You're reading from Digital Forensics with Kali Linux Perform data acquisition, data recovery, network forensics, and malware analysis with Kali Linux 2019.x

Product type Paperback

Published in Apr 2020

Publisher Packt

ISBN-13 9781838640804

Length 334 pages

Edition 2nd Edition

Tools

Kali Linux

Concepts

Forensics

Author (1):

Shiva V. N. Parasram

View More author details

Table of Contents (17) Chapters

Preface

1. Section 1: Kali Linux – Not Just for Penetration Testing

2. Chapter 1: Introduction to Digital Forensics FREE CHAPTER

3. Chapter 2: Installing Kali Linux

4. Section 2: Forensic Fundamentals and Best Practices

5. Chapter 3: Understanding Filesystems and Storage Media

6. Chapter 4: Incident Response and Data Acquisition

7. Section 3: Forensic Tools in Kali Linux

8. Chapter 5: Evidence Acquisition and Preservation with dc3dd and Guymager

9. Chapter 6: File Recovery and Data Carving with foremost, Scalpel, and bulk_extractor

10. Chapter 7: Memory Forensics with Volatility

11. Chapter 8: Artifact Analysis

12. Section 4: Automated Digital Forensic Suites

13. Chapter 9: Autopsy

14. Chapter 10: Analysis with Xplico

15. Chapter 11: Network Analysis

16. Other Books You May Enjoy

Capturing packets using Wireshark

Wireshark is a very popular and well-known tool used for network and packet analysis and troubleshooting. It comes pre-installed in Kali Linux and is relatively straightforward to use once you have an idea about filters, protocols, and color codes.

If you're new to the Wireshark protocol analyzer and packet analysis, you can find some great tutorials online, including the official documentation at https://www.wireshark.org/docs/wsug_html_chunked/ChapterCapture.html.

Before we begin using Wireshark, let's see what our network interfaces are first. We'll need to specify the interface we want to begin capturing packets on when we start Wireshark. To get information on your interfaces in Kali Linux, open Terminal and type ifconfig:

Figure 11.1 – Viewing the network adapter configurations

In the previous screenshot, the ifconfig command displays the output for two interfaces. The interface I'll be...