You're reading from Digital Forensics with Kali Linux Perform data acquisition, data recovery, network forensics, and malware analysis with Kali Linux 2019.x

Product type Paperback

Published in Apr 2020

Publisher Packt

ISBN-13 9781838640804

Length 334 pages

Edition 2nd Edition

Tools

Kali Linux

Concepts

Forensics

Author (1):

Shiva V. N. Parasram

View More author details

Table of Contents (17) Chapters

Preface

1. Section 1: Kali Linux – Not Just for Penetration Testing

2. Chapter 1: Introduction to Digital Forensics FREE CHAPTER

3. Chapter 2: Installing Kali Linux

4. Section 2: Forensic Fundamentals and Best Practices

5. Chapter 3: Understanding Filesystems and Storage Media

6. Chapter 4: Incident Response and Data Acquisition

7. Section 3: Forensic Tools in Kali Linux

8. Chapter 5: Evidence Acquisition and Preservation with dc3dd and Guymager

9. Chapter 6: File Recovery and Data Carving with foremost, Scalpel, and bulk_extractor

10. Chapter 7: Memory Forensics with Volatility

11. Chapter 8: Artifact Analysis

12. Section 4: Automated Digital Forensic Suites

13. Chapter 9: Autopsy

14. Chapter 10: Analysis with Xplico

15. Chapter 11: Network Analysis

16. Other Books You May Enjoy

What about the data?

In this chapter so far, we've looked at the various media for storing data. Now, I'd like to talk about the actual data itself, some of its states, and what happens when it's accessed.

Data states

Firstly, there's data in transit, also called data in motion. These states describe data on the move, perhaps traversing across the network between devices or even between storage media, actively moving between locations.

Then there's data in use. Data in this state is currently being accessed by a user or processed by a CPU. When data is accessed from the hard drive, it is temporarily stored in RAM, which is much faster than the hard drive (particularly mechanical drives) and stored there for as long as the user accesses it and there is power to the device.

When data is not in motion, transit, or in use, it is described as data at rest. In this state, the data rests or resides on non-volatile media such as hard drives, optical media...