be better off at the end of the day than worrying about learning 50+ questions on NMAP. "Why can't you run an NMAP XMAS scan on Windows 98"... How is this (real world C|EH question) going to help someone understand forensics.

Logged

Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #19 on: September 26, 2010, 11:50:53 PM »

I work in both forensics and hacking.  I can tell form experience that they definitely complement each.  However, like sil mentioned, they are entirely different animals.  While hacking knowledge provides a certain insight into a hacking case, we have plenty of good forensics investigators that are capable of catching a hacker without any hacking knowledge what-so-ever.  They are mostly ex-cops and ex-feds with serious investigative backgrounds.  That's the part that's key.  Don't forget that very few investigation deal with hackers. 

While you can teach the technical knowledge required for forensics work, in my experience, the investigative skills almost entirely come from experience.  A good investigator has solved enough cases where he or she can easily assume the role of the person their investigating, regardless of the circumstances.  Think of a detective in a serial killer investigation.  The detective obvious has been in the shoes of a killer, but he is able to think like one.

Those are just my two cents.
Logged

~~~~~~~~~~~~~~
Ketchup
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #20 on: September 27, 2010, 12:25:13 PM »

Um, just to set the stage for a truce on the subject I'd suggest people mentally break any conversation on this topic into two areas: forensics and incident response. As soon as you start using those terms it helps to highlight what skill sets fall into one versus the other.  Definitely not a 100% solution but it works.  I manage ethical hacking teams, forensics teams, and an IR team, and being very clear on the description of what needs to occur goes a long way to making sure the right people end up on the right projects.  Ethical hackers all the way on the offensive, incident response guys on the defensive/reactive end, and "pure" forensics guys typically acting in the image/find/testify/etc role. Not quite offensive or defensive.  The IR guys typically have both a forensic and pen testing background so that they can understand what they are seeing and make logical decisions on where to go in the environment for the next stage of the investigation.  Individuals tend to be more skilled in one side or the other but understand the concepts of both.  Please note, the IR guys might not end up acting in the pure forensics role for a variety of reasons, but the most common is lack of legal/LE experience.  They don't understand court and don't want to get grilled as an expert witness.  Again, this post was meant to break away from the monolithic use of the work "forensics", nothing more.

Oh, and I'll probably be posting job openings for all three.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
Pages: 1 [2]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.063 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.