- The Forensic Server Project
- Collecting Data Using FSP
- Correlating and Analyzing Data Using FSP
- Future Directions of the Forensic Server Project
- Summary
This chapter is from the book
This chapter is from the book
This chapter is from the book
Future Directions of the Forensic Server Project
The Forensic Server Project is an open source project and can be modified in any way the investigator may see fit. The server can be run not just on Windows but on any platform that supports Perl. Clients can be created for specific platforms, with functionality that meets the specific needs of the investigator. All that is required is some Perl programming ability. The current version of the FSP provides the base functionality onto which additional capabilities can be built. Functionality such as the following can be added:
-
Encrypted communications— The communications between the client and server can be encrypted to provide an added layer of protection, using Perl modules such as Crypt::TripleDES or Crypt::TwoFish.
-
Running the server as a service— Using a variety of means, one of which is the Win32::Daemon module from Dave Roth, the server component can be run as a Windows service. This may be something that makes the FSP server more convenient for the investigator and perhaps for first responders.
-
Authentication— As an additional level of protection, the investigator may want to add authentication so that only specific users can send data to the server.
-
Remote setup of the server— In addition to running the server as a service and providing authentication, the investigator may want to provide the functionality of allowing for remote setup of the server. This will require some modification to both the server and the client, but allowing remote setup provides a level of flexibility to the first responder.
-
Support for multiple processes— Using the fork() functionality in Perl, the investigator can provide support for multiple processes running simultaneously. This would make things much easier in instances in which first responders are conducting data collection activities from multiple systems and from multiple locations all to the same server.
-
Additional client components— The two client components addressed in this chapter provide a great deal of functionality but only serve as the basis for what's possible. Not only can additional client components be created, but also components can be developed for additional platforms.
-
Additional analysis capability— As stated, data collection is usually the easy part when it comes to incident response and forensic audit investigations. Analyzing the data is can be difficult, particularly when the investigator is looking for specific activity. When dealing with large amounts of data, using some form of automation makes analysis of the data more accurate and more efficient. Investigators can craft tools to meet their specific needs or the specific needs of the investigation.
However, keep in mind that the Forensic Server Project is simply a framework that is implemented in Perl. Neither the server nor the client components need to be written in Perl. Other languages, such as Visual Basic, Python, or Ruby, can be used. In addition, the basic functionality outlined in the FSP can be expanded to include other capabilities or functionality as desired by the investigator.