{"id":935,"date":"2021-04-27T20:57:57","date_gmt":"2021-04-27T20:57:57","guid":{"rendered":"https:\/\/hackemall.live\/?p=935"},"modified":"2021-04-27T22:38:48","modified_gmt":"2021-04-27T22:38:48","slug":"forensic-roadmap","status":"publish","type":"post","link":"https:\/\/hackemall.live\/index.php\/2021\/04\/27\/forensic-roadmap\/","title":{"rendered":"Forensic Roadmap"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner-1024x421.png\" alt=\"\" class=\"wp-image-936\" width=\"768\" height=\"316\" srcset=\"https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner-1024x421.png 1024w, https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner-300x123.png 300w, https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner-768x316.png 768w, https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner-750x308.png 750w, https:\/\/hackemall.live\/wp-content\/uploads\/2021\/04\/forensic_banner.png 1399w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/figure>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\"><strong>Kh\u00e1i ni\u1ec7m<\/strong><\/h2>\n\n\n\n<p><strong>Digital Forensics (\u0111i\u1ec1u tra s\u1ed1) <\/strong>l\u00e0 m\u1ed9t nh\u00e1nh c\u1ee7a ng\u00e0nh khoa h\u1ecdc \u0111i\u1ec1u tra \u0111\u1ec1 c\u1eadp \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p, c\u00f4ng c\u1ee5 k\u1ef9 thu\u1eadt khoa h\u1ecdc \u0111\u00e3 \u0111\u01b0\u1ee3c ch\u1ee9ng minh \u0111\u1ec3 thu th\u1eadp, b\u1ea3o qu\u1ea3n v\u00e0 ph\u00e2n t\u00edch d\u1eef li\u1ec7u trong c\u00e1c thi\u1ebft b\u1ecb k\u1ef9 thu\u1eadt s\u1ed1 v\u1edbi m\u1ee5c ti\u00eau t\u00ecm ki\u1ebfm c\u00e1c ch\u1ee9ng c\u1ee9 thuy\u1ebft ph\u1ee5c \u0111\u1ec3 t\u00e1i hi\u1ec7n l\u1ea1i c\u00e1c s\u1ef1 ki\u1ec7n \u0111\u00e3 v\u00e0 \u0111ang di\u1ec5n ra nh\u1eb1m x\u00e1c \u0111\u1ecbnh c\u00e1c h\u00e0nh vi ph\u1ea1m t\u1ed9i hay h\u1ed7 tr\u1ee3 cho vi\u1ec7c d\u1ef1 \u0111o\u00e1n c\u00e1c ho\u1ea1t \u0111\u1ed9ng tr\u00e1i ph\u00e9p nh\u01b0 c\u1ed1 \u00fd x\u00e2m nh\u1eadp, t\u1ea5n c\u00f4ng ho\u1eb7c g\u00e2y gi\u00e1n \u0111o\u1ea1n qu\u00e1 tr\u00ecnh ho\u1ea1t \u0111\u1ed9ng c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n\n\n\n<p><em><strong>Khi n\u00e0o th\u00ec th\u1ef1c s\u1ef1 c\u1ea7n thi\u1ebft th\u1ef1c hi\u1ec7n m\u1ed9t cu\u1ed9c \u0111i\u1ec1u tra s\u1ed1?<\/strong><\/em><\/p>\n\n\n\n<ul><li>Khi h\u1ec7 th\u1ed1ng b\u1ecb t\u1ea5n c\u00f4ng m\u00e0 ch\u01b0a x\u00e1c \u0111\u1ecbnh \u0111\u01b0\u1ee3c nguy\u00ean nh\u00e2n.<\/li><li>Khi c\u1ea7n thi\u1ebft kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u tr\u00ean thi\u1ebft b\u1ecb, h\u1ec7 th\u1ed1ng \u0111\u00e3 b\u1ecb x\u00f3a \u0111i<\/li><li>Khi th\u1ef1c hi\u1ec7n \u0111i\u1ec1u tra t\u1ed9i ph\u1ea1m c\u00f3 li\u00ean quan \u0111\u1ebfn c\u00f4ng ngh\u1ec7 cao<\/li><li>\u0110i\u1ec1u tra s\u1ef1 gian l\u1eadn trong t\u1ed5 ch\u1ee9c<\/li><li>\u0110i\u1ec1u tra c\u00e1c ho\u1ea1t \u0111\u1ed9ng gi\u00e1n \u0111i\u1ec7p c\u00f4ng nghi\u1ec7p<\/li><\/ul>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\"><strong>M\u1ed9t s\u1ed1 lo\u1ea1i h\u00ecnh \u0111i\u1ec1u tra s\u1ed1 ph\u1ed5 bi\u1ebfn<\/strong><\/h2>\n\n\n\n<p>Ng\u00e0y nay d\u1eef li\u1ec7u s\u1ed1 c\u00f3 m\u1eb7t \u1edf kh\u1eafp m\u1ecdi n\u01a1i, t\u1eeb m\u00e1y t\u00ednh cho \u0111\u1ebfn c\u00e1c thi\u1ebft b\u1ecb di \u0111\u1ed9ng, thi\u1ebft b\u1ecb PDA, GPS, m\u00e1y t\u00ednh b\u1ea3ng. Tuy nhi\u00ean trong ph\u1ea1m vi b\u00e0i vi\u1ebft n\u00e0y, m\u00ecnh ch\u1ec9 gi\u1edbi thi\u1ec7u m\u1ed9t s\u1ed1 lo\u1ea1i h\u00ecnh \u0111i\u1ec1u tra s\u1ed1 tr\u00ean m\u00e1y t\u00ednh bao g\u1ed3m:<\/p>\n\n\n\n<ul><li><em><strong>Ph\u00e2n t\u00edch \u0111i\u1ec1u tra d\u1eef li\u1ec7u tr\u00ean \u1ed5 c\u1ee9ng:&nbsp;<\/strong><\/em>L\u00e0 vi\u1ec7c thu th\u1eadp, ph\u00e2n t\u00edch d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef tr\u00ean ph\u01b0\u01a1ng ti\u1ec7n l\u01b0u tr\u1eef v\u1eadt l\u00fd, t\u1eeb \u0111\u00f3 tr\u00edch xu\u1ea5t c\u00e1c d\u1eef li\u1ec7u \u1ea9n, kh\u00f4i ph\u1ee5c c\u00e1c t\u1eadp tin b\u1ecb x\u00f3a, qua \u0111\u00f3 x\u00e1c \u0111\u1ecbnh ng\u01b0\u1eddi \u0111\u00e3 t\u1ea1o ra nh\u1eefng thay \u0111\u1ed5i d\u1eef li\u1ec7u tr\u00ean thi\u1ebft b\u1ecb \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch, c\u0169ng nh\u01b0 t\u00ecm ki\u1ebfm nh\u1eefng b\u1eb1ng ch\u1ee9ng li\u00ean quan \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng x\u00e2m nh\u1eadp, gian l\u1eadn\u2026<\/li><li><em><strong>Ph\u00e2n t\u00edch \u0111i\u1ec1u tra d\u1eef li\u1ec7u m\u1ea1ng:&nbsp;<\/strong><\/em>L\u00e0 m\u1ed9t nh\u00e1nh c\u1ee7a&nbsp;\u0111i\u1ec1u tra s\u1ed1 li\u00ean quan \u0111\u1ebfn vi\u1ec7c theo d\u00f5i, gi\u00e1m s\u00e1t, ph\u00e2n t\u00edch l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng m\u00e1y t\u00ednh nh\u1eb1m ph\u1ee5c v\u1ee5 cho vi\u1ec7c thu th\u1eadp th\u00f4ng tin, s\u1ef1 ki\u1ec7n li\u00ean quan,\u0111\u1ec3 ph\u00e1t hi\u1ec7n s\u1ef1 b\u1ea5t th\u01b0\u1eddng, c\u00e1c d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp tr\u00ean m\u00f4i tr\u01b0\u1eddng m\u1ea1ng.<\/li><\/ul>\n\n\n\n<ul><li><em><strong>Ph\u00e2n t\u00edch \u0111i\u1ec1u tra d\u1eef li\u1ec7u tr\u00ean RAM<\/strong>:&nbsp;<\/em>L\u00e0 ph\u01b0\u01a1ng th\u1ee9c \u0111i\u1ec1u tra m\u00e1y t\u00ednh b\u1eb1ng vi\u1ec7c s\u1eed d\u1ee5ng ki\u1ebfn tr\u00fac qu\u1ea3n l\u00fd b\u1ed9 nh\u1edb trong m\u00e1y t\u00ednh \u0111\u1ec3 \u00e1nh x\u1ea1, tr\u00edch xu\u1ea5t c\u00e1c t\u1eadp tin \u0111ang th\u1ef1c thi v\u00e0 c\u01b0 tr\u00fa trong b\u1ed9 nh\u1edb RAM t\u1ea1i th\u1eddi \u0111i\u1ec3m h\u1ec7 th\u1ed1ng \u0111ang ho\u1ea1t \u0111\u1ed9ng, sau \u0111\u00f3 ti\u1ebfn h\u00e0nh ph\u00e2n t\u00edch l\u00e0m r\u00f5 c\u00e1c h\u00e0nh vi \u0111ang x\u1ea3y ra tr\u00ean h\u1ec7 th\u1ed1ng.<\/li><\/ul>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\"><strong>Ti\u1ebfp c\u1eadn l\u0129nh v\u1ef1c n\u00e0y nh\u01b0 th\u1ebf n\u00e0o?<\/strong><\/h2>\n\n\n\n<p>Sau khi gi\u1edbi thi\u1ec7u qua v\u1ec1 kh\u00e1i ni\u1ec7m v\u00e0 m\u1ed9t s\u1ed1 lo\u1ea1i h\u00ecnh \u0111i\u1ec1u tra s\u1ed1 ph\u1ed5 bi\u1ebfn, ch\u1eafc m\u1ecdi ng\u01b0\u1eddi \u0111\u00e3 c\u00f3 \u0111\u01b0\u1ee3c nh\u1eefng h\u00ecnh dung ban \u0111\u1ea7u v\u1ec1 l\u0129nh v\u1ef1c n\u00e0y. V\u1eady b\u00e2y gi\u1edd ch\u00fang ta n\u00ean ti\u1ebfp c\u1eadn nh\u01b0 th\u1ebf n\u00e0o? Sau \u0111\u00e2y m\u00ecnh \u0111\u01b0a ra m\u1ed9t s\u1ed1 g\u1ee3i \u00fd m\u00e0 c\u00e1c b\u1ea1n c\u00f3 th\u1ec3 tham kh\u1ea3o \u0111\u1ec3 x\u00e2y d\u1ef1ng cho m\u00ecnh m\u1ed9t l\u1ed9 tr\u00ecnh t\u1ed1t.<\/p>\n\n\n\n<ul><li><strong>N\u1eafm b\u1eaft \u0111\u01b0\u1ee3c quy tr\u00ecnh th\u1ef1c hi\u1ec7n bao g\u1ed3m c\u00e1c b\u01b0\u1edbc:<\/strong><ul><li><strong><em>Chu\u1ea9n b\u1ecb<\/em><\/strong><em>: <\/em>Th\u1ef1c hi\u1ec7n vi\u1ec7c m\u00f4 t\u1ea3 l\u1ea1i th\u00f4ng tin h\u1ec7 th\u1ed1ng, nh\u1eefng g\u00ec \u0111\u00e3 x\u1ea3y ra, c\u00e1c d\u1ea5u hi\u1ec7u, \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh ph\u1ea1m vi \u0111i\u1ec1u tra, m\u1ee5c \u0111\u00edch c\u0169ng nh\u01b0 c\u00e1c t\u00e0i nguy\u00ean c\u1ea7n thi\u1ebft s\u1ebd s\u1eed d\u1ee5ng trong su\u1ed1t qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra. Giai \u0111o\u1ea1n n\u00e0y cung c\u1ea5p m\u1ed9t c\u00e1i nh\u00ecn bao qu\u00e1t v\u1ec1 c\u00e1c th\u00f4ng tin li\u00ean quan \u0111\u1ebfn h\u1ec7 th\u1ed1ng b\u1ecb t\u1ea5n c\u00f4ng, th\u00f4ng tin v\u1ec1 h\u1ea1 t\u1ea7ng m\u1ea1ng, c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng \u0111\u00f3, c\u00e1c \u1ee9ng d\u1ee5ng ng\u0103n ch\u1eb7n x\u00e2m nh\u1eadp\u2026 \u0111ang \u0111\u01b0\u1ee3c tri\u1ec3n khai.<\/li><\/ul><ul><li><strong><em>Thu th\u1eadp d\u1eef li\u1ec7u: <\/em><\/strong>\u0110\u00e2y l\u00e0 giai \u0111o\u1ea1n quan tr\u1ecdng quy\u1ebft \u0111\u1ecbnh s\u1ef1 tin c\u1eady c\u1ee7a k\u1ebft qu\u1ea3 khi \u0111i\u1ec1u tra m\u1ed9t h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh b\u1ecb t\u1ea5n c\u00f4ng. T\u1ea5t c\u1ea3 d\u1eef li\u1ec7u li\u00ean quan \u0111\u1ebfn h\u1ec7 th\u1ed1ng c\u1ee7a m\u00e1y t\u00ednh c\u1ea7n \u0111\u01b0\u1ee3c thu th\u1eadp v\u00e0 \u0111\u1ea3m b\u1ea3o \u0111\u01b0\u1ee3c t\u00ednh to\u00e0n v\u1eb9n trong su\u1ed1t qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra. T\u00f9y v\u00e0o \u0111\u1eb7c \u0111i\u1ec3m, nghi\u1ec7p v\u1ee5 c\u1ee7a h\u1ec7 th\u1ed1ng, ng\u01b0\u1eddi ph\u00e2n t\u00edch ph\u1ea3i l\u1ef1a ch\u1ecdn c\u00e1ch thu th\u1eadp ph\u00f9 h\u1ee3p. Ng\u01b0\u1eddi ph\u00e2n t\u00edch c\u1ea7n ph\u1ea3i x\u00e1c \u0111\u1ecbnh k\u1ef9 thu\u1eadt s\u1ebd \u0111i\u1ec1u tra, \u0111\u1ec3 l\u1ef1a ch\u1ecdn c\u00e1ch thu th\u1eadp d\u1eef li\u1ec7u ph\u00f9 h\u1ee3p, ph\u1ea3i bi\u1ebft \u0111\u01b0\u1ee3c khi n\u00e0o th\u00ec c\u1ea7n th\u1ef1c hi\u1ec7n Dead Forensics, khi n\u00e0o th\u00ec ph\u1ea3i th\u1ef1c hi\u1ec7n Live Forensics \u0111\u1ec3 tr\u00e1nh v\u00f4 t\u00ecnh ph\u00e1 h\u1ee7y \u0111i nh\u1eefng d\u1eef li\u1ec7u quan tr\u1ecdng nh\u01b0 d\u1eef li\u1ec7u RAM, d\u1eef li\u1ec7u m\u1ea1ng.<\/li><\/ul><ul><li><strong><em>\u0110i\u1ec1u tra ph\u00e2n t\u00edch: <\/em><\/strong>S\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p nghi\u1ec7p v\u1ee5, c\u00e1c k\u1ef9 thu\u1eadt v\u00e0 c\u00f4ng c\u1ee5 kh\u00e1c nhau \u0111\u1ec3 tr\u00edch xu\u1ea5t, ph\u00e2n t\u00edch c\u00e1c d\u1eef li\u1ec7u thu \u0111\u01b0\u1ee3c \u0111\u1ec3 t\u00ecm ki\u1ebfm c\u00e1c ch\u1ee9ng c\u1ee9 li\u00ean quan \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng b\u1ea5t h\u1ee3p ph\u00e1p tr\u00ean h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh.<\/li><\/ul><ul><li><strong><em>L\u1eadp b\u00e1o c\u00e1o:<\/em><\/strong> Sau khi thu th\u1eadp \u0111\u01b0\u1ee3c nh\u1eefng ch\u1ee9ng c\u1ee9 c\u00f3 gi\u00e1 tr\u1ecb v\u00e0 c\u00f3 t\u00ednh thuy\u1ebft ph\u1ee5c th\u00ec t\u1ea5t c\u1ea3 ph\u1ea3i \u0111\u01b0\u1ee3c t\u00e0i li\u1ec7u h\u00f3a l\u1ea1i r\u00f5 r\u00e0ng, chi ti\u1ebft v\u00e0 b\u00e1o c\u00e1o l\u1ea1i cho b\u1ed9 ph\u1eadn c\u00f3 tr\u00e1ch nhi\u1ec7m x\u1eed l\u00fd ch\u1ee9ng c\u1ee9 thu \u0111\u01b0\u1ee3c, \u0111\u1ed9i ng\u0169 \u0111i\u1ec1u tra ph\u1ea3i \u0111\u01b0a ra c\u00e1c k\u1ef9 thu\u1eadt \u0111i\u1ec1u tra, c\u00e1c c\u00f4ng ngh\u1ec7, ph\u01b0\u01a1ng th\u1ee9c \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng, c\u0169ng nh\u01b0 c\u00e1c ch\u1ee9ng c\u1ee9 thu \u0111\u01b0\u1ee3c, t\u1ea5t c\u1ea3 ph\u1ea3i \u0111\u01b0\u1ee3c gi\u1ea3i th\u00edch r\u00f5 r\u00e0ng. B\u00e1o c\u00e1o ph\u1ea3i \u0111\u1ea3m b\u1ea3o t\u00ednh trung l\u1eadp v\u00e0 minh b\u1ea1ch).<\/li><\/ul><\/li><li><strong>X\u00e2y d\u1ef1ng m\u1ed9t h\u1ec7 th\u1ed1ng Lab \u0111\u1ec3 th\u1ef1c h\u00e0nh: <\/strong>C\u00f3 nhi\u1ec1u c\u00e1ch \u0111\u1ec3 b\u1ea1n d\u1ef1ng 1 Lab ph\u1ee5c v\u1ee5 vi\u1ec7c nghi\u00ean c\u1ee9u \u0111i\u1ec1u tra s\u1ed1, tuy nhi\u00ean m\u00ecnh \u1edf \u0111\u00e2y m\u00ecnh \u0111\u1ec1 xu\u1ea5t m\u1ecdi ng\u01b0\u1eddi c\u00e0i \u0111\u1eb7t SANS SIFT &#8211; M\u1ed9t m\u00f4i tr\u01b0\u1eddng \u0111i\u1ec1u tra s\u1ed1 tuy\u1ec7t v\u1eddi, t\u1eadp trung v\u00e0 ch\u1ecdn l\u1ecdc l\u1ea1i c\u00e1c c\u00f4ng c\u1ee5 \u0111i\u1ec1u tra sau \u0111\u00f3 t\u00edch h\u1ee3p s\u1eb5n trong m\u1ed9t h\u1ec7 th\u1ed1ng, n\u00f3 ch\u1ee9ng minh r\u1eb1ng \u0111i\u1ec1u tra chuy\u00ean s\u00e2u v\u00e0 \u1ee9ng ph\u00f3 v\u1edbi s\u1ef1 c\u1ed1 x\u00e2m nh\u1eadp c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 m\u00e3 ngu\u1ed3n m\u1edf v\u00e0 c\u1eadp nh\u1eadt th\u01b0\u1eddng xuy\u00ean, b\u1ed9 c\u00f4ng c\u1ee5 ch\u1ecdn l\u1ecdc n\u00e0y t\u00edch h\u1ee3p nh\u1eefng c\u00f4ng c\u1ee5 chuy\u00ean d\u1ee5ng nh\u01b0 Thesleuth Kit, DFF, Wireshark, Foremost, volatility, Hexeditor\u2026 B\u1ea1n c\u00f3 th\u1ec3 <a href=\"https:\/\/digital-forensics.sans.org\/community\/downloads\">t\u1ea3i SANS SIFT t\u1ea1i \u0111\u00e2y<\/a>. B\u00ean c\u1ea1nh c\u00f4ng c\u1ee5 c\u00f3 s\u1eb5n trong SANS SIFT b\u1ea1n c\u0169ng c\u1ea7n l\u00e0m quen d\u1ea7n c\u00e1c c\u00f4ng c\u1ee5 kh\u00e1c nh\u01b0 FTK, OSForensics, GRR, Network Miner, PowerForensics\u2026<\/li><li><strong>B\u1eaft tay v\u00e0o gi\u1ea3i quy\u1ebft <a href=\"https:\/\/www.honeynet.org\/challenges\/\">14 challenges c\u1ee7a HoneyNet<\/a>: <\/strong>Trong qu\u00e1 tr\u00ecnh gi\u1ea3i quy\u1ebft challenge b\u1ea1n s\u1ebd \u0111\u01b0\u1ee3c l\u00e0m quen v\u1edbi nhi\u1ec1u k\u1ef9 thu\u1eadt ph\u00e2n t\u00edch v\u00e0 c\u00e1c c\u00f4ng c\u1ee5 chuy\u00ean d\u1ee5ng khi \u0111i\u1ec1u tra s\u1ed1. C\u0169ng trong qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra, b\u1ea1n s\u1ebd ph\u1ea3i t\u00ecm ki\u1ebfm c\u00e1c ngu\u1ed3n th\u00f4ng tin h\u1ed7 tr\u1ee3 qua \u0111\u00f3 c\u1ee7ng c\u1ed1 \u0111\u01b0\u1ee3c nhi\u1ec1u ki\u1ebfn th\u1ee9c t\u1eeb ph\u00e2n t\u00edch d\u1eef li\u1ec7u m\u1ea1ng, ph\u00e2n t\u00edch memory, ph\u00e2n t\u00edch file system, ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c, kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u\u2026 N\u1ebfu b\u00ed qu\u00e1 th\u00ec b\u1ea1n c\u00f3 th\u1ec3 tham kh\u1ea3o c\u00e1ch ng\u01b0\u1eddi kh\u00e1c gi\u1ea3i quy\u1ebft challenge c\u1ee7a m\u00ecnh v\u00e0 \u00e1p d\u1ee5ng 1 k\u1ef9 thu\u1eadt t\u01b0\u01a1ng \u0111\u01b0\u01a1ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n.<\/li><\/ul>\n\n\n\n<p><strong>Xong 14 challenge c\u1ee7a HoneyNet th\u00ec c\u00e1c b\u1ea1n c\u00f3 th\u1ec3 t\u1ef1 \u0111i tr\u00ean \u0111\u00f4i ch\u00e2n c\u1ee7a m\u00ecnh, l\u00fac n\u00e0y b\u1ea1n \u0111\u00e3 c\u00f3 m\u1ed9t n\u1ec1n t\u1ea3ng t\u1ed1t v\u1ec1 \u0111i\u1ec1u tra s\u1ed1 v\u00e0 nhi\u1ec1u k\u1ef9 n\u0103ng \u0111\u01b0\u1ee3c c\u1ee7ng c\u1ed1 v\u00e0 c\u00f3 th\u1ec3 th\u1ef1c chi\u1ebfn \u0111\u01b0\u1ee3c, b\u1ea1n c\u00f3 th\u1ec3 xu\u1ed1ng n\u00fai \u0111\u1ec1 m\u00e0i d\u0169a th\u00eam trong giang h\u1ed3.<\/strong><\/p>\n\n\n\n<ul><li>Ti\u1ebfp t\u1ee5c tham gia c\u00e1c cu\u1ed9c thi CTF \u0111\u1ec3 r\u00e8n luy\u1ec7n th\u00eam kh\u1ea3 n\u0103ng t\u01b0 duy khi g\u1eb7p challenges m\u1edbi. Th\u01b0\u1eddng trong c\u00e1c cu\u1ed9c thi CTF \u0111\u1ec1u c\u00f3 m\u1ed9t ph\u1ea7n d\u00e0nh cho Forensics, v\u1edbi nh\u1eefng challenge th\u00fa v\u1ecb tr\u1ea3i \u0111\u1ec1u trong c\u00e1c m\u1ea3ng li\u00ean quan \u0111\u1ebfn \u0111i\u1ec1u tra s\u1ed1 \u0111\u1ec3 b\u1ea1n \u0111\u01b0\u1ee3c th\u1eed s\u1ee9c.<\/li><li>Ti\u1ebfp t\u1ee5c \u0111\u1ecdc s\u00e1ch: \u0110\u1eebng \u0111\u1ecdc nhi\u1ec1u qu\u00e1, nh\u01b0ng kh\u00f4ng th\u1ebf kh\u00f4ng \u0111\u1ecdc. Th\u01b0\u1eddng th\u00ec khi ti\u1ebfp c\u1eadn b\u1ea5t k\u1ef3 l\u0129nh v\u1ef1c n\u00e0o th\u00ec ch\u00fang ta hay c\u00f3 th\u00f3i quen \u0111\u1ecdc tr\u01b0\u1edbc th\u1ef1c h\u00e0nh sau, tuy nhi\u00ean m\u00ecnh mu\u1ed1n m\u1ecdi ng\u01b0\u1eddi th\u1ef1c h\u00e0nh \u0111\u1ec3 k\u00edch th\u00edch s\u1ef1 t\u00ecm t\u00f2i, t\u1eeb \u0111\u00f3 bi\u1ebft m\u00ecnh \u0111ang h\u1ed5ng \u0111\u00e2u v\u00e0 quay sang h\u1ec7 th\u1ed1ng l\u1ea1i ki\u1ebfn th\u1ee9c c\u1ee7a m\u00ecnh qua s\u00e1ch. Th\u1ef1c h\u00e0nh nhi\u1ec1u s\u1ebd r\u00e8n luy\u1ec7n k\u1ef9 n\u0103ng, kh\u1ea3 n\u0103ng t\u01b0 duy c\u00f2n \u0111\u1ecdc s\u00e1ch gi\u00fap m\u00ecnh c\u00f3 \u0111\u01b0\u1ee3c n\u1ec1n t\u1ea3ng v\u1eefng ch\u1eafc. T\u01b0\u01a1ng \u1ee9ng v\u1edbi c\u00e1c lo\u1ea1i h\u00ecnh \u0111i\u1ec1u tra ph\u1ed5 bi\u1ebfn, m\u00ecnh gi\u1edbi thi\u1ec7u m\u1ed9t s\u1ed1 cu\u1ed1n s\u00e1ch \u0111\u1ea1i di\u1ec7n cho 3 lo\u1ea1i h\u00ecnh tr\u00ean:<ul><li>The Art of Memory Forensics: S\u00e1ch cung c\u1ea5p ki\u1ebfn th\u1ee9c n\u1ec1n t\u1ea3ng gi\u00fap b\u1ea1n nghi\u00ean c\u1ee9u chuy\u00ean s\u00e2u v\u1ec1 ph\u00e2n t\u00edch \u0111i\u1ec1u tra s\u1ed1 tr\u00ean b\u1ed9 nh\u1edb RAM. Cu\u1ed1n s\u00e1ch n\u00e0y th\u00edch h\u1ee3p khi b\u1ea1n v\u1eeba \u0111\u1ecdc v\u1eeba th\u1ef1c h\u00e0nh v\u1edbi Volatility<\/li><\/ul><ul><li>File System Forensic Analysis: S\u00e1ch m\u00f4 t\u1ea3 chi ti\u1ebft \u1edf low-level v\u1ec1 file System v\u00e0 Volume System qua \u0111\u00f3 gi\u1edbi thi\u1ec7u c\u00e1c k\u1ef9 thu\u1eadt t\u00ecm ki\u1ebfm c\u00e1c ch\u1ee9ng c\u1ee9 t\u1eeb d\u1eef li\u1ec7u \u1ea9n, kh\u00f4i ph\u1ee5c c\u00e1c t\u1eadp tin b\u1ecb x\u00f3a v\u00e0 nh\u1eefng c\u00e2n nh\u1eafc trong qu\u00e1 tr\u00ecnh th\u1ef1c hi\u1ec7n \u0111i\u1ec1u tra. S\u00e1ch n\u00e0y th\u00edch h\u1ee3p khi b\u1ea1n v\u1eeba \u0111\u1ecdc v\u1eeba th\u1ef1c h\u00e0nh v\u1edbi b\u1ed9 c\u00f4ng c\u1ee5 \u201cThe sleuth kit\u201d.<\/li><\/ul><ul><li>Network Forensics: Tracking Hackers through Cyberspace: S\u00e1ch t\u1eadp trung v\u00e0o vi\u1ec7c m\u00f4 t\u1ea3 c\u00e1ch c\u00e1c giao th\u1ee9c ho\u1ea1t \u0111\u1ed9ng v\u00e0 l\u00e0m th\u1ebf n\u00e0o \u0111\u1ec3 thu th\u1eadp v\u00e0 ph\u00e2n t\u00edch d\u1eef li\u1ec7u m\u1ea1ng \u0111\u1ec3 t\u00ecm ki\u1ebfm c\u00e1c d\u1ea5u hi\u1ec7u \u0111\u00e1ng ng\u1edd \u0111ang \u0111\u01b0\u1ee3c \u201cl\u01b0u th\u00f4ng\u201d tr\u00ean m\u1ea1ng. S\u00e1ch n\u00e0y th\u00edch h\u1ee3p khi b\u00e0n v\u1eeba \u0111\u1ecdc v\u1eeba th\u1ef1c h\u00e0nh v\u1edbi Wireshark.<\/li><\/ul><\/li><li>Ki\u1ebfm m\u1ed9t c\u00f4ng ty l\u00e0m v\u1ec1 b\u1ea3o m\u1eadt \u0111\u1ec3 \u0111\u01b0\u1ee3c l\u00e0m vi\u1ec7c th\u01b0\u1eddng xuy\u00ean: V\u0103n \u00f4n, v\u00f5 luy\u1ec7n, n\u1ebfu ch\u1ec9 l\u00e0m Lab kh\u00f4ng th\u00ec b\u1ea1n s\u1ebd d\u1ec5 ch\u00e1n, cho n\u00ean ph\u1ea3i t\u00ecm m\u1ed9t c\u00f4ng ty c\u00f3 b\u1ed9 ph\u1eadn li\u00ean quan \u0111\u1ebfn \u0111i\u1ec1u tra s\u1ed1 \u0111\u1ec3 \u0111\u01b0\u1ee3c c\u1ecd x\u00e1t v\u00e0 luy\u1ec7n t\u1eadp th\u01b0\u1eddng xuy\u00ean. C\u00e1ch \u0111\u00e2y 10 n\u0103m \u1edf Vi\u1ec7t Nam kh\u00f4ng nhi\u1ec1u c\u00f4ng ty c\u00f3 b\u1ed9 ph\u1eadn n\u00e0y, tuy nhi\u00ean trong 2 n\u0103m tr\u1edf l\u1ea1i \u0111\u00e2y th\u00ec ph\u1ea7n l\u1edbn c\u00e1c c\u00f4ng ty ho\u1ea1t \u0111\u1ed9ng trong l\u0129nh v\u1ef1c an to\u00e0n th\u00f4ng tin, hay c\u00e1c h\u1ec7 th\u1ed1ng nh\u00e0 b\u0103ng \u0111\u1ec1u c\u00f3 \u0111\u1ed9i ng\u0169 chuy\u00ean tr\u00e1ch v\u1ec1 m\u1ea3ng n\u00e0y s\u1ebd m\u1edf ra r\u1ea5t nhi\u1ec1u c\u01a1 h\u1ed9i \u0111\u1ec3 c\u00e1c b\u1ea1n chinh chi\u1ebfn.<\/li><li>M\u1ed9t s\u1ed1 ngu\u1ed3n t\u00e0i nguy\u00ean tham kh\u1ea3o<ul><li><a href=\"https:\/\/forensicswiki.xyz\/page\/Main_Page\">Forensics Wiki<\/a>: Wiki li\u00ean quan \u0111\u1ebfn c\u00e1c th\u00f4ng tin v\u1ec1 \u0111i\u1ec1u tra s\u1ed1, tr\u00ean \u0111\u00f3 gi\u1edbi thi\u1ec7u c\u00e1c c\u00f4ng c\u1ee5, k\u1ef9 thu\u1eadt th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi ng\u01b0\u1eddi \u0111i\u1ec1u tra c\u0169ng nh\u01b0 m\u1ed9t s\u1ed1 papers, t\u1ed5 ch\u1ee9c v\u00e0 con ng\u01b0\u1eddi li\u00ean quan \u0111\u1ebfn l\u0129nh v\u1ef1c n\u00e0y.<\/li><\/ul><ul><li><a href=\"https:\/\/toolcatalog.nist.gov\/search\/index.php\">NIST Forensics Tool Catalog:<\/a> N\u01a1i b\u1ea1n c\u00f3 th\u1ec3 t\u00ecm ki\u1ebfm c\u00e1c c\u00f4ng c\u1ee5 chuy\u00ean d\u1ee5ng t\u1eeb ngu\u1ed3n m\u1edf \u0111\u1ec5n th\u01b0\u01a1ng m\u1ea1i li\u00ean quan \u0111\u1ebfn \u0111i\u1ec1u tra s\u1ed1.<\/li><\/ul><ul><li>\u0110\u1ecdc White paper: Th\u01b0\u1eddng \u0111\u01b0\u1ee3c vi\u1ebft ng\u1eafn g\u1ecdn, \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt v\u00e0 d\u1ec5 \u201cti\u00eau h\u00f3a\u201d h\u01a1n so v\u1edbi s\u00e1ch. \u0110\u1ed1i v\u1edbi l\u0129nh v\u1ef1c \u0111i\u1ec1u tra s\u1ed1 th\u00ec m\u1ecdi ng\u01b0\u1eddi c\u00f3 th\u1ec3 follow <a href=\"https:\/\/www.sans.org\/reading-room\/whitepapers\/forensics\">Whitepaper c\u1ee7a SANS<\/a>. \u0110\u00e2y l\u00e0 n\u01a1i lu\u00f4n update c\u00e1c k\u1ef9 thu\u1eadt m\u1edbi li\u00ean quan \u0111\u1ebfn \u0111i\u1ec1u tra s\u1ed1.<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">T\u1ed5ng K\u1ebft<\/h2>\n\n\n\n<p>Khi vi\u1ebft b\u00e0i n\u00e0y m\u00ecnh t\u00ednh l\u00e0m 1 c\u00e1i roadmap d\u00e0i h\u01a1i nh\u01b0ng thi\u1ebft ngh\u0129 \u0111\u01b0a v\u00e0o nhi\u1ec1u qu\u00e1 ng\u01b0\u1eddi \u0111\u1ecdc l\u1ea1i th\u00eam r\u1ed1i, v\u00ec v\u1eady m\u00ecnh c\u1ed1 g\u1eafng h\u1ea1n ch\u1ebf th\u00f4ng tin \u0111\u1ea7u v\u00e0o nh\u01b0ng hi v\u1ecdng v\u1eabn \u0111\u1ee7 \u0111\u1ec3 1 b\u1ea1n m\u1edbi b\u1eaft \u0111\u1ea7u l\u00e0m quen v\u1edbi l\u0129nh v\u1ef1c n\u00e0y, v\u1edbi kh\u1ea3 n\u0103ng t\u1ef1 h\u1ecdc \u0111\u1ec1u c\u00f3 th\u1ec3 theo \u0111\u01b0\u1ee3c l\u00e2u d\u00e0i v\u00e0 th\u1ef1c chi\u1ebfn t\u1ed1t. Ch\u00fac c\u00e1c b\u1ea1n c\u00f3 nh\u1eefng tr\u1ea3i nghi\u1ec7m th\u00fa v\u1ecb v\u1edbi l\u0129nh v\u1ef1c n\u00e0y.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kh\u00e1i ni\u1ec7m Digital Forensics (\u0111i\u1ec1u tra s\u1ed1) l\u00e0 m\u1ed9t nh\u00e1nh c\u1ee7a ng\u00e0nh khoa h\u1ecdc \u0111i\u1ec1u tra \u0111\u1ec1 c\u1eadp \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p, c\u00f4ng c\u1ee5 k\u1ef9 thu\u1eadt khoa h\u1ecdc \u0111\u00e3 \u0111\u01b0\u1ee3c ch\u1ee9ng minh \u0111\u1ec3 thu th\u1eadp, b\u1ea3o qu\u1ea3n v\u00e0 ph\u00e2n t\u00edch d\u1eef li\u1ec7u trong c\u00e1c thi\u1ebft b\u1ecb k\u1ef9 thu\u1eadt s\u1ed1 v\u1edbi m\u1ee5c ti\u00eau [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":936,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,16],"tags":[],"_links":{"self":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/935"}],"collection":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/comments?post=935"}],"version-history":[{"count":5,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/935\/revisions"}],"predecessor-version":[{"id":941,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/935\/revisions\/941"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/media\/936"}],"wp:attachment":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/media?parent=935"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/categories?post=935"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/tags?post=935"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}