Perl Scripting for Windows Security Live Response, Forensic Analysis, and Monitoring

I decided to write this book for a couple of reasons. One was that I’ve now written a couple of books that have to do with incident response and forensic analysis on Windows systems, and I used a lot of Perl in both books. Okay ”¦ I’ll come clean ”¦ I used nothing but Perl in both books! What I’ve seen as a result of this is that many readers want to use the tools, but don’t know how ”¦ they simply aren’t familiar with Perl, with interpreted (or scripting) languages in general, and may not be entirely comfortable with running tools at the command line. Another reason for writing this book is that contrary popular belief, there is no single application available that does everything or provides every function an incident responder could possibly need. By “popular”, I’m primarily referring to those folks who don’t perform incident response on a regular basis, as well as those who hire and have contracts with fi rms that provide incident responders and other consultants. Many times, incident responders (such as myself ) will show up on-site will a pelican case full of equipment, CDs and DVDs full of tools and code, all of which provides a base capability. From there, what data to retrieve and how to view, manipulate, and present that data is dependant upon the customer ”¦ and no two are alike. In the years that I have been performing incident response and computer forensics, while I have had customers with similar requirements, no two engagements have been identical. Talking to other consultants, I have heard the same thing. There simply is no such thing as an application xiii xiv Preface www.syngress.com that will read Event Log fi le, web and FTP server log fi les, or perhaps entire images, and simply give you your answer (was the system compromised, by whom, and when) at the push of a button. Signifi cant amounts of data collection, review, reduction, analysis, and presentation are required, and many times I fi nd myself writing Perl scripts to perform one or more of those functions. In fact, I have found these scripts to be useful enough that for some, I have documented them, cleaned them up a bit, and provided them for public consumption. I really need to point out that this book is not about computer forensic analysis. The purpose of this book is to show what can be (and has been) done, using Perl, to perform incident response,computer forensic analysis, and application monitoring on Windows systems. This book is about using Perl to complete computer incident response, forensic analysis tasks, and application monitoring, not about the tasks themselves, or the actual analysis