I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I need to choose an OS, and I was wondering: What should I choose, and why? If anyone could give me any pointers I should look out for, it would be much appreciated! Thanks
closed as off-topic by Adi, TildalWave, GdD, Steve, Iszi Feb 10 '14 at 19:50
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Adi, TildalWave, GdD, Steve
I would go for Kali Linux .
This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu.
In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.
The SANS sift kit/workstation (http://digital-forensics.sans.org/community/downloads) is very good if you're looking to learn about forensics, as it comprises things like autopsy and other open source tools which are commonly used. Little extra: http://www.forensicswiki.org/wiki/Main_Page this page helps A LOT when you're getting used to things.
When I was at university I used Backtrack Linux a LOT. It has a lot of forensics (and live forensics) tools preinstalled and it is designed to be used for these purposes - (albeit it is probably most famous for nefarious hacking and spying on suspected cow tippers etc)
It depends on the tool you choose. Forensic tools like Autopsy can run on several different operating systems. They can parse the filesystem of the image you've been given, and show you the contents of the files. If such a tool is written in Java, you can run it on Windows, Mac, or Linux.
In forensic work, you are not necessarily trying to "run" the software from the image. You often are simply looking at the files you collect from the system, and piecing together what happened based on file contents, file system attributes such as last-accessed-time, creator ID, etc. If you were to mount the file system in the OS and run programs that accessed those files, your own investigative activity would likely hide the very clues you are seeking to uncover.
But sometimes you won't have much of a choice. If you discover a file named foo.docx, a simple text editor will show you very little, and you will likely need to use Word to view it. That creates another problem: what if the file you're trying to examine contains a virus? Opening it in Word on your computer could subject you to exactly the same problems as the victim computer image you're looking at. In that case, you need to learn to use a virtual machine as a sandbox.
If you're comfortable with Linux, consider using Caine or Deft.
Both are distroes meant for forensics use, which means that by default they don't do anything that may modify the data, such as automatically mounting filesystems or activating swaps.
They also contain a lot of useful tools for the job.