Computação forense em sistemas gnu/linux

First Responders Guide to Computer Forensics

Richard Nolan Colin O’Sullivan Jake Branson Cal Waits

March 2005

CERT Training and Education

HANDBOOK CMU/SEI-2005-HB-001

Pittsburgh, PA 15213-3890

First Responders Guide to Computer Forensics

CMU/SEI-2005-HB-001

Richard Nolan Colin O’Sullivan Jake Branson Cal Waits

March 2005

CERT Training and Education

Unlimited distribution subject to the copyright.

This report was prepared for the SEI Joint Program Office ESC/XPK 5 Eglin Street Hanscom AFB, MA 01731-2100 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientific and technical information exchange. FOR THE COMMANDER

Christos Scondras Chief of Programs, XPK This work is sponsored by the SEI FFRDC primary sponsor and the Commander, United States Army Reserve (USAR) Information Operations Command and USAR EIO. The Software Engineering Institute is a federally funded research and development center sponsored by the U.S. Department of Defense. Copyright 2005 Carnegie Mellon University. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and "No Warranty" statements are included with all reproductions and derivative works. External use.