diff --git a/.astro/data-store.json b/.astro/data-store.json index 4d77db7..8caf647 100644 --- a/.astro/data-store.json +++ b/.astro/data-store.json @@ -1 +1 @@ -[["Map",1,2,7,8],"meta::meta",["Map",3,4,5,6],"astro-version","5.12.3","astro-config-digest","{\"root\":{},\"srcDir\":{},\"publicDir\":{},\"outDir\":{},\"cacheDir\":{},\"compressHTML\":true,\"base\":\"/\",\"trailingSlash\":\"ignore\",\"output\":\"server\",\"scopedStyleStrategy\":\"attribute\",\"build\":{\"format\":\"directory\",\"client\":{},\"server\":{},\"assets\":\"_astro\",\"serverEntry\":\"entry.mjs\",\"redirects\":true,\"inlineStylesheets\":\"auto\",\"concurrency\":1},\"server\":{\"open\":false,\"host\":true,\"port\":4321,\"streaming\":true,\"allowedHosts\":[]},\"redirects\":{},\"image\":{\"endpoint\":{\"route\":\"/_image\",\"entrypoint\":\"astro/assets/endpoint/node\"},\"service\":{\"entrypoint\":\"astro/assets/services/sharp\",\"config\":{}},\"domains\":[],\"remotePatterns\":[],\"responsiveStyles\":false},\"devToolbar\":{\"enabled\":true},\"markdown\":{\"syntaxHighlight\":{\"type\":\"shiki\",\"excludeLangs\":[\"math\"]},\"shikiConfig\":{\"langs\":[],\"langAlias\":{},\"theme\":\"github-dark\",\"themes\":{},\"wrap\":false,\"transformers\":[]},\"remarkPlugins\":[],\"rehypePlugins\":[],\"remarkRehype\":{},\"gfm\":true,\"smartypants\":true},\"security\":{\"checkOrigin\":true},\"env\":{\"schema\":{},\"validateSecrets\":false},\"experimental\":{\"clientPrerender\":false,\"contentIntellisense\":false,\"headingIdCompat\":false,\"preserveScriptOrder\":false,\"liveContentCollections\":false,\"csp\":false,\"rawEnvValues\":false},\"legacy\":{\"collections\":false},\"session\":{\"driver\":\"fs-lite\",\"options\":{\"base\":\"/var/home/user01/Projekte/forensic-pathways/node_modules/.astro/sessions\"}}}","knowledgebase",["Map",9,10,77,78,149,150,223,224,288,289,535,536],"regular-expressions-regex",{"id":9,"data":11,"body":33,"filePath":34,"digest":35,"rendered":36,"legacyId":76},{"title":12,"tool_name":13,"description":14,"last_updated":15,"author":16,"difficulty":17,"categories":18,"tags":23,"sections":29,"review_status":32},"Regular Expressions (Regex) – Musterbasierte Textanalyse","Regular Expressions (Regex)","Pattern matching language für Suche, Extraktion und Manipulation von Text in forensischen Analysen.",["Date","2025-07-20T00:00:00.000Z"],"Claude 4 Sonnet","intermediate",[19,20,21,22],"incident-response","malware-analysis","network-forensics","fraud-investigation",[24,25,26,27,28],"pattern-matching","text-processing","log-analysis","string-manipulation","search-algorithms",{"overview":30,"installation":31,"configuration":31,"usage_examples":30,"best_practices":30,"troubleshooting":31,"advanced_topics":30},true,false,"published","> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\n**Regular Expressions (Regex)** sind ein leistungsfähiges Werkzeug zur Erkennung, Extraktion und Transformation von Zeichenfolgen anhand vordefinierter Muster. In der digitalen Forensik sind Regex-Ausdrücke unverzichtbar: Sie helfen beim Auffinden von IP-Adressen, Hash-Werten, Dateipfaden, Malware-Signaturen oder Kreditkartennummern in großen Mengen unstrukturierter Daten wie Logdateien, Netzwerktraces oder Memory Dumps.\n\nRegex ist nicht auf eine bestimmte Plattform oder Software beschränkt – es wird in nahezu allen gängigen Programmiersprachen, Texteditoren und forensischen Tools unterstützt.\n\n## Verwendungsbeispiele\n\n### 1. IP-Adressen extrahieren\n\n```regex\n\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b\n````\n\nVerwendung:\n\n* Finden von IP-Adressen in Firewall-Logs oder Packet Captures.\n* Beispiel-Zeile:\n\n ```\n Connection from 192.168.1.101 to port 443 established\n ```\n\n### 2. E-Mail-Adressen identifizieren\n\n```regex\n[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\n```\n\nVerwendung:\n\n* Erkennung von kompromittierten Accounts in Phishing-E-Mails.\n* Analyse von Useraktivitäten oder Kommunikationsverläufen.\n\n### 3. Hash-Werte erkennen (z. B. SHA-256)\n\n```regex\n\\b[A-Fa-f0-9]{64}\\b\n```\n\nVerwendung:\n\n* Extraktion von Malware-Hashes aus Memory Dumps oder YARA-Logs.\n\n### 4. Zeitstempel in Logdateien extrahieren\n\n```regex\n\\d{4}-\\d{2}-\\d{2}[ T]\\d{2}:\\d{2}:\\d{2}\n```\n\nVerwendung:\n\n* Zeitsensitive Korrelationsanalysen (z. B. bei Intrusion Detection oder Timeline-Rekonstruktionen).\n\n## Best Practices\n\n* **Regex testen**: Nutze Plattformen wie [regexr.com](https://regexr.com/) oder [regex101.com](https://regex101.com/) zur Validierung.\n* **Performance beachten**: Komplexe Ausdrücke können ineffizient sein und Systeme verlangsamen – verwende Lazy Quantifiers (`*?`, `+?`) bei Bedarf.\n* **Escape-Zeichen korrekt anwenden**: Spezielle Zeichen wie `.` oder `\\` müssen bei Bedarf mit `\\\\` oder `\\.` maskiert werden.\n* **Portabilität prüfen**: Unterschiedliche Regex-Engines (z. B. Python `re`, PCRE, JavaScript) interpretieren manche Syntax leicht unterschiedlich.\n* **Lesbarkeit fördern**: Verwende benannte Gruppen (`(?P\u003Cname>...)`) und Kommentare (`(?x)`), um reguläre Ausdrücke besser wartbar zu machen.\n\n## Weiterführende Themen\n\n### Lookaheads und Lookbehinds\n\nMit **Lookaheads** (`(?=...)`) und **Lookbehinds** (`(?\u003C=...)`) können Bedingungen formuliert werden, ohne dass der Text Teil des Matchs wird.\n\nBeispiel: Alle `.exe`-Dateinamen **ohne** das Wort `safe` davor matchen:\n\n```regex\n(?\u003C!safe\\s)[\\w-]+\\.exe\n```\n\n### Regex in Forensik-Tools\n\n* **YARA**: Unterstützt Regex zur Erstellung von Malware-Signaturen.\n* **Wireshark**: Filtert Payloads anhand von Regex-ähnlicher Syntax.\n* **Splunk & ELK**: Verwenden Regex für Logparsing und Visualisierung.\n* **Volatility Plugins**: Extrahieren Artefakte mit Regex-basierten Scans.\n\n---\n\n> 🔤 **Regex ist ein universelles Werkzeug für Analysten, Ermittler und Entwickler, um versteckte Informationen schnell und flexibel aufzuspüren.**\n>\n> Nutze es überall dort, wo Textdaten eine Rolle spielen.","src/content/knowledgebase/regular-expressions-regex.md","247bcf48ebdc9ba0",{"html":37,"metadata":38},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>\u003Cstrong>Regular Expressions (Regex)\u003C/strong> sind ein leistungsfähiges Werkzeug zur Erkennung, Extraktion und Transformation von Zeichenfolgen anhand vordefinierter Muster. In der digitalen Forensik sind Regex-Ausdrücke unverzichtbar: Sie helfen beim Auffinden von IP-Adressen, Hash-Werten, Dateipfaden, Malware-Signaturen oder Kreditkartennummern in großen Mengen unstrukturierter Daten wie Logdateien, Netzwerktraces oder Memory Dumps.\u003C/p>\n\u003Cp>Regex ist nicht auf eine bestimmte Plattform oder Software beschränkt – es wird in nahezu allen gängigen Programmiersprachen, Texteditoren und forensischen Tools unterstützt.\u003C/p>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"1-ip-adressen-extrahieren\">1. IP-Adressen extrahieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b(?:\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Verwendung:\u003C/p>\n\u003Cul>\n\u003Cli>\n\u003Cp>Finden von IP-Adressen in Firewall-Logs oder Packet Captures.\u003C/p>\n\u003C/li>\n\u003Cli>\n\u003Cp>Beispiel-Zeile:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Connection from 192.168.1.101 to port 443 established\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"2-e-mail-adressen-identifizieren\">2. E-Mail-Adressen identifizieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9._%+-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Verwendung:\u003C/p>\n\u003Cul>\n\u003Cli>Erkennung von kompromittierten Accounts in Phishing-E-Mails.\u003C/li>\n\u003Cli>Analyse von Useraktivitäten oder Kommunikationsverläufen.\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"3-hash-werte-erkennen-zb-sha-256\">3. Hash-Werte erkennen (z. B. SHA-256)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[A-Fa-f0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{64}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Verwendung:\u003C/p>\n\u003Cul>\n\u003Cli>Extraktion von Malware-Hashes aus Memory Dumps oder YARA-Logs.\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"4-zeitstempel-in-logdateien-extrahieren\">4. Zeitstempel in Logdateien extrahieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{4}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#79B8FF\">[ T]\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Verwendung:\u003C/p>\n\u003Cul>\n\u003Cli>Zeitsensitive Korrelationsanalysen (z. B. bei Intrusion Detection oder Timeline-Rekonstruktionen).\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Regex testen\u003C/strong>: Nutze Plattformen wie \u003Ca href=\"https://regexr.com/\">regexr.com\u003C/a> oder \u003Ca href=\"https://regex101.com/\">regex101.com\u003C/a> zur Validierung.\u003C/li>\n\u003Cli>\u003Cstrong>Performance beachten\u003C/strong>: Komplexe Ausdrücke können ineffizient sein und Systeme verlangsamen – verwende Lazy Quantifiers (\u003Ccode>*?\u003C/code>, \u003Ccode>+?\u003C/code>) bei Bedarf.\u003C/li>\n\u003Cli>\u003Cstrong>Escape-Zeichen korrekt anwenden\u003C/strong>: Spezielle Zeichen wie \u003Ccode>.\u003C/code> oder \u003Ccode>\\\u003C/code> müssen bei Bedarf mit \u003Ccode>\\\\\u003C/code> oder \u003Ccode>\\.\u003C/code> maskiert werden.\u003C/li>\n\u003Cli>\u003Cstrong>Portabilität prüfen\u003C/strong>: Unterschiedliche Regex-Engines (z. B. Python \u003Ccode>re\u003C/code>, PCRE, JavaScript) interpretieren manche Syntax leicht unterschiedlich.\u003C/li>\n\u003Cli>\u003Cstrong>Lesbarkeit fördern\u003C/strong>: Verwende benannte Gruppen (\u003Ccode>(?P<name>...)\u003C/code>) und Kommentare (\u003Ccode>(?x)\u003C/code>), um reguläre Ausdrücke besser wartbar zu machen.\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Ch3 id=\"lookaheads-und-lookbehinds\">Lookaheads und Lookbehinds\u003C/h3>\n\u003Cp>Mit \u003Cstrong>Lookaheads\u003C/strong> (\u003Ccode>(?=...)\u003C/code>) und \u003Cstrong>Lookbehinds\u003C/strong> (\u003Ccode>(?<=...)\u003C/code>) können Bedingungen formuliert werden, ohne dass der Text Teil des Matchs wird.\u003C/p>\n\u003Cp>Beispiel: Alle \u003Ccode>.exe\u003C/code>-Dateinamen \u003Cstrong>ohne\u003C/strong> das Wort \u003Ccode>safe\u003C/code> davor matchen:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">(?<!\u003C/span>\u003Cspan style=\"color:#DBEDFF\">safe\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\s\u003C/span>\u003Cspan style=\"color:#F97583\">)\u003C/span>\u003Cspan style=\"color:#79B8FF\">[\\w-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">exe\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"regex-in-forensik-tools\">Regex in Forensik-Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>YARA\u003C/strong>: Unterstützt Regex zur Erstellung von Malware-Signaturen.\u003C/li>\n\u003Cli>\u003Cstrong>Wireshark\u003C/strong>: Filtert Payloads anhand von Regex-ähnlicher Syntax.\u003C/li>\n\u003Cli>\u003Cstrong>Splunk & ELK\u003C/strong>: Verwenden Regex für Logparsing und Visualisierung.\u003C/li>\n\u003Cli>\u003Cstrong>Volatility Plugins\u003C/strong>: Extrahieren Artefakte mit Regex-basierten Scans.\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cblockquote>\n\u003Cp>🔤 \u003Cstrong>Regex ist ein universelles Werkzeug für Analysten, Ermittler und Entwickler, um versteckte Informationen schnell und flexibel aufzuspüren.\u003C/strong>\u003C/p>\n\u003Cp>Nutze es überall dort, wo Textdaten eine Rolle spielen.\u003C/p>\n\u003C/blockquote>",{"headings":39,"localImagePaths":73,"remoteImagePaths":74,"frontmatter":11,"imagePaths":75},[40,44,48,52,55,58,61,64,67,70],{"depth":41,"slug":42,"text":43},1,"übersicht","Übersicht",{"depth":45,"slug":46,"text":47},2,"verwendungsbeispiele","Verwendungsbeispiele",{"depth":49,"slug":50,"text":51},3,"1-ip-adressen-extrahieren","1. IP-Adressen extrahieren",{"depth":49,"slug":53,"text":54},"2-e-mail-adressen-identifizieren","2. E-Mail-Adressen identifizieren",{"depth":49,"slug":56,"text":57},"3-hash-werte-erkennen-zb-sha-256","3. Hash-Werte erkennen (z. B. SHA-256)",{"depth":49,"slug":59,"text":60},"4-zeitstempel-in-logdateien-extrahieren","4. Zeitstempel in Logdateien extrahieren",{"depth":45,"slug":62,"text":63},"best-practices","Best Practices",{"depth":45,"slug":65,"text":66},"weiterführende-themen","Weiterführende Themen",{"depth":49,"slug":68,"text":69},"lookaheads-und-lookbehinds","Lookaheads und Lookbehinds",{"depth":49,"slug":71,"text":72},"regex-in-forensik-tools","Regex in Forensik-Tools",[],[],[],"regular-expressions-regex.md","misp",{"id":77,"data":79,"body":95,"filePath":96,"digest":97,"rendered":98,"legacyId":148},{"title":80,"tool_name":81,"description":82,"last_updated":83,"author":16,"difficulty":17,"categories":84,"tags":87,"sections":94,"review_status":32},"MISP - Plattform für Threat Intelligence Sharing","MISP","Das Rückgrat des modernen Threat-Intelligence-Sharings mit über 40.000 aktiven Instanzen weltweit.",["Date","2025-07-20T00:00:00.000Z"],[19,85,20,21,86],"static-investigations","cloud-forensics",[88,89,90,91,92,93],"web-based","threat-intelligence","api","correlation","ioc-sharing","automation",{"overview":30,"installation":30,"configuration":30,"usage_examples":30,"best_practices":30,"troubleshooting":30,"advanced_topics":31},"> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\n**MISP (Malware Information Sharing Platform & Threat Sharing)** ist eine freie Open-Source-Plattform zur strukturierten Erfassung, Speicherung, Analyse und gemeinsamen Nutzung von Cyber-Bedrohungsdaten. Mit über 40.000 Instanzen weltweit ist MISP der De-facto-Standard für den Austausch von Indicators of Compromise (IoCs) und Threat Intelligence zwischen CERTs, SOCs, Strafverfolgungsbehörden und anderen sicherheitsrelevanten Organisationen.\n\nDie föderierte Architektur ermöglicht einen kontrollierten, dezentralen Austausch von Informationen über vertrauenswürdige Partner hinweg. Durch Taxonomien, Tags und integrierte APIs ist eine automatische Anreicherung, Korrelation und Verarbeitung von Informationen in SIEMs, Firewalls oder Endpoint-Lösungen möglich.\n\n## Installation\n\n### Voraussetzungen\n\n- **Server-Betriebssystem:** Linux (empfohlen: Debian/Ubuntu)\n- **Abhängigkeiten:** MariaDB/MySQL, PHP, Apache/Nginx, Redis\n- **Ressourcen:** Mindestens 4 GB RAM, SSD empfohlen\n\n### Installationsschritte\n\n```bash\n# Beispiel für Debian/Ubuntu:\nsudo apt update && sudo apt install -y curl gnupg git python3 python3-pip redis-server mariadb-server apache2 php libapache2-mod-php\n\n# MISP klonen\ngit clone https://github.com/MISP/MISP.git /var/www/MISP\n\n# Setup-Skript nutzen\ncd /var/www/MISP && bash INSTALL/INSTALL.debian.sh\n````\n\nWeitere Details: [Offizielle Installationsanleitung](https://misp.github.io/MISP/INSTALL.debian/)\n\n## Konfiguration\n\n### Webserver\n\n* HTTPS aktivieren (Let's Encrypt oder Reverse Proxy)\n* PHP-Konfiguration anpassen (`upload_max_filesize`, `memory_limit`, `post_max_size`)\n\n### Benutzerrollen\n\n* Administrator, Org-Admin, Analyst etc.\n* Zugriffsbeschränkungen nach Organisation/Feed definierbar\n\n### Feeds und Galaxies\n\n* Aktivierung von Feeds (z. B. CIRCL, Abuse.ch, OpenCTI)\n* Nutzung von Galaxies zur Klassifizierung (APT-Gruppen, Malware-Familien)\n\n## Verwendungsbeispiele\n\n### Beispiel 1: Import von IoCs aus externem Feed\n\n1. Feed aktivieren unter **Administration → List Feeds**\n2. Feed synchronisieren\n3. Ereignisse durchsuchen, analysieren, ggf. mit eigenen Daten korrelieren\n\n### Beispiel 2: Automatisierte Anbindung an SIEM\n\n* REST-API-Token erstellen\n* API-Calls zur Abfrage neuer Events (z. B. mit Python, Logstash oder MISP Workbench)\n* Integration in Security-Systeme über JSON/STIX export\n\n## Best Practices\n\n* Regelmäßige Backups der Datenbank\n* Taxonomien konsistent verwenden\n* Nutzung der Sighting-Funktion zur Validierung von IoCs\n* Vertrauensstufen (TLP, PAP) korrekt setzen\n* Nicht nur konsumieren – auch teilen!\n\n## Troubleshooting\n\n### Problem: MISP-Feeds laden nicht\n\n**Lösung:**\n\n* Internetverbindung prüfen\n* Cronjobs aktiv?\n* Logs prüfen: `/var/www/MISP/app/tmp/logs/error.log`\n\n### Problem: API gibt 403 zurück\n\n**Lösung:**\n\n* Ist der API-Key korrekt und aktiv?\n* Rechte des Benutzers überprüfen\n* IP-Filter im MISP-Backend beachten\n\n### Problem: Hohe Datenbanklast\n\n**Lösung:**\n\n* Indizes optimieren\n* Redis aktivieren\n* Alte Events regelmäßig archivieren oder löschen\n\n## Weiterführende Themen\n\n* STIX2-Import/Export\n* Erweiterungen mit MISP Modules (z. B. für Virustotal, YARA)\n* Föderierte Netzwerke und Community-Portale\n* Integration mit OpenCTI oder TheHive\n\n---\n\n**Links:**\n\n* 🌐 [Offizielle Projektseite](https://misp-project.org/)\n* 📦 [CC24-MISP-Instanz](https://misp.cc24.dev)\n* 📊 [Status-Monitoring](https://status.mikoshi.de/api/badge/34/status)\n\nLizenz: **AGPL-3.0**","src/content/knowledgebase/misp.md","35930fa919a46964",{"html":99,"metadata":100},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>\u003Cstrong>MISP (Malware Information Sharing Platform & Threat Sharing)\u003C/strong> ist eine freie Open-Source-Plattform zur strukturierten Erfassung, Speicherung, Analyse und gemeinsamen Nutzung von Cyber-Bedrohungsdaten. Mit über 40.000 Instanzen weltweit ist MISP der De-facto-Standard für den Austausch von Indicators of Compromise (IoCs) und Threat Intelligence zwischen CERTs, SOCs, Strafverfolgungsbehörden und anderen sicherheitsrelevanten Organisationen.\u003C/p>\n\u003Cp>Die föderierte Architektur ermöglicht einen kontrollierten, dezentralen Austausch von Informationen über vertrauenswürdige Partner hinweg. Durch Taxonomien, Tags und integrierte APIs ist eine automatische Anreicherung, Korrelation und Verarbeitung von Informationen in SIEMs, Firewalls oder Endpoint-Lösungen möglich.\u003C/p>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Server-Betriebssystem:\u003C/strong> Linux (empfohlen: Debian/Ubuntu)\u003C/li>\n\u003Cli>\u003Cstrong>Abhängigkeiten:\u003C/strong> MariaDB/MySQL, PHP, Apache/Nginx, Redis\u003C/li>\n\u003Cli>\u003Cstrong>Ressourcen:\u003C/strong> Mindestens 4 GB RAM, SSD empfohlen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installationsschritte\">Installationsschritte\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Beispiel für Debian/Ubuntu:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> curl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> gnupg\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> python3-pip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> redis-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mariadb-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apache2\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> libapache2-mod-php\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MISP klonen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/MISP/MISP.git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/MISP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Setup-Skript nutzen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/MISP\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">bash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> INSTALL/INSTALL.debian.sh\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Weitere Details: \u003Ca href=\"https://misp.github.io/MISP/INSTALL.debian/\">Offizielle Installationsanleitung\u003C/a>\u003C/p>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"webserver\">Webserver\u003C/h3>\n\u003Cul>\n\u003Cli>HTTPS aktivieren (Let’s Encrypt oder Reverse Proxy)\u003C/li>\n\u003Cli>PHP-Konfiguration anpassen (\u003Ccode>upload_max_filesize\u003C/code>, \u003Ccode>memory_limit\u003C/code>, \u003Ccode>post_max_size\u003C/code>)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"benutzerrollen\">Benutzerrollen\u003C/h3>\n\u003Cul>\n\u003Cli>Administrator, Org-Admin, Analyst etc.\u003C/li>\n\u003Cli>Zugriffsbeschränkungen nach Organisation/Feed definierbar\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"feeds-und-galaxies\">Feeds und Galaxies\u003C/h3>\n\u003Cul>\n\u003Cli>Aktivierung von Feeds (z. B. CIRCL, Abuse.ch, OpenCTI)\u003C/li>\n\u003Cli>Nutzung von Galaxies zur Klassifizierung (APT-Gruppen, Malware-Familien)\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"beispiel-1-import-von-iocs-aus-externem-feed\">Beispiel 1: Import von IoCs aus externem Feed\u003C/h3>\n\u003Col>\n\u003Cli>Feed aktivieren unter \u003Cstrong>Administration → List Feeds\u003C/strong>\u003C/li>\n\u003Cli>Feed synchronisieren\u003C/li>\n\u003Cli>Ereignisse durchsuchen, analysieren, ggf. mit eigenen Daten korrelieren\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"beispiel-2-automatisierte-anbindung-an-siem\">Beispiel 2: Automatisierte Anbindung an SIEM\u003C/h3>\n\u003Cul>\n\u003Cli>REST-API-Token erstellen\u003C/li>\n\u003Cli>API-Calls zur Abfrage neuer Events (z. B. mit Python, Logstash oder MISP Workbench)\u003C/li>\n\u003Cli>Integration in Security-Systeme über JSON/STIX export\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Regelmäßige Backups der Datenbank\u003C/li>\n\u003Cli>Taxonomien konsistent verwenden\u003C/li>\n\u003Cli>Nutzung der Sighting-Funktion zur Validierung von IoCs\u003C/li>\n\u003Cli>Vertrauensstufen (TLP, PAP) korrekt setzen\u003C/li>\n\u003Cli>Nicht nur konsumieren – auch teilen!\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-misp-feeds-laden-nicht\">Problem: MISP-Feeds laden nicht\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Internetverbindung prüfen\u003C/li>\n\u003Cli>Cronjobs aktiv?\u003C/li>\n\u003Cli>Logs prüfen: \u003Ccode>/var/www/MISP/app/tmp/logs/error.log\u003C/code>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-api-gibt-403-zurück\">Problem: API gibt 403 zurück\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Ist der API-Key korrekt und aktiv?\u003C/li>\n\u003Cli>Rechte des Benutzers überprüfen\u003C/li>\n\u003Cli>IP-Filter im MISP-Backend beachten\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-hohe-datenbanklast\">Problem: Hohe Datenbanklast\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Indizes optimieren\u003C/li>\n\u003Cli>Redis aktivieren\u003C/li>\n\u003Cli>Alte Events regelmäßig archivieren oder löschen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>STIX2-Import/Export\u003C/li>\n\u003Cli>Erweiterungen mit MISP Modules (z. B. für Virustotal, YARA)\u003C/li>\n\u003Cli>Föderierte Netzwerke und Community-Portale\u003C/li>\n\u003Cli>Integration mit OpenCTI oder TheHive\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Links:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>🌐 \u003Ca href=\"https://misp-project.org/\">Offizielle Projektseite\u003C/a>\u003C/li>\n\u003Cli>📦 \u003Ca href=\"https://misp.cc24.dev\">CC24-MISP-Instanz\u003C/a>\u003C/li>\n\u003Cli>📊 \u003Ca href=\"https://status.mikoshi.de/api/badge/34/status\">Status-Monitoring\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Cp>Lizenz: \u003Cstrong>AGPL-3.0\u003C/strong>\u003C/p>",{"headings":101,"localImagePaths":145,"remoteImagePaths":146,"frontmatter":79,"imagePaths":147},[102,103,106,109,112,115,118,121,124,125,128,131,132,135,138,141,144],{"depth":41,"slug":42,"text":43},{"depth":45,"slug":104,"text":105},"installation","Installation",{"depth":49,"slug":107,"text":108},"voraussetzungen","Voraussetzungen",{"depth":49,"slug":110,"text":111},"installationsschritte","Installationsschritte",{"depth":45,"slug":113,"text":114},"konfiguration","Konfiguration",{"depth":49,"slug":116,"text":117},"webserver","Webserver",{"depth":49,"slug":119,"text":120},"benutzerrollen","Benutzerrollen",{"depth":49,"slug":122,"text":123},"feeds-und-galaxies","Feeds und Galaxies",{"depth":45,"slug":46,"text":47},{"depth":49,"slug":126,"text":127},"beispiel-1-import-von-iocs-aus-externem-feed","Beispiel 1: Import von IoCs aus externem Feed",{"depth":49,"slug":129,"text":130},"beispiel-2-automatisierte-anbindung-an-siem","Beispiel 2: Automatisierte Anbindung an SIEM",{"depth":45,"slug":62,"text":63},{"depth":45,"slug":133,"text":134},"troubleshooting","Troubleshooting",{"depth":49,"slug":136,"text":137},"problem-misp-feeds-laden-nicht","Problem: MISP-Feeds laden nicht",{"depth":49,"slug":139,"text":140},"problem-api-gibt-403-zurück","Problem: API gibt 403 zurück",{"depth":49,"slug":142,"text":143},"problem-hohe-datenbanklast","Problem: Hohe Datenbanklast",{"depth":45,"slug":65,"text":66},[],[],[],"misp.md","kali-linux",{"id":149,"data":151,"body":166,"filePath":167,"digest":168,"rendered":169,"legacyId":222},{"title":152,"tool_name":153,"description":154,"last_updated":155,"author":16,"difficulty":17,"categories":156,"tags":159,"sections":165,"review_status":32},"Kali Linux - Die Hacker-Distribution für Forensik & Penetration Testing","Kali Linux","Leitfaden zur Installation, Nutzung und Best Practices für Kali Linux – die All-in-One-Plattform für Security-Profis.",["Date","2025-07-20T00:00:00.000Z"],[19,157,158],"forensics","penetration-testing",[160,161,158,162,163,164],"live-boot","tool-collection","forensics-suite","virtualization","arm-support",{"overview":30,"installation":30,"configuration":30,"usage_examples":30,"best_practices":30,"troubleshooting":30,"advanced_topics":30},"> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nKali Linux ist eine auf Debian basierende Linux-Distribution, die speziell für Penetration Testing, digitale Forensik, Reverse Engineering und Incident Response entwickelt wurde. Mit über 600 vorinstallierten Tools ist sie ein unverzichtbares Werkzeug für Security-Experten, Ermittler und forensische Analysten. Die Live-Boot-Funktion erlaubt es, Systeme ohne Spuren zu hinterlassen zu analysieren – ideal für forensische Untersuchungen.\n\n## Installation\n\n### Option 1: Live-System (USB/DVD)\n\n1. ISO-Image von [kali.org](https://www.kali.org/get-kali/) herunterladen.\n2. Mit **Rufus** oder **balenaEtcher** auf einen USB-Stick schreiben.\n3. Vom USB-Stick booten (ggf. Boot-Reihenfolge im BIOS anpassen).\n4. Kali kann direkt ohne Installation im Live-Modus verwendet werden.\n\n### Option 2: Installation auf Festplatte\n\n1. ISO-Image booten und **Graphical Install** wählen.\n2. Schritt-für-Schritt durch den Installationsassistenten navigieren:\n - Sprache, Zeitzone und Tastaturlayout auswählen\n - Partitionierung konfigurieren (automatisch oder manuell)\n - Benutzerkonten erstellen\n3. Nach Installation Neustart durchführen.\n\n### Option 3: Virtuelle Maschine (VM)\n\n- Offizielle VM-Images für VirtualBox und VMware von der [Kali-Website](https://www.kali.org/get-kali/#kali-virtual-machines)\n- Importieren, ggf. Netzwerkbrücke und Shared Folders aktivieren\n\n## Konfiguration\n\n### Netzwerkeinstellungen\n\n- Konfiguration über `nmtui` oder `/etc/network/interfaces`\n- VPN und Proxy-Integration über GUI oder Terminal\n\n### Updates & Paketquellen\n\n```bash\nsudo apt update && sudo apt full-upgrade\n````\n\n> Hinweis: `kali-rolling` ist die Standard-Distribution für kontinuierliche Updates.\n\n### Sprache & Lokalisierung\n\n```bash\nsudo dpkg-reconfigure locales\nsudo dpkg-reconfigure keyboard-configuration\n```\n\n## Verwendungsbeispiele\n\n### 1. Netzwerkscan mit Nmap\n\n```bash\nnmap -sS -T4 -A 192.168.1.0/24\n```\n\n### 2. Passwort-Cracking mit John the Ripper\n\n```bash\njohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt\n```\n\n### 3. Forensik mit Autopsy\n\n```bash\nautopsy &\n```\n\n### 4. Android-Analyse mit MobSF (in Docker)\n\n```bash\ndocker pull opensecurity/mobile-security-framework-mobsf\ndocker run -it -p 8000:8000 mobsf\n```\n\n## Best Practices\n\n* Nutze immer **aktuelle Snapshots** oder VM-Clones vor gefährlichen Tests\n* Verwende separate Netzwerke (z. B. Host-only oder NAT) für Tests\n* Deaktiviere automatisches WLAN bei forensischen Analysen\n* Prüfe und aktualisiere regelmäßig Toolsets (`apt`, `git`, `pip`)\n* Halte deine ISO-Images versioniert für forensische Reproduzierbarkeit\n\n## Troubleshooting\n\n### Problem: Keine Internetverbindung nach Installation\n\n**Lösung:** Netzwerkadapter prüfen, ggf. mit `ifconfig` oder `ip a` überprüfen, DHCP aktivieren.\n\n### Problem: Tools fehlen nach Update\n\n**Lösung:** Tool-Gruppen wie `kali-linux-default` manuell nachinstallieren:\n\n```bash\nsudo apt install kali-linux-default\n```\n\n### Problem: „Permission Denied“ bei Tools\n\n**Lösung:** Root-Rechte nutzen oder mit `sudo` ausführen.\n\n## Weiterführende Themen\n\n* **Kustomisierung von Kali ISOs** mit `live-build`\n* **NetHunter**: Kali für mobile Geräte (Android)\n* **Kali Purple**: Defensive Security Suite\n* Integration mit **Cloud-Infrastrukturen** via WSL oder Azure\n\n---\n\n**Links & Ressourcen:**\n\n* Offizielle Website: [https://kali.org](https://kali.org/)\n* Dokumentation: [https://docs.kali.org/](https://docs.kali.org/)\n* GitLab Repo: [https://gitlab.com/kalilinux](https://gitlab.com/kalilinux)\n* Discord-Community: [https://discord.com/invite/kali-linux](https://discord.com/invite/kali-linux)","src/content/knowledgebase/kali-linux.md","09243ebc79d75dbc",{"html":170,"metadata":171},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Kali Linux ist eine auf Debian basierende Linux-Distribution, die speziell für Penetration Testing, digitale Forensik, Reverse Engineering und Incident Response entwickelt wurde. Mit über 600 vorinstallierten Tools ist sie ein unverzichtbares Werkzeug für Security-Experten, Ermittler und forensische Analysten. Die Live-Boot-Funktion erlaubt es, Systeme ohne Spuren zu hinterlassen zu analysieren – ideal für forensische Untersuchungen.\u003C/p>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"option-1-live-system-usbdvd\">Option 1: Live-System (USB/DVD)\u003C/h3>\n\u003Col>\n\u003Cli>ISO-Image von \u003Ca href=\"https://www.kali.org/get-kali/\">kali.org\u003C/a> herunterladen.\u003C/li>\n\u003Cli>Mit \u003Cstrong>Rufus\u003C/strong> oder \u003Cstrong>balenaEtcher\u003C/strong> auf einen USB-Stick schreiben.\u003C/li>\n\u003Cli>Vom USB-Stick booten (ggf. Boot-Reihenfolge im BIOS anpassen).\u003C/li>\n\u003Cli>Kali kann direkt ohne Installation im Live-Modus verwendet werden.\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"option-2-installation-auf-festplatte\">Option 2: Installation auf Festplatte\u003C/h3>\n\u003Col>\n\u003Cli>ISO-Image booten und \u003Cstrong>Graphical Install\u003C/strong> wählen.\u003C/li>\n\u003Cli>Schritt-für-Schritt durch den Installationsassistenten navigieren:\n\u003Cul>\n\u003Cli>Sprache, Zeitzone und Tastaturlayout auswählen\u003C/li>\n\u003Cli>Partitionierung konfigurieren (automatisch oder manuell)\u003C/li>\n\u003Cli>Benutzerkonten erstellen\u003C/li>\n\u003C/ul>\n\u003C/li>\n\u003Cli>Nach Installation Neustart durchführen.\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"option-3-virtuelle-maschine-vm\">Option 3: Virtuelle Maschine (VM)\u003C/h3>\n\u003Cul>\n\u003Cli>Offizielle VM-Images für VirtualBox und VMware von der \u003Ca href=\"https://www.kali.org/get-kali/#kali-virtual-machines\">Kali-Website\u003C/a>\u003C/li>\n\u003Cli>Importieren, ggf. Netzwerkbrücke und Shared Folders aktivieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"netzwerkeinstellungen\">Netzwerkeinstellungen\u003C/h3>\n\u003Cul>\n\u003Cli>Konfiguration über \u003Ccode>nmtui\u003C/code> oder \u003Ccode>/etc/network/interfaces\u003C/code>\u003C/li>\n\u003Cli>VPN und Proxy-Integration über GUI oder Terminal\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"updates--paketquellen\">Updates & Paketquellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> full-upgrade\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cblockquote>\n\u003Cp>Hinweis: \u003Ccode>kali-rolling\u003C/code> ist die Standard-Distribution für kontinuierliche Updates.\u003C/p>\n\u003C/blockquote>\n\u003Ch3 id=\"sprache--lokalisierung\">Sprache & Lokalisierung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dpkg-reconfigure\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> locales\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dpkg-reconfigure\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> keyboard-configuration\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"1-netzwerkscan-mit-nmap\">1. Netzwerkscan mit Nmap\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">nmap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -sS\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T4\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -A\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 192.168.1.0/24\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"2-passwort-cracking-mit-john-the-ripper\">2. Passwort-Cracking mit John the Ripper\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">john\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --wordlist=/usr/share/wordlists/rockyou.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hashes.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-forensik-mit-autopsy\">3. Forensik mit Autopsy\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">autopsy\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> &\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"4-android-analyse-mit-mobsf-in-docker\">4. Android-Analyse mit MobSF (in Docker)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">docker\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> opensecurity/mobile-security-framework-mobsf\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">docker\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> run\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -it\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -p\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 8000:8000\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mobsf\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Nutze immer \u003Cstrong>aktuelle Snapshots\u003C/strong> oder VM-Clones vor gefährlichen Tests\u003C/li>\n\u003Cli>Verwende separate Netzwerke (z. B. Host-only oder NAT) für Tests\u003C/li>\n\u003Cli>Deaktiviere automatisches WLAN bei forensischen Analysen\u003C/li>\n\u003Cli>Prüfe und aktualisiere regelmäßig Toolsets (\u003Ccode>apt\u003C/code>, \u003Ccode>git\u003C/code>, \u003Ccode>pip\u003C/code>)\u003C/li>\n\u003Cli>Halte deine ISO-Images versioniert für forensische Reproduzierbarkeit\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-keine-internetverbindung-nach-installation\">Problem: Keine Internetverbindung nach Installation\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Netzwerkadapter prüfen, ggf. mit \u003Ccode>ifconfig\u003C/code> oder \u003Ccode>ip a\u003C/code> überprüfen, DHCP aktivieren.\u003C/p>\n\u003Ch3 id=\"problem-tools-fehlen-nach-update\">Problem: Tools fehlen nach Update\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Tool-Gruppen wie \u003Ccode>kali-linux-default\u003C/code> manuell nachinstallieren:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> kali-linux-default\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-permission-denied-bei-tools\">Problem: „Permission Denied“ bei Tools\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Root-Rechte nutzen oder mit \u003Ccode>sudo\u003C/code> ausführen.\u003C/p>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Kustomisierung von Kali ISOs\u003C/strong> mit \u003Ccode>live-build\u003C/code>\u003C/li>\n\u003Cli>\u003Cstrong>NetHunter\u003C/strong>: Kali für mobile Geräte (Android)\u003C/li>\n\u003Cli>\u003Cstrong>Kali Purple\u003C/strong>: Defensive Security Suite\u003C/li>\n\u003Cli>Integration mit \u003Cstrong>Cloud-Infrastrukturen\u003C/strong> via WSL oder Azure\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Links & Ressourcen:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Offizielle Website: \u003Ca href=\"https://kali.org/\">https://kali.org\u003C/a>\u003C/li>\n\u003Cli>Dokumentation: \u003Ca href=\"https://docs.kali.org/\">https://docs.kali.org/\u003C/a>\u003C/li>\n\u003Cli>GitLab Repo: \u003Ca href=\"https://gitlab.com/kalilinux\">https://gitlab.com/kalilinux\u003C/a>\u003C/li>\n\u003Cli>Discord-Community: \u003Ca href=\"https://discord.com/invite/kali-linux\">https://discord.com/invite/kali-linux\u003C/a>\u003C/li>\n\u003C/ul>",{"headings":172,"localImagePaths":219,"remoteImagePaths":220,"frontmatter":151,"imagePaths":221},[173,174,175,178,181,184,185,188,191,194,195,198,201,204,207,208,209,212,215,218],{"depth":41,"slug":42,"text":43},{"depth":45,"slug":104,"text":105},{"depth":49,"slug":176,"text":177},"option-1-live-system-usbdvd","Option 1: Live-System (USB/DVD)",{"depth":49,"slug":179,"text":180},"option-2-installation-auf-festplatte","Option 2: Installation auf Festplatte",{"depth":49,"slug":182,"text":183},"option-3-virtuelle-maschine-vm","Option 3: Virtuelle Maschine (VM)",{"depth":45,"slug":113,"text":114},{"depth":49,"slug":186,"text":187},"netzwerkeinstellungen","Netzwerkeinstellungen",{"depth":49,"slug":189,"text":190},"updates--paketquellen","Updates & Paketquellen",{"depth":49,"slug":192,"text":193},"sprache--lokalisierung","Sprache & Lokalisierung",{"depth":45,"slug":46,"text":47},{"depth":49,"slug":196,"text":197},"1-netzwerkscan-mit-nmap","1. Netzwerkscan mit Nmap",{"depth":49,"slug":199,"text":200},"2-passwort-cracking-mit-john-the-ripper","2. Passwort-Cracking mit John the Ripper",{"depth":49,"slug":202,"text":203},"3-forensik-mit-autopsy","3. Forensik mit Autopsy",{"depth":49,"slug":205,"text":206},"4-android-analyse-mit-mobsf-in-docker","4. Android-Analyse mit MobSF (in Docker)",{"depth":45,"slug":62,"text":63},{"depth":45,"slug":133,"text":134},{"depth":49,"slug":210,"text":211},"problem-keine-internetverbindung-nach-installation","Problem: Keine Internetverbindung nach Installation",{"depth":49,"slug":213,"text":214},"problem-tools-fehlen-nach-update","Problem: Tools fehlen nach Update",{"depth":49,"slug":216,"text":217},"problem-permission-denied-bei-tools","Problem: „Permission Denied“ bei Tools",{"depth":45,"slug":65,"text":66},[],[],[],"kali-linux.md","velociraptor",{"id":223,"data":225,"body":239,"filePath":240,"digest":241,"rendered":242,"legacyId":287},{"title":226,"tool_name":227,"description":228,"last_updated":229,"author":16,"difficulty":230,"categories":231,"tags":232,"sections":238,"review_status":32},"Velociraptor – Skalierbare Endpoint-Forensik mit VQL","Velociraptor","Detaillierte Anleitung und Best Practices für Velociraptor – Remote-Forensik der nächsten Generation",["Date","2025-07-20T00:00:00.000Z"],"advanced",[19,20,21],[88,233,234,235,236,237],"endpoint-monitoring","artifact-extraction","scripting","live-forensics","hunting",{"overview":30,"installation":30,"configuration":30,"usage_examples":30,"best_practices":30,"troubleshooting":30,"advanced_topics":30},"> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nVelociraptor ist ein Open-Source-Tool zur Endpoint-Forensik mit Fokus auf Skalierbarkeit, Präzision und Geschwindigkeit. Es ermöglicht die zielgerichtete Erfassung und Analyse digitaler Artefakte über eine eigene Query Language – VQL (Velociraptor Query Language). Die Architektur erlaubt remote Zugriff auf tausende Endpoints gleichzeitig, ohne dass vollständige Disk-Images erforderlich sind.\n\n## Hauptmerkmale\n\n- 🌐 Web-basierte Benutzeroberfläche\n- 💡 VQL – mächtige, SQL-ähnliche Abfragesprache\n- 🚀 Hochskalierbare Hunt-Funktionalität\n- 🔍 Artefaktbasierte Sammlung (ohne Full-Image)\n- 🖥️ Plattformunterstützung für Windows, macOS, Linux\n- 📦 Apache 2.0 Lizenz – Open Source\n\nWeitere Infos: [velociraptor.app](https://www.velociraptor.app/) \nProjektspiegel: [raptor.cc24.dev](https://raptor.cc24.dev) \nStatus: ![Status](https://status.mikoshi.de/api/badge/33/status)\n\n---\n\n## Installation\n\n### Voraussetzungen\n\n- Python ≥ 3.9\n- Adminrechte auf dem System\n- Firewall-Freigaben für Webport (Standard: 8000)\n\n### Installation unter Linux/macOS\n\n```bash\nwget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor\nchmod +x velociraptor\nsudo mv velociraptor /usr/local/bin/\n````\n\n### Installation unter Windows\n\n1. Download der `.exe` von der [Release-Seite](https://github.com/Velocidex/velociraptor/releases)\n2. Ausführung in PowerShell mit Adminrechten:\n\n ```powershell\n .\\velociraptor.exe config generate > server.config.yaml\n ```\n\n---\n\n## Konfiguration\n\n### Server Setup\n\n1. Generiere die Konfigurationsdatei:\n\n ```bash\n velociraptor config generate > server.config.yaml\n ```\n2. Starte den Server:\n\n ```bash\n velociraptor --config server.config.yaml frontend\n ```\n3. Zugriff über Browser via `https://\u003Chostname>:8000`\n\n### Client Deployment\n\n* MSI/EXE für Windows, oder `deb/rpm` für Linux\n* Unterstützt automatische Registrierung am Server\n* Deployment über GPO, Puppet, Ansible etc. möglich\n\n---\n\n## Verwendungsbeispiele\n\n### 1. Live-Memory-Artefakte sammeln\n\n```vql\nSELECT * FROM Artifact.MemoryInfo()\n```\n\n### 2. Hunt starten auf verdächtige Prozesse\n\n```vql\nSELECT * FROM pslist()\nWHERE Name =~ \"mimikatz|cobaltstrike\"\n```\n\n### 3. Dateiinhalt extrahieren\n\n```vql\nSELECT * FROM glob(globs=\"C:\\\\Users\\\\*\\\\AppData\\\\*.dat\")\n```\n\n---\n\n## Best Practices\n\n* Erstelle eigene Artefakte für unternehmensspezifische Bedrohungsmodelle\n* Verwende \"Notebook\"-Funktion für strukturierte Analysen\n* Nutze \"Labels\", um Endpoints zu organisieren (z. B. `location:Berlin`)\n* Kombiniere Velociraptor mit SIEM/EDR-Systemen über REST API\n\n---\n\n## Troubleshooting\n\n### Problem: Keine Verbindung vom Client zum Server\n\n**Lösung:**\n\n* Ports freigegeben? (Default: 8000/tcp)\n* TLS-Zertifikate korrekt generiert?\n* `server.config.yaml` auf korrekte `public_ip` prüfen\n\n### Problem: Hunt hängt in Warteschleife\n\n**Lösung:**\n\n* Genügend Worker-Prozesse aktiv?\n* Endpoint online?\n* `log_level` auf `debug` setzen und Log analysieren\n\n---\n\n## Weiterführende Themen\n\n* Eigene Artefakte schreiben mit VQL\n* Integration mit ELK Stack\n* Automatisiertes Incident Response Playbook\n* Velociraptor als IR-as-a-Service einsetzen\n\n---\n\n🧠 **Tipp:** Die Lernkurve bei VQL ist steil – aber mit hohem ROI. Testumgebung aufsetzen und mit Community-Artefakten starten.\n\n📚 Weitere Ressourcen:\n\n* [Offizielle Doku](https://docs.velociraptor.app/)\n* [YouTube Channel](https://www.youtube.com/c/VelociraptorDFIR)\n* [Community auf Discord](https://www.velociraptor.app/community/)","src/content/knowledgebase/velociraptor.md","05636b9b97e61d17",{"html":243,"metadata":244},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Velociraptor ist ein Open-Source-Tool zur Endpoint-Forensik mit Fokus auf Skalierbarkeit, Präzision und Geschwindigkeit. Es ermöglicht die zielgerichtete Erfassung und Analyse digitaler Artefakte über eine eigene Query Language – VQL (Velociraptor Query Language). Die Architektur erlaubt remote Zugriff auf tausende Endpoints gleichzeitig, ohne dass vollständige Disk-Images erforderlich sind.\u003C/p>\n\u003Ch2 id=\"hauptmerkmale\">Hauptmerkmale\u003C/h2>\n\u003Cul>\n\u003Cli>🌐 Web-basierte Benutzeroberfläche\u003C/li>\n\u003Cli>💡 VQL – mächtige, SQL-ähnliche Abfragesprache\u003C/li>\n\u003Cli>🚀 Hochskalierbare Hunt-Funktionalität\u003C/li>\n\u003Cli>🔍 Artefaktbasierte Sammlung (ohne Full-Image)\u003C/li>\n\u003Cli>🖥️ Plattformunterstützung für Windows, macOS, Linux\u003C/li>\n\u003Cli>📦 Apache 2.0 Lizenz – Open Source\u003C/li>\n\u003C/ul>\n\u003Cp>Weitere Infos: \u003Ca href=\"https://www.velociraptor.app/\">velociraptor.app\u003C/a>\u003Cbr>\nProjektspiegel: \u003Ca href=\"https://raptor.cc24.dev\">raptor.cc24.dev\u003C/a>\u003Cbr>\nStatus: \u003Cimg src=\"https://status.mikoshi.de/api/badge/33/status\" alt=\"Status\">\u003C/p>\n\u003Chr>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>Python ≥ 3.9\u003C/li>\n\u003Cli>Adminrechte auf dem System\u003C/li>\n\u003Cli>Firewall-Freigaben für Webport (Standard: 8000)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installation-unter-linuxmacos\">Installation unter Linux/macOS\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">chmod\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> +x\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> velociraptor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> velociraptor\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /usr/local/bin/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"installation-unter-windows\">Installation unter Windows\u003C/h3>\n\u003Col>\n\u003Cli>\n\u003Cp>Download der \u003Ccode>.exe\u003C/code> von der \u003Ca href=\"https://github.com/Velocidex/velociraptor/releases\">Release-Seite\u003C/a>\u003C/p>\n\u003C/li>\n\u003Cli>\n\u003Cp>Ausführung in PowerShell mit Adminrechten:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"powershell\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">.\\\u003C/span>\u003Cspan style=\"color:#79B8FF\">velociraptor.exe\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> config generate \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> server.config.yaml\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003C/ol>\n\u003Chr>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"server-setup\">Server Setup\u003C/h3>\n\u003Col>\n\u003Cli>\n\u003Cp>Generiere die Konfigurationsdatei:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">velociraptor\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> config\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> generate\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> server.config.yaml\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>Starte den Server:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">velociraptor\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --config\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> server.config.yaml\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frontend\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>Zugriff über Browser via \u003Ccode>https://<hostname>:8000\u003C/code>\u003C/p>\n\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"client-deployment\">Client Deployment\u003C/h3>\n\u003Cul>\n\u003Cli>MSI/EXE für Windows, oder \u003Ccode>deb/rpm\u003C/code> für Linux\u003C/li>\n\u003Cli>Unterstützt automatische Registrierung am Server\u003C/li>\n\u003Cli>Deployment über GPO, Puppet, Ansible etc. möglich\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"1-live-memory-artefakte-sammeln\">1. Live-Memory-Artefakte sammeln\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM Artifact.MemoryInfo()\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"2-hunt-starten-auf-verdächtige-prozesse\">2. Hunt starten auf verdächtige Prozesse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM pslist()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>WHERE Name =~ \"mimikatz|cobaltstrike\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-dateiinhalt-extrahieren\">3. Dateiinhalt extrahieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM glob(globs=\"C:\\\\Users\\\\*\\\\AppData\\\\*.dat\")\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Chr>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Erstelle eigene Artefakte für unternehmensspezifische Bedrohungsmodelle\u003C/li>\n\u003Cli>Verwende “Notebook”-Funktion für strukturierte Analysen\u003C/li>\n\u003Cli>Nutze “Labels”, um Endpoints zu organisieren (z. B. \u003Ccode>location:Berlin\u003C/code>)\u003C/li>\n\u003Cli>Kombiniere Velociraptor mit SIEM/EDR-Systemen über REST API\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-keine-verbindung-vom-client-zum-server\">Problem: Keine Verbindung vom Client zum Server\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Ports freigegeben? (Default: 8000/tcp)\u003C/li>\n\u003Cli>TLS-Zertifikate korrekt generiert?\u003C/li>\n\u003Cli>\u003Ccode>server.config.yaml\u003C/code> auf korrekte \u003Ccode>public_ip\u003C/code> prüfen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-hunt-hängt-in-warteschleife\">Problem: Hunt hängt in Warteschleife\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Genügend Worker-Prozesse aktiv?\u003C/li>\n\u003Cli>Endpoint online?\u003C/li>\n\u003Cli>\u003Ccode>log_level\u003C/code> auf \u003Ccode>debug\u003C/code> setzen und Log analysieren\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>Eigene Artefakte schreiben mit VQL\u003C/li>\n\u003Cli>Integration mit ELK Stack\u003C/li>\n\u003Cli>Automatisiertes Incident Response Playbook\u003C/li>\n\u003Cli>Velociraptor als IR-as-a-Service einsetzen\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>🧠 \u003Cstrong>Tipp:\u003C/strong> Die Lernkurve bei VQL ist steil – aber mit hohem ROI. Testumgebung aufsetzen und mit Community-Artefakten starten.\u003C/p>\n\u003Cp>📚 Weitere Ressourcen:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://docs.velociraptor.app/\">Offizielle Doku\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.youtube.com/c/VelociraptorDFIR\">YouTube Channel\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.velociraptor.app/community/\">Community auf Discord\u003C/a>\u003C/li>\n\u003C/ul>",{"headings":245,"localImagePaths":284,"remoteImagePaths":285,"frontmatter":225,"imagePaths":286},[246,247,250,251,252,255,258,259,262,265,266,269,272,275,276,277,280,283],{"depth":41,"slug":42,"text":43},{"depth":45,"slug":248,"text":249},"hauptmerkmale","Hauptmerkmale",{"depth":45,"slug":104,"text":105},{"depth":49,"slug":107,"text":108},{"depth":49,"slug":253,"text":254},"installation-unter-linuxmacos","Installation unter Linux/macOS",{"depth":49,"slug":256,"text":257},"installation-unter-windows","Installation unter Windows",{"depth":45,"slug":113,"text":114},{"depth":49,"slug":260,"text":261},"server-setup","Server Setup",{"depth":49,"slug":263,"text":264},"client-deployment","Client Deployment",{"depth":45,"slug":46,"text":47},{"depth":49,"slug":267,"text":268},"1-live-memory-artefakte-sammeln","1. Live-Memory-Artefakte sammeln",{"depth":49,"slug":270,"text":271},"2-hunt-starten-auf-verdächtige-prozesse","2. Hunt starten auf verdächtige Prozesse",{"depth":49,"slug":273,"text":274},"3-dateiinhalt-extrahieren","3. Dateiinhalt extrahieren",{"depth":45,"slug":62,"text":63},{"depth":45,"slug":133,"text":134},{"depth":49,"slug":278,"text":279},"problem-keine-verbindung-vom-client-zum-server","Problem: Keine Verbindung vom Client zum Server",{"depth":49,"slug":281,"text":282},"problem-hunt-hängt-in-warteschleife","Problem: Hunt hängt in Warteschleife",{"depth":45,"slug":65,"text":66},[],[],[],"velociraptor.md","android-logical-imaging",{"id":288,"data":290,"body":303,"filePath":304,"digest":305,"rendered":306,"legacyId":534},{"title":291,"tool_name":292,"description":293,"last_updated":294,"author":295,"difficulty":230,"categories":296,"tags":298,"sections":302,"review_status":32},"Extraktion logischer Dateisysteme alter Android-Smartphones - eine KI-Recherche","Android Logical Imaging","Wie man alte Android-Handys aufbekommen könnte - eine Recherche von Claude",["Date","2025-07-21T00:00:00.000Z"],"Claude 4 Sonnet (Research)",[297],"data-collection",[299,300,301],"imaging","filesystem","hardware-interface",{"overview":30,"installation":30,"configuration":30,"usage_examples":30,"best_practices":30,"troubleshooting":30,"advanced_topics":30},"# Übersicht\n\nOpen-Source Android Forensik bietet robuste Alternativen zu kommerziellen Lösungen wie Cellebrite UFED und Magnet AXIOM. Besonders für ältere Android-Geräte (5+ Jahre) existieren bewährte Methoden zur Datenextraktion und -analyse.\n\n## Kernkomponenten des Open-Source Forensik-Stacks\n\n**Autopsy Digital Forensics Platform** bildet das Fundament mit GUI-basierter Analyse und integrierten Android-Parsing-Fähigkeiten. Die Plattform unterstützt **ALEAPP (Android Logs Events And Protobuf Parser)**, das über 100 Artefakt-Kategorien aus Android-Extraktionen parst.\n\n**Mobile Verification Toolkit (MVT)** von Amnesty International bietet spezialisierte Command-Line-Tools für Android-Analyse mit Fokus auf Kompromittierungserkennung.\n\n**SIFT Workstation** stellt eine komplette Ubuntu-basierte forensische Umgebung mit 125+ vorinstallierten Tools bereit.\n\n## Erfolgsraten nach Gerätealter\n\n- **Pre-2017 Geräte**: 85-98% logische Extraktion, 30-70% physische Extraktion\n- **2017-2019 Geräte**: 80-95% logische Extraktion, 15-35% physische Extraktion \n- **2020+ Geräte**: 70-85% logische Extraktion, 5-15% physische Extraktion\n\n# Installation\n\n## SIFT Workstation Setup\n\n### Systemanforderungen\n- Quad-Core CPU 2.5GHz+\n- 16GB+ RAM\n- 500GB+ SSD Speicher\n- USB 3.0+ Anschlüsse\n\n### Installation\n1. Download von [SANS SIFT Workstation](https://www.sans.org/tools/sift-workstation/)\n2. VMware/VirtualBox Import der OVA-Datei\n3. VM-Konfiguration: 8GB+ RAM, 4+ CPU-Kerne\n\n```bash\n# Update nach Installation\nsudo apt update && sudo apt upgrade -y\nsudo sift update\n```\n\n## Autopsy Installation\n\n### Windows Installation\n1. Download von [autopsy.com](https://www.autopsy.com/)\n2. Java 8+ Installation erforderlich\n3. Installation mit Administratorrechten\n\n### Linux Installation\n```bash\n# Ubuntu/Debian\nsudo apt install autopsy sleuthkit\n# Oder manueller Download und Installation\nwget https://github.com/sleuthkit/autopsy/releases/latest\n```\n\n## Essential Tools Installation\n\n### Android Debug Bridge (ADB)\n```bash\n# Ubuntu/Debian\nsudo apt install android-tools-adb android-tools-fastboot\n\n# Windows - Download Android Platform Tools\n# https://developer.android.com/studio/releases/platform-tools\n```\n\n### ALEAPP Installation\n```bash\ngit clone https://github.com/abrignoni/ALEAPP.git\ncd ALEAPP\npip3 install -r requirements.txt\n```\n\n### Mobile Verification Toolkit (MVT)\n```bash\npip3 install mvt\n# Oder via GitHub für neueste Version\ngit clone https://github.com/mvt-project/mvt.git\ncd mvt && pip3 install .\n```\n\n### Andriller Installation\n```bash\ngit clone https://github.com/den4uk/andriller.git\ncd andriller\npip3 install -r requirements.txt\n```\n\n# Konfiguration\n\n## ADB Setup und Gerätevorbereitung\n\n### USB-Debugging aktivieren\n1. Entwickleroptionen freischalten (7x Build-Nummer antippen)\n2. USB-Debugging aktivieren\n3. Gerät via USB verbinden\n4. RSA-Fingerprint akzeptieren\n\n### ADB Verbindung testen\n```bash\nadb devices\n# Sollte Gerät mit \"device\" Status zeigen\nadb shell getprop ro.build.version.release # Android Version\nadb shell getprop ro.product.model # Gerätemodell\n```\n\n## Autopsy Projektkonfiguration\n\n### Case-Setup\n1. Neuen Fall erstellen\n2. Ermittler-Informationen eingeben\n3. Case-Verzeichnis festlegen (ausreichend Speicherplatz)\n\n### Android Analyzer Module aktivieren\n- Tools → Options → Modules\n- Android Analyzer aktivieren\n- ALEAPP Integration konfigurieren\n\n### Hash-Algorithmen konfigurieren\n- MD5, SHA-1, SHA-256 für Integritätsprüfung\n- Automatische Hash-Berechnung bei Import aktivieren\n\n## MVT Konfiguration\n\n### Konfigurationsdatei erstellen\n```yaml\n# ~/.mvt/config.yaml\nadb_path: \"/usr/bin/adb\"\noutput_folder: \"/home/user/mvt_output\"\n```\n\n# Verwendungsbeispiele\n\n## Fall 1: Logische Datenextraktion mit ADB\n\n### Geräteinformationen sammeln\n```bash\n# Systeminfo\nadb shell getprop > device_properties.txt\nadb shell cat /proc/version > kernel_info.txt\nadb shell mount > mount_info.txt\n\n# Installierte Apps\nadb shell pm list packages -f > installed_packages.txt\n```\n\n### Datenbank-Extraktion\n```bash\n# SMS/MMS Datenbank\nadb pull /data/data/com.android.providers.telephony/databases/mmssms.db\n\n# Kontakte\nadb pull /data/data/com.android.providers.contacts/databases/contacts2.db\n\n# Anrufliste \nadb pull /data/data/com.android.providers.contacts/databases/calllog.db\n```\n\n### WhatsApp Datenextraktion\n```bash\n# WhatsApp Datenbanken (Root erforderlich)\nadb shell su -c \"cp -r /data/data/com.whatsapp/ /sdcard/whatsapp_backup/\"\nadb pull /sdcard/whatsapp_backup/\n```\n\n## Fall 2: Android Backup-Analyse\n\n### Vollständiges Backup erstellen\n```bash\n# Umfassendes Backup (ohne Root)\nadb backup -all -system -apk -shared -f backup.ab\n\n# Backup entschlüsseln (falls verschlüsselt)\njava -jar abe.jar unpack backup.ab backup.tar\ntar -xf backup.tar\n```\n\n### Backup mit ALEAPP analysieren\n```bash\npython3 aleappGUI.py\n# Oder Command-Line\npython3 aleapp.py -t tar -i backup.tar -o output_folder\n```\n\n## Fall 3: MVT Kompromittierungsanalyse\n\n### Live-Geräteanalyse\n```bash\n# ADB-basierte Analyse\nmvt-android check-adb --output /path/to/output/\n\n# Backup-Analyse\nmvt-android check-backup --output /path/to/output/ backup.ab\n```\n\n### IOC-Suche mit Pegasus-Indikatoren\n```bash\n# Mit vorgefertigten IOCs\nmvt-android check-adb --iocs /path/to/pegasus.stix2 --output results/\n```\n\n## Fall 4: Physische Extraktion (Root erforderlich)\n\n### Device Rooting - MediaTek Geräte\n```bash\n# MTKClient für MediaTek-Chipsets\ngit clone https://github.com/bkerler/mtkclient.git\ncd mtkclient\npython3 mtk payload\n\n# Nach erfolgreichem Root\nadb shell su\n```\n\n### Vollständiges Memory Dump\n```bash\n# Partitionslayout ermitteln\nadb shell su -c \"cat /proc/partitions\"\nadb shell su -c \"ls -la /dev/block/\"\n\n# Vollständiges Device Image (Root erforderlich)\nadb shell su -c \"dd if=/dev/block/mmcblk0 of=/sdcard/full_device.img bs=4096\"\nadb pull /sdcard/full_device.img\n```\n\n# Best Practices\n\n## Rechtliche Compliance\n\n### Dokumentation und Chain of Custody\n- **Vollständige Dokumentation**: Wer, Was, Wann, Wo, Warum\n- **Hash-Verifikation**: MD5/SHA-256 für alle extrahierten Daten\n- **Nur forensische Kopien analysieren**, niemals Originaldaten\n- **Schriftliche Genehmigung** für Geräteanalyse einholen\n\n### Familiengeräte und Nachlässe\n- Genehmigung durch Nachlassverwalter erforderlich\n- Gerichtsbeschlüsse für Cloud-Zugang eventuell nötig\n- Drittpartei-Kommunikation kann weiterhin geschützt sein\n\n## Technische Best Practices\n\n### Hash-Integrität sicherstellen\n```bash\n# Hash vor und nach Transfer prüfen\nmd5sum original_file.db\nsha256sum original_file.db\n\n# Hash-Verifikation dokumentieren\necho \"$(date): MD5: $(md5sum file.db)\" >> chain_of_custody.log\n```\n\n### Sichere Arbeitsumgebung\n- Isolierte VM für Forensik-Arbeit\n- Netzwerk-Isolation während Analyse\n- Verschlüsselte Speicherung aller Evidenz\n- Regelmäßige Backups der Case-Datenbanken\n\n### Qualitätssicherung\n- Peer-Review kritischer Analysen\n- Standardisierte Arbeitsabläufe (SOPs)\n- Regelmäßige Tool-Validierung\n- Kontinuierliche Weiterbildung\n\n## Erfolgsmaximierung nach Gerätehersteller\n\n### MediaTek-Geräte (Höchste Erfolgsrate)\n- BootROM-Exploits für MT6735, MT6737, MT6750, MT6753, MT6797\n- MTKClient für Hardware-Level-Zugang\n- Erfolgsrate: 80%+ für Geräte 2015-2019\n\n### Samsung-Geräte\n- Ältere Knox-Implementierungen umgehbar\n- Emergency Dialer Exploits für Android 4.x\n- Erfolgsrate: 40-70% je nach Knox-Version\n\n### Pixel/Nexus-Geräte\n- Bootloader-Unlocking oft möglich\n- Fastboot-basierte Recovery-Installation\n- Erfolgsrate: 60-80% bei freigeschaltetem Bootloader\n\n# Troubleshooting\n\n## Problem: ADB erkennt Gerät nicht\n\n### Lösung: USB-Treiber und Berechtigungen\n```bash\n# Linux: USB-Berechtigungen prüfen\nlsusb | grep -i android\nsudo chmod 666 /dev/bus/usb/XXX/XXX\n\n# udev-Regeln erstellen\necho 'SUBSYSTEM==\"usb\", ATTR{idVendor}==\"18d1\", MODE=\"0666\", GROUP=\"plugdev\"' | sudo tee /etc/udev/rules.d/51-android.rules\nsudo udevadm control --reload-rules\n```\n\n### Windows: Treiber-Installation\n1. Geräte-Manager öffnen\n2. Android-Gerät mit Warnsymbol finden\n3. Treiber manuell installieren (Android USB Driver)\n\n## Problem: Verschlüsselte Android Backups\n\n### Lösung: Android Backup Extractor\n```bash\n# ADB Backup Extractor installieren\ngit clone https://github.com/nelenkov/android-backup-extractor.git\ncd android-backup-extractor\ngradle build\n\n# Backup entschlüsseln\njava -jar abe.jar unpack backup.ab backup.tar [password]\n```\n\n## Problem: Unzureichende Berechtigungen für Datenextraktion\n\n### Lösung: Alternative Extraktionsmethoden\n```bash\n# AFLogical OSE für begrenzte Extraktion ohne Root\n# WhatsApp Key/DB Extractor für spezifische Apps\n# Backup-basierte Extraktion als Fallback\n\n# Custom Recovery für erweiterten Zugang\nfastboot flash recovery twrp-device.img\n```\n\n## Problem: ALEAPP Parsing-Fehler\n\n### Lösung: Datenformat-Probleme beheben\n```bash\n# Log-Dateien prüfen\npython3 aleapp.py -t dir -i /path/to/data -o output --debug\n\n# Spezifische Parser deaktivieren\n# Manuelle SQLite-Analyse bei Parser-Fehlern\nsqlite3 database.db \".tables\"\nsqlite3 database.db \".schema table_name\"\n```\n\n# Erweiterte Techniken\n\n## Memory Forensics mit LiME\n\n### LiME für ARM-Devices kompilieren\n```bash\n# Cross-Compilation Setup\nexport ARCH=arm\nexport CROSS_COMPILE=arm-linux-gnueabi-\nexport KERNEL_DIR=/path/to/kernel/source\n\n# LiME Module kompilieren\ngit clone https://github.com/504ensicsLabs/LiME.git\ncd LiME/src\nmake\n\n# Memory Dump erstellen (Root erforderlich)\nadb push lime.ko /data/local/tmp/\nadb shell su -c \"insmod /data/local/tmp/lime.ko 'path=/sdcard/memory.lime format=lime'\"\n```\n\n### Volatility-Analyse von Android Memory\n```bash\n# Memory Dump analysieren\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.pslist\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.bash\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.netstat\n```\n\n## FRIDA-basierte Runtime-Analyse\n\n### FRIDA für Kryptographie-Hooks\n```javascript\n// crypto_hooks.js - SSL/TLS Traffic abfangen\nJava.perform(function() {\n var SSLContext = Java.use(\"javax.net.ssl.SSLContext\");\n SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(keyManagers, trustManagers, secureRandom) {\n console.log(\"[+] SSLContext.init() called\");\n this.init(keyManagers, trustManagers, secureRandom);\n };\n});\n```\n\n### FRIDA Installation und Verwendung\n```bash\n# FRIDA Server auf Android-Gerät installieren\nadb push frida-server /data/local/tmp/\nadb shell su -c \"chmod 755 /data/local/tmp/frida-server\"\nadb shell su -c \"/data/local/tmp/frida-server &\"\n\n# Script ausführen\nfrida -U -l crypto_hooks.js com.target.package\n```\n\n## Custom Recovery und Fastboot-Exploits\n\n### TWRP Installation für forensischen Zugang\n```bash\n# Bootloader entsperren (Herstellerabhängig)\nfastboot oem unlock\n# Oder\nfastboot flashing unlock\n\n# TWRP flashen\nfastboot flash recovery twrp-device.img\nfastboot boot twrp-device.img # Temporäre Installation\n\n# In TWRP: ADB-Zugang mit Root-Berechtigungen\nadb shell mount /system\nadb shell mount /data\n```\n\n### Partitions-Imaging mit dd\n```bash\n# Vollständige Partition-Liste\nadb shell cat /proc/partitions\n\n# Kritische Partitionen extrahieren\nadb shell dd if=/dev/block/bootdevice/by-name/system of=/external_sd/system.img\nadb shell dd if=/dev/block/bootdevice/by-name/userdata of=/external_sd/userdata.img\nadb shell dd if=/dev/block/bootdevice/by-name/boot of=/external_sd/boot.img\n```\n\n## SQLite Forensics und gelöschte Daten\n\n### Erweiterte SQLite-Analyse\n```bash\n# Freelist-Analyse für gelöschte Einträge\nsqlite3 database.db \"PRAGMA freelist_count;\"\nsqlite3 database.db \"PRAGMA page_size;\"\n\n# WAL-Datei Analyse\nsqlite3 database.db \"PRAGMA wal_checkpoint;\"\nstrings database.db-wal | grep -i \"search_term\"\n\n# Undark für Deleted Record Recovery\nundark database.db --freelist --export-csv\n```\n\n### Timeline-Rekonstruktion\n```bash\n# Autopsy Timeline-Generierung\n# Tools → Generate Timeline\n# Analyse von MAC-Times (Modified, Accessed, Created)\n\n# Plaso Timeline-Tools\nlog2timeline.py timeline.plaso /path/to/android/data/\npsort.py -o dynamic timeline.plaso\n```\n\n## Weiterführende Ressourcen\n\n### Dokumentation und Standards\n- [NIST SP 800-101 Rev. 1 - Mobile Device Forensics Guidelines](https://csrc.nist.gov/pubs/sp/800/101/r1/final)\n- [SANS FOR585 - Smartphone Forensics](https://www.sans.org/cyber-security-courses/advanced-smartphone-mobile-device-forensics/)\n- [ALEAPP GitHub Repository](https://github.com/abrignoni/ALEAPP)\n- [MVT Documentation](https://docs.mvt.re/en/latest/)\n\n### Community und Weiterbildung\n- [Autopsy User Documentation](https://sleuthkit.org/autopsy/docs/)\n- [Android Forensics References](https://github.com/impillar/AndroidReferences/blob/master/AndroidTools.md)\n- [Digital Forensics Framework Collection](https://github.com/mesquidar/ForensicsTools)\n\n### Spezialisierte Tools\n- [MTKClient für MediaTek Exploits](https://github.com/bkerler/mtkclient)\n- [Android Forensics Framework](https://github.com/nowsecure/android-forensics)\n- [Santoku Linux Mobile Forensics Distribution](https://santoku-linux.com/)\n\n---\n\n**Wichtiger Hinweis**: Diese Anleitung dient ausschließlich für autorisierte forensische Untersuchungen. Stellen Sie sicher, dass Sie über entsprechende rechtliche Befugnisse verfügen, bevor Sie diese Techniken anwenden. Bei Zweifeln konsultieren Sie Rechtsberatung.","src/content/knowledgebase/android-logical-imaging.md","0bb3f1d2c872d2bf",{"html":307,"metadata":308},"\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Open-Source Android Forensik bietet robuste Alternativen zu kommerziellen Lösungen wie Cellebrite UFED und Magnet AXIOM. Besonders für ältere Android-Geräte (5+ Jahre) existieren bewährte Methoden zur Datenextraktion und -analyse.\u003C/p>\n\u003Ch2 id=\"kernkomponenten-des-open-source-forensik-stacks\">Kernkomponenten des Open-Source Forensik-Stacks\u003C/h2>\n\u003Cp>\u003Cstrong>Autopsy Digital Forensics Platform\u003C/strong> bildet das Fundament mit GUI-basierter Analyse und integrierten Android-Parsing-Fähigkeiten. Die Plattform unterstützt \u003Cstrong>ALEAPP (Android Logs Events And Protobuf Parser)\u003C/strong>, das über 100 Artefakt-Kategorien aus Android-Extraktionen parst.\u003C/p>\n\u003Cp>\u003Cstrong>Mobile Verification Toolkit (MVT)\u003C/strong> von Amnesty International bietet spezialisierte Command-Line-Tools für Android-Analyse mit Fokus auf Kompromittierungserkennung.\u003C/p>\n\u003Cp>\u003Cstrong>SIFT Workstation\u003C/strong> stellt eine komplette Ubuntu-basierte forensische Umgebung mit 125+ vorinstallierten Tools bereit.\u003C/p>\n\u003Ch2 id=\"erfolgsraten-nach-gerätealter\">Erfolgsraten nach Gerätealter\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Pre-2017 Geräte\u003C/strong>: 85-98% logische Extraktion, 30-70% physische Extraktion\u003C/li>\n\u003Cli>\u003Cstrong>2017-2019 Geräte\u003C/strong>: 80-95% logische Extraktion, 15-35% physische Extraktion\u003C/li>\n\u003Cli>\u003Cstrong>2020+ Geräte\u003C/strong>: 70-85% logische Extraktion, 5-15% physische Extraktion\u003C/li>\n\u003C/ul>\n\u003Ch1 id=\"installation\">Installation\u003C/h1>\n\u003Ch2 id=\"sift-workstation-setup\">SIFT Workstation Setup\u003C/h2>\n\u003Ch3 id=\"systemanforderungen\">Systemanforderungen\u003C/h3>\n\u003Cul>\n\u003Cli>Quad-Core CPU 2.5GHz+\u003C/li>\n\u003Cli>16GB+ RAM\u003C/li>\n\u003Cli>500GB+ SSD Speicher\u003C/li>\n\u003Cli>USB 3.0+ Anschlüsse\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installation-1\">Installation\u003C/h3>\n\u003Col>\n\u003Cli>Download von \u003Ca href=\"https://www.sans.org/tools/sift-workstation/\">SANS SIFT Workstation\u003C/a>\u003C/li>\n\u003Cli>VMware/VirtualBox Import der OVA-Datei\u003C/li>\n\u003Cli>VM-Konfiguration: 8GB+ RAM, 4+ CPU-Kerne\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Update nach Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> upgrade\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -y\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sift\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"autopsy-installation\">Autopsy Installation\u003C/h2>\n\u003Ch3 id=\"windows-installation\">Windows Installation\u003C/h3>\n\u003Col>\n\u003Cli>Download von \u003Ca href=\"https://www.autopsy.com/\">autopsy.com\u003C/a>\u003C/li>\n\u003Cli>Java 8+ Installation erforderlich\u003C/li>\n\u003Cli>Installation mit Administratorrechten\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"linux-installation\">Linux Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ubuntu/Debian\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> autopsy\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sleuthkit\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder manueller Download und Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/sleuthkit/autopsy/releases/latest\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"essential-tools-installation\">Essential Tools Installation\u003C/h2>\n\u003Ch3 id=\"android-debug-bridge-adb\">Android Debug Bridge (ADB)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ubuntu/Debian\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-tools-adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-tools-fastboot\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Windows - Download Android Platform Tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># https://developer.android.com/studio/releases/platform-tools\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"aleapp-installation\">ALEAPP Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/abrignoni/ALEAPP.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ALEAPP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> requirements.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"mobile-verification-toolkit-mvt\">Mobile Verification Toolkit (MVT)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mvt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder via GitHub für neueste Version\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/mvt-project/mvt.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mvt\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> .\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"andriller-installation\">Andriller Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/den4uk/andriller.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> andriller\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> requirements.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"konfiguration\">Konfiguration\u003C/h1>\n\u003Ch2 id=\"adb-setup-und-gerätevorbereitung\">ADB Setup und Gerätevorbereitung\u003C/h2>\n\u003Ch3 id=\"usb-debugging-aktivieren\">USB-Debugging aktivieren\u003C/h3>\n\u003Col>\n\u003Cli>Entwickleroptionen freischalten (7x Build-Nummer antippen)\u003C/li>\n\u003Cli>USB-Debugging aktivieren\u003C/li>\n\u003Cli>Gerät via USB verbinden\u003C/li>\n\u003Cli>RSA-Fingerprint akzeptieren\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"adb-verbindung-testen\">ADB Verbindung testen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> devices\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Sollte Gerät mit \"device\" Status zeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ro.build.version.release\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Android Version\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ro.product.model\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Gerätemodell\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"autopsy-projektkonfiguration\">Autopsy Projektkonfiguration\u003C/h2>\n\u003Ch3 id=\"case-setup\">Case-Setup\u003C/h3>\n\u003Col>\n\u003Cli>Neuen Fall erstellen\u003C/li>\n\u003Cli>Ermittler-Informationen eingeben\u003C/li>\n\u003Cli>Case-Verzeichnis festlegen (ausreichend Speicherplatz)\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"android-analyzer-module-aktivieren\">Android Analyzer Module aktivieren\u003C/h3>\n\u003Cul>\n\u003Cli>Tools → Options → Modules\u003C/li>\n\u003Cli>Android Analyzer aktivieren\u003C/li>\n\u003Cli>ALEAPP Integration konfigurieren\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"hash-algorithmen-konfigurieren\">Hash-Algorithmen konfigurieren\u003C/h3>\n\u003Cul>\n\u003Cli>MD5, SHA-1, SHA-256 für Integritätsprüfung\u003C/li>\n\u003Cli>Automatische Hash-Berechnung bei Import aktivieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"mvt-konfiguration\">MVT Konfiguration\u003C/h2>\n\u003Ch3 id=\"konfigurationsdatei-erstellen\">Konfigurationsdatei erstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"yaml\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ~/.mvt/config.yaml\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">adb_path\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/usr/bin/adb\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">output_folder\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/home/user/mvt_output\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h1>\n\u003Ch2 id=\"fall-1-logische-datenextraktion-mit-adb\">Fall 1: Logische Datenextraktion mit ADB\u003C/h2>\n\u003Ch3 id=\"geräteinformationen-sammeln\">Geräteinformationen sammeln\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Systeminfo\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> device_properties.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /proc/version\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> kernel_info.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount_info.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Installierte Apps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pm\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> list\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> packages\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> installed_packages.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"datenbank-extraktion\">Datenbank-Extraktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SMS/MMS Datenbank\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.telephony/databases/mmssms.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Kontakte\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.contacts/databases/contacts2.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Anrufliste \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.contacts/databases/calllog.db\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"whatsapp-datenextraktion\">WhatsApp Datenextraktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WhatsApp Datenbanken (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"cp -r /data/data/com.whatsapp/ /sdcard/whatsapp_backup/\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /sdcard/whatsapp_backup/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-2-android-backup-analyse\">Fall 2: Android Backup-Analyse\u003C/h2>\n\u003Ch3 id=\"vollständiges-backup-erstellen\">Vollständiges Backup erstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Umfassendes Backup (ohne Root)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -all\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -system\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -apk\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -shared\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup entschlüsseln (falls verschlüsselt)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">java\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> abe.jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unpack\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -xf\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"backup-mit-aleapp-analysieren\">Backup mit ALEAPP analysieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleappGUI.py\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder Command-Line\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleapp.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> output_folder\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-3-mvt-kompromittierungsanalyse\">Fall 3: MVT Kompromittierungsanalyse\u003C/h2>\n\u003Ch3 id=\"live-geräteanalyse\">Live-Geräteanalyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ADB-basierte Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-adb\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/output/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-backup\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/output/\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"ioc-suche-mit-pegasus-indikatoren\">IOC-Suche mit Pegasus-Indikatoren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit vorgefertigten IOCs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-adb\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --iocs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/pegasus.stix2\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> results/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-4-physische-extraktion-root-erforderlich\">Fall 4: Physische Extraktion (Root erforderlich)\u003C/h2>\n\u003Ch3 id=\"device-rooting---mediatek-geräte\">Device Rooting - MediaTek Geräte\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MTKClient für MediaTek-Chipsets\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/bkerler/mtkclient.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mtkclient\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mtk\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> payload\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Nach erfolgreichem Root\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"vollständiges-memory-dump\">Vollständiges Memory Dump\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Partitionslayout ermitteln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"cat /proc/partitions\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ls -la /dev/block/\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständiges Device Image (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"dd if=/dev/block/mmcblk0 of=/sdcard/full_device.img bs=4096\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /sdcard/full_device.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"best-practices\">Best Practices\u003C/h1>\n\u003Ch2 id=\"rechtliche-compliance\">Rechtliche Compliance\u003C/h2>\n\u003Ch3 id=\"dokumentation-und-chain-of-custody\">Dokumentation und Chain of Custody\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Vollständige Dokumentation\u003C/strong>: Wer, Was, Wann, Wo, Warum\u003C/li>\n\u003Cli>\u003Cstrong>Hash-Verifikation\u003C/strong>: MD5/SHA-256 für alle extrahierten Daten\u003C/li>\n\u003Cli>\u003Cstrong>Nur forensische Kopien analysieren\u003C/strong>, niemals Originaldaten\u003C/li>\n\u003Cli>\u003Cstrong>Schriftliche Genehmigung\u003C/strong> für Geräteanalyse einholen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"familiengeräte-und-nachlässe\">Familiengeräte und Nachlässe\u003C/h3>\n\u003Cul>\n\u003Cli>Genehmigung durch Nachlassverwalter erforderlich\u003C/li>\n\u003Cli>Gerichtsbeschlüsse für Cloud-Zugang eventuell nötig\u003C/li>\n\u003Cli>Drittpartei-Kommunikation kann weiterhin geschützt sein\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"technische-best-practices\">Technische Best Practices\u003C/h2>\n\u003Ch3 id=\"hash-integrität-sicherstellen\">Hash-Integrität sicherstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash vor und nach Transfer prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_file.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_file.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash-Verifikation dokumentieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"$(\u003C/span>\u003Cspan style=\"color:#B392F0\">date\u003C/span>\u003Cspan style=\"color:#9ECBFF\">): MD5: $(\u003C/span>\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> file.db)\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> chain_of_custody.log\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"sichere-arbeitsumgebung\">Sichere Arbeitsumgebung\u003C/h3>\n\u003Cul>\n\u003Cli>Isolierte VM für Forensik-Arbeit\u003C/li>\n\u003Cli>Netzwerk-Isolation während Analyse\u003C/li>\n\u003Cli>Verschlüsselte Speicherung aller Evidenz\u003C/li>\n\u003Cli>Regelmäßige Backups der Case-Datenbanken\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"qualitätssicherung\">Qualitätssicherung\u003C/h3>\n\u003Cul>\n\u003Cli>Peer-Review kritischer Analysen\u003C/li>\n\u003Cli>Standardisierte Arbeitsabläufe (SOPs)\u003C/li>\n\u003Cli>Regelmäßige Tool-Validierung\u003C/li>\n\u003Cli>Kontinuierliche Weiterbildung\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"erfolgsmaximierung-nach-gerätehersteller\">Erfolgsmaximierung nach Gerätehersteller\u003C/h2>\n\u003Ch3 id=\"mediatek-geräte-höchste-erfolgsrate\">MediaTek-Geräte (Höchste Erfolgsrate)\u003C/h3>\n\u003Cul>\n\u003Cli>BootROM-Exploits für MT6735, MT6737, MT6750, MT6753, MT6797\u003C/li>\n\u003Cli>MTKClient für Hardware-Level-Zugang\u003C/li>\n\u003Cli>Erfolgsrate: 80%+ für Geräte 2015-2019\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"samsung-geräte\">Samsung-Geräte\u003C/h3>\n\u003Cul>\n\u003Cli>Ältere Knox-Implementierungen umgehbar\u003C/li>\n\u003Cli>Emergency Dialer Exploits für Android 4.x\u003C/li>\n\u003Cli>Erfolgsrate: 40-70% je nach Knox-Version\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"pixelnexus-geräte\">Pixel/Nexus-Geräte\u003C/h3>\n\u003Cul>\n\u003Cli>Bootloader-Unlocking oft möglich\u003C/li>\n\u003Cli>Fastboot-basierte Recovery-Installation\u003C/li>\n\u003Cli>Erfolgsrate: 60-80% bei freigeschaltetem Bootloader\u003C/li>\n\u003C/ul>\n\u003Ch1 id=\"troubleshooting\">Troubleshooting\u003C/h1>\n\u003Ch2 id=\"problem-adb-erkennt-gerät-nicht\">Problem: ADB erkennt Gerät nicht\u003C/h2>\n\u003Ch3 id=\"lösung-usb-treiber-und-berechtigungen\">Lösung: USB-Treiber und Berechtigungen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Linux: USB-Berechtigungen prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">lsusb\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> chmod\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 666\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/bus/usb/XXX/XXX\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># udev-Regeln erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'SUBSYSTEM==\"usb\", ATTR{idVendor}==\"18d1\", MODE=\"0666\", GROUP=\"plugdev\"'\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tee\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /etc/udev/rules.d/51-android.rules\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> udevadm\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> control\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --reload-rules\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"windows-treiber-installation\">Windows: Treiber-Installation\u003C/h3>\n\u003Col>\n\u003Cli>Geräte-Manager öffnen\u003C/li>\n\u003Cli>Android-Gerät mit Warnsymbol finden\u003C/li>\n\u003Cli>Treiber manuell installieren (Android USB Driver)\u003C/li>\n\u003C/ol>\n\u003Ch2 id=\"problem-verschlüsselte-android-backups\">Problem: Verschlüsselte Android Backups\u003C/h2>\n\u003Ch3 id=\"lösung-android-backup-extractor\">Lösung: Android Backup Extractor\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ADB Backup Extractor installieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/nelenkov/android-backup-extractor.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-backup-extractor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">gradle\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> build\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup entschlüsseln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">java\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> abe.jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unpack\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [password]\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"problem-unzureichende-berechtigungen-für-datenextraktion\">Problem: Unzureichende Berechtigungen für Datenextraktion\u003C/h2>\n\u003Ch3 id=\"lösung-alternative-extraktionsmethoden\">Lösung: Alternative Extraktionsmethoden\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># AFLogical OSE für begrenzte Extraktion ohne Root\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WhatsApp Key/DB Extractor für spezifische Apps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup-basierte Extraktion als Fallback\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Custom Recovery für erweiterten Zugang\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> recovery\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"problem-aleapp-parsing-fehler\">Problem: ALEAPP Parsing-Fehler\u003C/h2>\n\u003Ch3 id=\"lösung-datenformat-probleme-beheben\">Lösung: Datenformat-Probleme beheben\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Log-Dateien prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleapp.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dir\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/data\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> output\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --debug\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Spezifische Parser deaktivieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Manuelle SQLite-Analyse bei Parser-Fehlern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \".tables\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \".schema table_name\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"erweiterte-techniken\">Erweiterte Techniken\u003C/h1>\n\u003Ch2 id=\"memory-forensics-mit-lime\">Memory Forensics mit LiME\u003C/h2>\n\u003Ch3 id=\"lime-für-arm-devices-kompilieren\">LiME für ARM-Devices kompilieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Cross-Compilation Setup\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ARCH\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">arm\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> CROSS_COMPILE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">arm-linux-gnueabi-\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> KERNEL_DIR\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">/path/to/kernel/source\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># LiME Module kompilieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/504ensicsLabs/LiME.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> LiME/src\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">make\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory Dump erstellen (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> push\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> lime.ko\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/local/tmp/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"insmod /data/local/tmp/lime.ko 'path=/sdcard/memory.lime format=lime'\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"volatility-analyse-von-android-memory\">Volatility-Analyse von Android Memory\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory Dump analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.pslist\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.netstat\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"frida-basierte-runtime-analyse\">FRIDA-basierte Runtime-Analyse\u003C/h2>\n\u003Ch3 id=\"frida-für-kryptographie-hooks\">FRIDA für Kryptographie-Hooks\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"javascript\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">// crypto_hooks.js - SSL/TLS Traffic abfangen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">Java.\u003C/span>\u003Cspan style=\"color:#B392F0\">perform\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">function\u003C/span>\u003Cspan style=\"color:#E1E4E8\">() {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> var\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> SSLContext \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Java.\u003C/span>\u003Cspan style=\"color:#B392F0\">use\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"javax.net.ssl.SSLContext\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> SSLContext.init.\u003C/span>\u003Cspan style=\"color:#B392F0\">overload\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'[Ljavax.net.ssl.KeyManager;'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'[Ljavax.net.ssl.TrustManager;'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'java.security.SecureRandom'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).\u003C/span>\u003Cspan style=\"color:#B392F0\">implementation\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#F97583\"> function\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#FFAB70\">keyManagers\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">trustManagers\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">secureRandom\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> console.\u003C/span>\u003Cspan style=\"color:#B392F0\">log\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"[+] SSLContext.init() called\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> this\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#B392F0\">init\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(keyManagers, trustManagers, secureRandom);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> };\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">});\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"frida-installation-und-verwendung\">FRIDA Installation und Verwendung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># FRIDA Server auf Android-Gerät installieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> push\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frida-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/local/tmp/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"chmod 755 /data/local/tmp/frida-server\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"/data/local/tmp/frida-server &\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Script ausführen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">frida\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -U\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -l\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> crypto_hooks.js\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> com.target.package\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"custom-recovery-und-fastboot-exploits\">Custom Recovery und Fastboot-Exploits\u003C/h2>\n\u003Ch3 id=\"twrp-installation-für-forensischen-zugang\">TWRP Installation für forensischen Zugang\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Bootloader entsperren (Herstellerabhängig)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> oem\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unlock\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flashing\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unlock\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># TWRP flashen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> recovery\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> boot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Temporäre Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># In TWRP: ADB-Zugang mit Root-Berechtigungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /system\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"partitions-imaging-mit-dd\">Partitions-Imaging mit dd\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständige Partition-Liste\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /proc/partitions\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Kritische Partitionen extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/system\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/system.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/userdata\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/userdata.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/boot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/boot.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"sqlite-forensics-und-gelöschte-daten\">SQLite Forensics und gelöschte Daten\u003C/h2>\n\u003Ch3 id=\"erweiterte-sqlite-analyse\">Erweiterte SQLite-Analyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Freelist-Analyse für gelöschte Einträge\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA freelist_count;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA page_size;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WAL-Datei Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA wal_checkpoint;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">strings\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db-wal\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"search_term\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Undark für Deleted Record Recovery\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">undark\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --freelist\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --export-csv\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"timeline-rekonstruktion\">Timeline-Rekonstruktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Autopsy Timeline-Generierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Tools → Generate Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Analyse von MAC-Times (Modified, Accessed, Created)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Plaso Timeline-Tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">log2timeline.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/android/data/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dynamic\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h2>\n\u003Ch3 id=\"dokumentation-und-standards\">Dokumentation und Standards\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://csrc.nist.gov/pubs/sp/800/101/r1/final\">NIST SP 800-101 Rev. 1 - Mobile Device Forensics Guidelines\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.sans.org/cyber-security-courses/advanced-smartphone-mobile-device-forensics/\">SANS FOR585 - Smartphone Forensics\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/abrignoni/ALEAPP\">ALEAPP GitHub Repository\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://docs.mvt.re/en/latest/\">MVT Documentation\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"community-und-weiterbildung\">Community und Weiterbildung\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://sleuthkit.org/autopsy/docs/\">Autopsy User Documentation\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/impillar/AndroidReferences/blob/master/AndroidTools.md\">Android Forensics References\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/mesquidar/ForensicsTools\">Digital Forensics Framework Collection\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"spezialisierte-tools\">Spezialisierte Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://github.com/bkerler/mtkclient\">MTKClient für MediaTek Exploits\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/nowsecure/android-forensics\">Android Forensics Framework\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://santoku-linux.com/\">Santoku Linux Mobile Forensics Distribution\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Wichtiger Hinweis\u003C/strong>: Diese Anleitung dient ausschließlich für autorisierte forensische Untersuchungen. Stellen Sie sicher, dass Sie über entsprechende rechtliche Befugnisse verfügen, bevor Sie diese Techniken anwenden. Bei Zweifeln konsultieren Sie Rechtsberatung.\u003C/p>",{"headings":309,"localImagePaths":531,"remoteImagePaths":532,"frontmatter":290,"imagePaths":533},[310,311,314,317,318,321,324,326,329,332,335,338,341,344,347,350,351,354,357,360,363,366,369,372,375,378,379,382,385,388,391,394,397,400,403,406,409,412,415,418,419,422,425,428,431,434,437,440,443,446,449,452,453,456,459,462,465,468,471,474,477,480,483,486,489,492,495,498,501,504,507,510,513,516,519,522,525,528],{"depth":41,"slug":42,"text":43},{"depth":45,"slug":312,"text":313},"kernkomponenten-des-open-source-forensik-stacks","Kernkomponenten des Open-Source Forensik-Stacks",{"depth":45,"slug":315,"text":316},"erfolgsraten-nach-gerätealter","Erfolgsraten nach Gerätealter",{"depth":41,"slug":104,"text":105},{"depth":45,"slug":319,"text":320},"sift-workstation-setup","SIFT Workstation Setup",{"depth":49,"slug":322,"text":323},"systemanforderungen","Systemanforderungen",{"depth":49,"slug":325,"text":105},"installation-1",{"depth":45,"slug":327,"text":328},"autopsy-installation","Autopsy Installation",{"depth":49,"slug":330,"text":331},"windows-installation","Windows Installation",{"depth":49,"slug":333,"text":334},"linux-installation","Linux Installation",{"depth":45,"slug":336,"text":337},"essential-tools-installation","Essential Tools Installation",{"depth":49,"slug":339,"text":340},"android-debug-bridge-adb","Android Debug Bridge (ADB)",{"depth":49,"slug":342,"text":343},"aleapp-installation","ALEAPP Installation",{"depth":49,"slug":345,"text":346},"mobile-verification-toolkit-mvt","Mobile Verification Toolkit (MVT)",{"depth":49,"slug":348,"text":349},"andriller-installation","Andriller Installation",{"depth":41,"slug":113,"text":114},{"depth":45,"slug":352,"text":353},"adb-setup-und-gerätevorbereitung","ADB Setup und Gerätevorbereitung",{"depth":49,"slug":355,"text":356},"usb-debugging-aktivieren","USB-Debugging aktivieren",{"depth":49,"slug":358,"text":359},"adb-verbindung-testen","ADB Verbindung testen",{"depth":45,"slug":361,"text":362},"autopsy-projektkonfiguration","Autopsy Projektkonfiguration",{"depth":49,"slug":364,"text":365},"case-setup","Case-Setup",{"depth":49,"slug":367,"text":368},"android-analyzer-module-aktivieren","Android Analyzer Module aktivieren",{"depth":49,"slug":370,"text":371},"hash-algorithmen-konfigurieren","Hash-Algorithmen konfigurieren",{"depth":45,"slug":373,"text":374},"mvt-konfiguration","MVT Konfiguration",{"depth":49,"slug":376,"text":377},"konfigurationsdatei-erstellen","Konfigurationsdatei erstellen",{"depth":41,"slug":46,"text":47},{"depth":45,"slug":380,"text":381},"fall-1-logische-datenextraktion-mit-adb","Fall 1: Logische Datenextraktion mit ADB",{"depth":49,"slug":383,"text":384},"geräteinformationen-sammeln","Geräteinformationen sammeln",{"depth":49,"slug":386,"text":387},"datenbank-extraktion","Datenbank-Extraktion",{"depth":49,"slug":389,"text":390},"whatsapp-datenextraktion","WhatsApp Datenextraktion",{"depth":45,"slug":392,"text":393},"fall-2-android-backup-analyse","Fall 2: Android Backup-Analyse",{"depth":49,"slug":395,"text":396},"vollständiges-backup-erstellen","Vollständiges Backup erstellen",{"depth":49,"slug":398,"text":399},"backup-mit-aleapp-analysieren","Backup mit ALEAPP analysieren",{"depth":45,"slug":401,"text":402},"fall-3-mvt-kompromittierungsanalyse","Fall 3: MVT Kompromittierungsanalyse",{"depth":49,"slug":404,"text":405},"live-geräteanalyse","Live-Geräteanalyse",{"depth":49,"slug":407,"text":408},"ioc-suche-mit-pegasus-indikatoren","IOC-Suche mit Pegasus-Indikatoren",{"depth":45,"slug":410,"text":411},"fall-4-physische-extraktion-root-erforderlich","Fall 4: Physische Extraktion (Root erforderlich)",{"depth":49,"slug":413,"text":414},"device-rooting---mediatek-geräte","Device Rooting - MediaTek Geräte",{"depth":49,"slug":416,"text":417},"vollständiges-memory-dump","Vollständiges Memory Dump",{"depth":41,"slug":62,"text":63},{"depth":45,"slug":420,"text":421},"rechtliche-compliance","Rechtliche Compliance",{"depth":49,"slug":423,"text":424},"dokumentation-und-chain-of-custody","Dokumentation und Chain of Custody",{"depth":49,"slug":426,"text":427},"familiengeräte-und-nachlässe","Familiengeräte und Nachlässe",{"depth":45,"slug":429,"text":430},"technische-best-practices","Technische Best Practices",{"depth":49,"slug":432,"text":433},"hash-integrität-sicherstellen","Hash-Integrität sicherstellen",{"depth":49,"slug":435,"text":436},"sichere-arbeitsumgebung","Sichere Arbeitsumgebung",{"depth":49,"slug":438,"text":439},"qualitätssicherung","Qualitätssicherung",{"depth":45,"slug":441,"text":442},"erfolgsmaximierung-nach-gerätehersteller","Erfolgsmaximierung nach Gerätehersteller",{"depth":49,"slug":444,"text":445},"mediatek-geräte-höchste-erfolgsrate","MediaTek-Geräte (Höchste Erfolgsrate)",{"depth":49,"slug":447,"text":448},"samsung-geräte","Samsung-Geräte",{"depth":49,"slug":450,"text":451},"pixelnexus-geräte","Pixel/Nexus-Geräte",{"depth":41,"slug":133,"text":134},{"depth":45,"slug":454,"text":455},"problem-adb-erkennt-gerät-nicht","Problem: ADB erkennt Gerät nicht",{"depth":49,"slug":457,"text":458},"lösung-usb-treiber-und-berechtigungen","Lösung: USB-Treiber und Berechtigungen",{"depth":49,"slug":460,"text":461},"windows-treiber-installation","Windows: Treiber-Installation",{"depth":45,"slug":463,"text":464},"problem-verschlüsselte-android-backups","Problem: Verschlüsselte Android Backups",{"depth":49,"slug":466,"text":467},"lösung-android-backup-extractor","Lösung: Android Backup Extractor",{"depth":45,"slug":469,"text":470},"problem-unzureichende-berechtigungen-für-datenextraktion","Problem: Unzureichende Berechtigungen für Datenextraktion",{"depth":49,"slug":472,"text":473},"lösung-alternative-extraktionsmethoden","Lösung: Alternative Extraktionsmethoden",{"depth":45,"slug":475,"text":476},"problem-aleapp-parsing-fehler","Problem: ALEAPP Parsing-Fehler",{"depth":49,"slug":478,"text":479},"lösung-datenformat-probleme-beheben","Lösung: Datenformat-Probleme beheben",{"depth":41,"slug":481,"text":482},"erweiterte-techniken","Erweiterte Techniken",{"depth":45,"slug":484,"text":485},"memory-forensics-mit-lime","Memory Forensics mit LiME",{"depth":49,"slug":487,"text":488},"lime-für-arm-devices-kompilieren","LiME für ARM-Devices kompilieren",{"depth":49,"slug":490,"text":491},"volatility-analyse-von-android-memory","Volatility-Analyse von Android Memory",{"depth":45,"slug":493,"text":494},"frida-basierte-runtime-analyse","FRIDA-basierte Runtime-Analyse",{"depth":49,"slug":496,"text":497},"frida-für-kryptographie-hooks","FRIDA für Kryptographie-Hooks",{"depth":49,"slug":499,"text":500},"frida-installation-und-verwendung","FRIDA Installation und Verwendung",{"depth":45,"slug":502,"text":503},"custom-recovery-und-fastboot-exploits","Custom Recovery und Fastboot-Exploits",{"depth":49,"slug":505,"text":506},"twrp-installation-für-forensischen-zugang","TWRP Installation für forensischen Zugang",{"depth":49,"slug":508,"text":509},"partitions-imaging-mit-dd","Partitions-Imaging mit dd",{"depth":45,"slug":511,"text":512},"sqlite-forensics-und-gelöschte-daten","SQLite Forensics und gelöschte Daten",{"depth":49,"slug":514,"text":515},"erweiterte-sqlite-analyse","Erweiterte SQLite-Analyse",{"depth":49,"slug":517,"text":518},"timeline-rekonstruktion","Timeline-Rekonstruktion",{"depth":45,"slug":520,"text":521},"weiterführende-ressourcen","Weiterführende Ressourcen",{"depth":49,"slug":523,"text":524},"dokumentation-und-standards","Dokumentation und Standards",{"depth":49,"slug":526,"text":527},"community-und-weiterbildung","Community und Weiterbildung",{"depth":49,"slug":529,"text":530},"spezialisierte-tools","Spezialisierte Tools",[],[],[],"android-logical-imaging.md","nextcloud",{"id":535,"data":537,"body":551,"filePath":552,"digest":553,"rendered":554,"legacyId":590},{"title":538,"tool_name":539,"description":540,"last_updated":541,"author":16,"difficulty":542,"categories":543,"tags":545,"sections":550,"review_status":32},"Nextcloud - Sichere Kollaborationsplattform","Nextcloud","Detaillierte Anleitung und Best Practices für Nextcloud in forensischen Einsatzszenarien",["Date","2025-07-20T00:00:00.000Z"],"novice",[544],"collaboration-general",[88,546,547,90,548,549],"collaboration","file-sharing","encryption","document-management",{"overview":30,"installation":30,"configuration":30,"usage_examples":30,"best_practices":30,"troubleshooting":30,"advanced_topics":31},"> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nNextcloud ist eine Open-Source-Cloud-Suite, die speziell für die sichere Zusammenarbeit entwickelt wurde. Sie eignet sich ideal für forensische Teams, da sie eine DSGVO-konforme Umgebung mit verschlüsselter Dateiablage, Office-Integration und Videokonferenzen bereitstellt. Zusätzlich bietet Nextcloud einen integrierten SSO-Provider, der das Identitätsmanagement für andere forensische Tools stark vereinfacht.\n\nSkalierbar von kleinen Raspberry-Pi-Installationen bis hin zu hochverfügbaren Multi-Node-Setups.\n\n- **Website:** [nextcloud.com](https://nextcloud.com/)\n- **Demo/Projektinstanz:** [cloud.cc24.dev](https://cloud.cc24.dev)\n- **Statusseite:** [Mikoshi Status](https://status.mikoshi.de/api/badge/11/status)\n- **Lizenz:** AGPL-3.0\n\n---\n\n## Installation\n\n### Voraussetzungen\n\n- Linux-Server oder Raspberry Pi\n- PHP 8.1 oder höher\n- MariaDB/PostgreSQL\n- Webserver (Apache/Nginx)\n- SSL-Zertifikat (empfohlen: Let's Encrypt)\n\n### Installationsschritte (Ubuntu Beispiel)\n\n```bash\nsudo apt update && sudo apt upgrade\nsudo apt install apache2 mariadb-server libapache2-mod-php php php-mysql \\\n php-gd php-xml php-mbstring php-curl php-zip php-intl php-bcmath unzip\n\nwget https://download.nextcloud.com/server/releases/latest.zip\nunzip latest.zip -d /var/www/\nchown -R www-data:www-data /var/www/nextcloud\n````\n\nDanach den Web-Installer im Browser aufrufen (`https://\u003Cyour-domain>/nextcloud`) und Setup abschließen.\n\n## Konfiguration\n\n* **Trusted Domains** in `config.php` definieren\n* SSO mit OpenID Connect aktivieren\n* Dateiverschlüsselung aktivieren (`Settings → Security`)\n* Benutzer und Gruppen über LDAP oder SAML integrieren\n\n## Verwendungsbeispiele\n\n### Gemeinsame Fallbearbeitung\n\n1. Ermittlungsordner als geteiltes Gruppenverzeichnis anlegen\n2. Versionierung und Kommentare zu forensischen Berichten aktivieren\n3. Vorschau für Office-Dateien, PDFs und Bilder direkt im Browser nutzen\n\n### Videokonferenzen mit \"Nextcloud Talk\"\n\n* Sichere Kommunikation zwischen Ermittlern und Sachverständigen\n* Ende-zu-Ende-verschlüsselt\n* Bildschirmfreigabe möglich\n\n### Automatischer Dateiimport per API\n\n* REST-Schnittstelle nutzen, um z. B. automatisch Logdateien oder Exportdaten hochzuladen\n* Ideal für Anbindung an SIEM, DLP oder Analyse-Pipelines\n\n## Best Practices\n\n* Zwei-Faktor-Authentifizierung aktivieren\n* Tägliche Backups der Datenbank und Datenstruktur\n* Nutzung von OnlyOffice oder Collabora für revisionssichere Dokumentenbearbeitung\n* Zugriff regelmäßig überprüfen, insbesondere bei externen Partnern\n\n## Troubleshooting\n\n### Problem: Langsame Performance\n\n**Lösung:** APCu aktivieren und Caching optimieren (`config.php → 'memcache.local'`).\n\n### Problem: Dateien erscheinen nicht im Sync\n\n**Lösung:** Cronjob für `files:scan` konfigurieren oder manuell ausführen:\n\n```bash\nsudo -u www-data php /var/www/nextcloud/occ files:scan --all\n```\n\n### Problem: Fehlermeldung \"Trusted domain not set\"\n\n**Lösung:** In `config/config.php` Eintrag `trusted_domains` korrekt konfigurieren:\n\n```php\n'trusted_domains' =>\n array (\n 0 => 'yourdomain.tld',\n 1 => 'cloud.cc24.dev',\n ),\n```\n\n## Weiterführende Themen\n\n* **Integration mit Forensik-Plattformen** (über WebDAV, API oder SSO)\n* **Custom Apps entwickeln** für spezielle Ermittlungs-Workflows\n* **Auditing aktivieren**: Nutzung und Änderungen nachvollziehen mit Protokollierungsfunktionen","src/content/knowledgebase/nextcloud.md","9294074e6083e37b",{"html":555,"metadata":556},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Nextcloud ist eine Open-Source-Cloud-Suite, die speziell für die sichere Zusammenarbeit entwickelt wurde. Sie eignet sich ideal für forensische Teams, da sie eine DSGVO-konforme Umgebung mit verschlüsselter Dateiablage, Office-Integration und Videokonferenzen bereitstellt. Zusätzlich bietet Nextcloud einen integrierten SSO-Provider, der das Identitätsmanagement für andere forensische Tools stark vereinfacht.\u003C/p>\n\u003Cp>Skalierbar von kleinen Raspberry-Pi-Installationen bis hin zu hochverfügbaren Multi-Node-Setups.\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Website:\u003C/strong> \u003Ca href=\"https://nextcloud.com/\">nextcloud.com\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Demo/Projektinstanz:\u003C/strong> \u003Ca href=\"https://cloud.cc24.dev\">cloud.cc24.dev\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Statusseite:\u003C/strong> \u003Ca href=\"https://status.mikoshi.de/api/badge/11/status\">Mikoshi Status\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Lizenz:\u003C/strong> AGPL-3.0\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>Linux-Server oder Raspberry Pi\u003C/li>\n\u003Cli>PHP 8.1 oder höher\u003C/li>\n\u003Cli>MariaDB/PostgreSQL\u003C/li>\n\u003Cli>Webserver (Apache/Nginx)\u003C/li>\n\u003Cli>SSL-Zertifikat (empfohlen: Let’s Encrypt)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installationsschritte-ubuntu-beispiel\">Installationsschritte (Ubuntu Beispiel)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> upgrade\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apache2\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mariadb-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> libapache2-mod-php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-mysql\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> php-gd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-xml\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-mbstring\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-curl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-zip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-intl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-bcmath\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unzip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://download.nextcloud.com/server/releases/latest.zip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">unzip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> latest.zip\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">chown\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -R\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> www-data:www-data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/nextcloud\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Danach den Web-Installer im Browser aufrufen (\u003Ccode>https://<your-domain>/nextcloud\u003C/code>) und Setup abschließen.\u003C/p>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Trusted Domains\u003C/strong> in \u003Ccode>config.php\u003C/code> definieren\u003C/li>\n\u003Cli>SSO mit OpenID Connect aktivieren\u003C/li>\n\u003Cli>Dateiverschlüsselung aktivieren (\u003Ccode>Settings → Security\u003C/code>)\u003C/li>\n\u003Cli>Benutzer und Gruppen über LDAP oder SAML integrieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"gemeinsame-fallbearbeitung\">Gemeinsame Fallbearbeitung\u003C/h3>\n\u003Col>\n\u003Cli>Ermittlungsordner als geteiltes Gruppenverzeichnis anlegen\u003C/li>\n\u003Cli>Versionierung und Kommentare zu forensischen Berichten aktivieren\u003C/li>\n\u003Cli>Vorschau für Office-Dateien, PDFs und Bilder direkt im Browser nutzen\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"videokonferenzen-mit-nextcloud-talk\">Videokonferenzen mit “Nextcloud Talk”\u003C/h3>\n\u003Cul>\n\u003Cli>Sichere Kommunikation zwischen Ermittlern und Sachverständigen\u003C/li>\n\u003Cli>Ende-zu-Ende-verschlüsselt\u003C/li>\n\u003Cli>Bildschirmfreigabe möglich\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"automatischer-dateiimport-per-api\">Automatischer Dateiimport per API\u003C/h3>\n\u003Cul>\n\u003Cli>REST-Schnittstelle nutzen, um z. B. automatisch Logdateien oder Exportdaten hochzuladen\u003C/li>\n\u003Cli>Ideal für Anbindung an SIEM, DLP oder Analyse-Pipelines\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Zwei-Faktor-Authentifizierung aktivieren\u003C/li>\n\u003Cli>Tägliche Backups der Datenbank und Datenstruktur\u003C/li>\n\u003Cli>Nutzung von OnlyOffice oder Collabora für revisionssichere Dokumentenbearbeitung\u003C/li>\n\u003Cli>Zugriff regelmäßig überprüfen, insbesondere bei externen Partnern\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-langsame-performance\">Problem: Langsame Performance\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> APCu aktivieren und Caching optimieren (\u003Ccode>config.php → 'memcache.local'\u003C/code>).\u003C/p>\n\u003Ch3 id=\"problem-dateien-erscheinen-nicht-im-sync\">Problem: Dateien erscheinen nicht im Sync\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Cronjob für \u003Ccode>files:scan\u003C/code> konfigurieren oder manuell ausführen:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> www-data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/nextcloud/occ\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> files:scan\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --all\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-fehlermeldung-trusted-domain-not-set\">Problem: Fehlermeldung “Trusted domain not set”\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> In \u003Ccode>config/config.php\u003C/code> Eintrag \u003Ccode>trusted_domains\u003C/code> korrekt konfigurieren:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"php\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">'trusted_domains'\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> array\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'yourdomain.tld'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'cloud.cc24.dev'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ),\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Integration mit Forensik-Plattformen\u003C/strong> (über WebDAV, API oder SSO)\u003C/li>\n\u003Cli>\u003Cstrong>Custom Apps entwickeln\u003C/strong> für spezielle Ermittlungs-Workflows\u003C/li>\n\u003Cli>\u003Cstrong>Auditing aktivieren\u003C/strong>: Nutzung und Änderungen nachvollziehen mit Protokollierungsfunktionen\u003C/li>\n\u003C/ul>",{"headings":557,"localImagePaths":587,"remoteImagePaths":588,"frontmatter":537,"imagePaths":589},[558,559,560,561,564,565,566,569,572,575,576,577,580,583,586],{"depth":41,"slug":42,"text":43},{"depth":45,"slug":104,"text":105},{"depth":49,"slug":107,"text":108},{"depth":49,"slug":562,"text":563},"installationsschritte-ubuntu-beispiel","Installationsschritte (Ubuntu Beispiel)",{"depth":45,"slug":113,"text":114},{"depth":45,"slug":46,"text":47},{"depth":49,"slug":567,"text":568},"gemeinsame-fallbearbeitung","Gemeinsame Fallbearbeitung",{"depth":49,"slug":570,"text":571},"videokonferenzen-mit-nextcloud-talk","Videokonferenzen mit “Nextcloud Talk”",{"depth":49,"slug":573,"text":574},"automatischer-dateiimport-per-api","Automatischer Dateiimport per API",{"depth":45,"slug":62,"text":63},{"depth":45,"slug":133,"text":134},{"depth":49,"slug":578,"text":579},"problem-langsame-performance","Problem: Langsame Performance",{"depth":49,"slug":581,"text":582},"problem-dateien-erscheinen-nicht-im-sync","Problem: Dateien erscheinen nicht im Sync",{"depth":49,"slug":584,"text":585},"problem-fehlermeldung-trusted-domain-not-set","Problem: Fehlermeldung “Trusted domain not set”",{"depth":45,"slug":65,"text":66},[],[],[],"nextcloud.md"] \ No newline at end of file +[["Map",1,2,9,10],"meta::meta",["Map",3,4,5,6,7,8],"astro-version","5.12.8","content-config-digest","ee82e3c9179b889a","astro-config-digest","{\"root\":{},\"srcDir\":{},\"publicDir\":{},\"outDir\":{},\"cacheDir\":{},\"compressHTML\":true,\"base\":\"/\",\"trailingSlash\":\"ignore\",\"output\":\"server\",\"scopedStyleStrategy\":\"attribute\",\"build\":{\"format\":\"directory\",\"client\":{},\"server\":{},\"assets\":\"_astro\",\"serverEntry\":\"entry.mjs\",\"redirects\":true,\"inlineStylesheets\":\"auto\",\"concurrency\":1},\"server\":{\"open\":false,\"host\":true,\"port\":4321,\"streaming\":true,\"allowedHosts\":[]},\"redirects\":{},\"image\":{\"endpoint\":{\"route\":\"/_image\",\"entrypoint\":\"astro/assets/endpoint/node\"},\"service\":{\"entrypoint\":\"astro/assets/services/sharp\",\"config\":{}},\"domains\":[],\"remotePatterns\":[],\"responsiveStyles\":false},\"devToolbar\":{\"enabled\":true},\"markdown\":{\"syntaxHighlight\":{\"type\":\"shiki\",\"excludeLangs\":[\"math\"]},\"shikiConfig\":{\"langs\":[],\"langAlias\":{},\"theme\":\"github-dark\",\"themes\":{},\"wrap\":false,\"transformers\":[]},\"remarkPlugins\":[null],\"rehypePlugins\":[],\"remarkRehype\":{},\"gfm\":true,\"smartypants\":true},\"security\":{\"checkOrigin\":true},\"env\":{\"schema\":{},\"validateSecrets\":false},\"experimental\":{\"clientPrerender\":false,\"contentIntellisense\":false,\"headingIdCompat\":false,\"preserveScriptOrder\":false,\"liveContentCollections\":false,\"csp\":false,\"rawEnvValues\":false},\"legacy\":{\"collections\":false},\"session\":{\"driver\":\"fs-lite\",\"options\":{\"base\":\"/var/home/user01/Projekte/forensic-pathways/node_modules/.astro/sessions\"}}}","knowledgebase",["Map",11,12,176,177,343,344,490,491,676,677,846,847,1006,1007,1159,1160,1288,1289,1539,1540,1620,1621,1690,1691,1759,1760],"concept-digital-evidence-chain",{"id":11,"data":13,"body":36,"filePath":37,"digest":38,"rendered":39,"legacyId":175},{"title":14,"description":15,"last_updated":16,"related_tools":17,"author":18,"difficulty":19,"categories":20,"tags":25,"published":34,"gated_content":35},"Digital Evidence Chain of Custody: Lückenlose Beweisführung in der digitalen Forensik","Umfassender Leitfaden für die rechtssichere Dokumentation digitaler Beweise von der Sicherstellung bis zur Gerichtsverhandlung. Praktische Umsetzung von ISO 27037, Dokumentationsstandards und häufige Fallstricke.",["Date","2025-08-10T00:00:00.000Z"],[],"Claude 4 Sonnett (Prompt: Mario Stöckl)","advanced",[21,22,23,24],"standards","documentation","legal-compliance","case-management",[26,27,28,29,30,31,23,22,32,33],"chain-of-custody","iso-27037","court-admissible","audit-trail","hash-verification","tamper-evidence","process-management","evidence-handling",true,false,"# Digital Evidence Chain of Custody: Lückenlose Beweisführung in der digitalen Forensik\n\nDie **Chain of Custody** (Beweiskette) ist das Rückgrat jeder forensischen Untersuchung und entscheidet oft über Erfolg oder Misserfolg vor Gericht. Dieser Leitfaden erklärt die rechtssicheren Verfahren für die lückenlose Dokumentation digitaler Beweise von der Sicherstellung bis zur Gerichtsverhandlung.\n\n## Warum ist die Chain of Custody entscheidend?\n\nIn der digitalen Forensik können Beweise innerhalb von Sekunden manipuliert, gelöscht oder verfälscht werden. Eine ordnungsgemäße Chain of Custody gewährleistet:\n\n- **Gerichtliche Verwertbarkeit** der Beweise\n- **Nachweis der Authentizität** und Integrität\n- **Schutz vor Manipulationsvorwürfen**\n- **Rechtssicherheit** für alle Beteiligten\n- **Compliance** mit internationalen Standards\n\n> **Warnung**: Bereits kleine Fehler in der Beweiskette können zur kompletten Verwerfung der Beweise führen und jahrelange Ermittlungsarbeit zunichte machen.\n\n## Rechtliche Grundlagen und Standards\n\n### Internationale Standards\n\n**ISO/IEC 27037:2012** - \"Guidelines for identification, collection, acquisition and preservation of digital evidence\"\n- Definiert Best Practices für digitale Beweismittel\n- International anerkannter Standard\n- Basis für nationale Implementierungen\n\n**ISO/IEC 27041:2015** - \"Guidance on assuring suitability and adequacy of incident investigative method\"\n- Ergänzt ISO 27037 um Qualitätssicherung\n- Fokus auf Angemessenheit der Methoden\n\n### Nationale Rahmenwerke\n\n**Deutschland**:\n- § 81a StPO (Körperliche Untersuchung)\n- § 94 ff. StPO (Beschlagnahme)\n- BSI-Standards zur IT-Forensik\n\n**USA**:\n- Federal Rules of Evidence (Rule 901, 902)\n- NIST Special Publication 800-86\n\n**EU**:\n- GDPR-Compliance bei der Beweissicherung\n- eIDAS-Verordnung für digitale Signaturen\n\n## Die vier Säulen der Chain of Custody\n\n### 1. Authentizität (Echtheit)\n**Definition**: Nachweis, dass die Beweise tatsächlich von der behaupteten Quelle stammen.\n\n**Praktische Umsetzung**:\n```bash\n# Cryptographic Hash Generation\nsha256sum /dev/sdb1 > evidence_hash.txt\nmd5sum /dev/sdb1 >> evidence_hash.txt\n\n# Mit Zeitstempel\necho \"$(date -u +%Y-%m-%dT%H:%M:%SZ): $(sha256sum /dev/sdb1)\" >> chain_log.txt\n```\n\n### 2. Integrität (Unversehrtheit)\n**Definition**: Sicherstellung, dass die Beweise seit der Sicherstellung unverändert geblieben sind.\n\n**Maßnahmen**:\n- **Write-Blocker** bei allen Zugriffen\n- **Hash-Verifizierung** vor und nach jeder Bearbeitung\n- **Versionskontrolle** für alle Arbeitskopien\n\n### 3. Nachvollziehbarkeit (Traceability)\n**Definition**: Lückenlose Dokumentation aller Personen, die Zugang zu den Beweisen hatten.\n\n**Dokumentationspflicht**: Wer, Was, Wann, Wo, Warum\n\n### 4. Nicht-Abstreitbarkeit (Non-Repudiation)\n**Definition**: Verhinderung, dass Beteiligte ihre Handlungen später abstreiten können.\n\n**Technische Lösung**: Digitale Signaturen, Blockchain-Timestamping\n\n## Praktische Implementierung: Schritt-für-Schritt\n\n### Phase 1: Vorbereitung der Sicherstellung\n\n**Equipment-Check**:\n```checklist\n□ Kalibrierte Write-Blocker\n□ Forensische Imaging-Tools\n□ Chain of Custody Formulare\n□ Tamper-evident Bags/Labels\n□ Digitalkamera für Dokumentation\n□ Messgeräte (falls erforderlich)\n□ Backup-Ausrüstung\n```\n\n**Dokumentation vor Ort**:\n1. **Umgebungsfotografie** (360°-Dokumentation)\n2. **Hardware-Identifikation** (Seriennummern, Labels)\n3. **Netzwerkzustand** (aktive Verbindungen)\n4. **Bildschirmzustand** (Screenshots vor Herunterfahren)\n\n### Phase 2: Sichere Akquisition\n\n**Write-Blocker Setup**:\n```bash\n# Hardware Write-Blocker Verification\nlsblk -o NAME,SIZE,RO,TYPE,MOUNTPOINT\n# RO sollte \"1\" anzeigen für geschützte Devices\n\n# Software Write-Blocker (Linux)\nblockdev --setro /dev/sdb\nblockdev --getro /dev/sdb # Should return 1\n```\n\n**Imaging mit Integrity Check**:\n```bash\n# dd mit Hash-Berechnung\ndd if=/dev/sdb | tee >(sha256sum > image.sha256) | dd of=evidence.dd\n\n# Oder mit dcfldd für bessere Forensik-Features\ndcfldd if=/dev/sdb of=evidence.dd hash=sha256,md5 hashlog=hashlog.txt bs=4096\n```\n\n### Phase 3: Dokumentation und Versiegelung\n\n**Chain of Custody Form - Kernelemente**:\n\n```\nDIGITAL EVIDENCE CUSTODY FORM\n\nFall-ID: _______________ Datum: _______________\nErmittler: _______________ Badge/ID: _______________\n\nBEWEISMITTEL DETAILS:\n- Beschreibung: ________________________________\n- Seriennummer: _______________________________\n- Hersteller/Modell: ___________________________\n- Kapazität: __________________________________\n- Hash-Werte:\n * SHA256: ___________________________________\n * MD5: _____________________________________\n\nCUSTODY CHAIN:\n[Datum/Zeit] [Übernommen von] [Übergeben an] [Zweck] [Unterschrift]\n_________________________________________________________________\n_________________________________________________________________\n\nINTEGRITÄT BESTÄTIGT:\n□ Write-Blocker verwendet\n□ Hash-Werte verifiziert \n□ Tamper-evident versiegelt\n□ Fotos dokumentiert\n```\n\n**Versiegelung**:\n```\nTamper-Evident Label Nummer: ______________\nSiegeltyp: _______________________________\nPlatzierung: _____________________________\nFoto-Referenz: ___________________________\n```\n\n### Phase 4: Transport und Lagerung\n\n**Sichere Aufbewahrung**:\n- **Klimakontrollierte Umgebung** (15-25°C, \u003C60% Luftfeuchtigkeit)\n- **Elektromagnetische Abschirmung** (Faraday-Käfig)\n- **Zugangskontrolle** (Biometrie, Kartenleser)\n- **Überwachung** (24/7 Video, Alarme)\n\n**Transport-Protokoll**:\n```\nTRANSPORT LOG\n\nVon: ______________________ Nach: ______________________\nDatum/Zeit Start: _____________ Ankunft: _______________\nTransportmittel: ___________________________________\nBegleitpersonen: ___________________________________\nSpezielle Vorkehrungen: ____________________________\n\nIntegrität bei Ankunft:\n□ Siegel unversehrt\n□ Hash-Werte überprüft\n□ Keine physischen Schäden\n□ Dokumentation vollständig\n\nEmpfänger: _________________ Unterschrift: _____________\n```\n\n## Digitale Chain of Custody Tools\n\n### Laboratory Information Management Systems (LIMS)\n\n**Kommerzielle Lösungen**:\n- **FRED (Forensic Recovery of Evidence Device)**\n- **CaseGuard** von AccessData\n- **EnCase Legal** von OpenText\n\n**Open Source Alternativen**:\n```python\n# Beispiel: Python-basierte CoC Tracking\nimport hashlib\nimport datetime\nimport json\nfrom cryptography.fernet import Fernet\n\nclass ChainOfCustody:\n def __init__(self):\n self.evidence_log = []\n self.key = Fernet.generate_key()\n self.cipher = Fernet(self.key)\n \n def add_custody_event(self, evidence_id, handler, action, location):\n event = {\n 'timestamp': datetime.datetime.utcnow().isoformat(),\n 'evidence_id': evidence_id,\n 'handler': handler,\n 'action': action,\n 'location': location,\n 'hash': self.calculate_hash(evidence_id)\n }\n \n # Encrypt sensitive data\n encrypted_event = self.cipher.encrypt(json.dumps(event).encode())\n self.evidence_log.append(encrypted_event)\n \n return event\n \n def calculate_hash(self, evidence_path):\n \"\"\"Calculate SHA256 hash of evidence file\"\"\"\n hash_sha256 = hashlib.sha256()\n with open(evidence_path, \"rb\") as f:\n for chunk in iter(lambda: f.read(4096), b\"\"):\n hash_sha256.update(chunk)\n return hash_sha256.hexdigest()\n```\n\n### Blockchain-basierte Lösungen\n\n**Unveränderliche Timestamps**:\n```solidity\n// Ethereum Smart Contract Beispiel\npragma solidity ^0.8.0;\n\ncontract EvidenceChain {\n struct CustodyEvent {\n uint256 timestamp;\n string evidenceId;\n string handler;\n string action;\n string hashValue;\n }\n \n mapping(string => CustodyEvent[]) public evidenceChain;\n \n event CustodyTransfer(\n string indexed evidenceId,\n string handler,\n uint256 timestamp\n );\n \n function addCustodyEvent(\n string memory _evidenceId,\n string memory _handler,\n string memory _action,\n string memory _hashValue\n ) public {\n evidenceChain[_evidenceId].push(CustodyEvent({\n timestamp: block.timestamp,\n evidenceId: _evidenceId,\n handler: _handler,\n action: _action,\n hashValue: _hashValue\n }));\n \n emit CustodyTransfer(_evidenceId, _handler, block.timestamp);\n }\n}\n```\n\n## Häufige Fehler und Fallstricke\n\n### Kritische Dokumentationsfehler\n\n**1. Unvollständige Handler-Information**\n```\n❌ Falsch: \"IT-Abteilung\"\n✅ Richtig: \"Max Mustermann, IT-Administrator, Badge #12345, Abteilung IT-Security\"\n```\n\n**2. Unspezifische Aktionsbeschreibungen**\n```\n❌ Falsch: \"Analyse durchgeführt\"\n✅ Richtig: \"Keyword-Suche nach 'vertraulich' mit EnCase v21.2, \n Read-Only Zugriff, Image Hash vor/nach verifiziert\"\n```\n\n**3. Lückenhafte Zeiterfassung**\n```\n❌ Falsch: \"15:30\"\n✅ Richtig: \"2024-01-15T15:30:27Z (UTC), Zeitzone CET+1\"\n```\n\n### Technische Fallstricke\n\n**Hash-Algorithmus Schwächen**:\n```bash\n# Vermeide MD5 für neue Fälle (Kollisionsanfällig)\n❌ md5sum evidence.dd\n\n# Verwende stärkere Algorithmen\n✅ sha256sum evidence.dd\n✅ sha3-256sum evidence.dd # Noch sicherer\n```\n\n**Write-Blocker Bypass**:\n```bash\n# Prüfe IMMER Write-Protection\nblockdev --getro /dev/sdb\nif [ $? -eq 0 ]; then\n echo \"Write protection AKTIV\"\nelse\n echo \"WARNUNG: Write protection NICHT aktiv!\"\n exit 1\nfi\n```\n\n### Rechtliche Fallstricke\n\n**GDPR-Compliance bei EU-Fällen**:\n- **Datenschutz-Folgenabschätzung** vor Imaging\n- **Zweckbindung** der Beweiserhebung\n- **Löschfristen** nach Verfahrensabschluss\n\n**Jurisdiktionsprobleme**:\n- **Cloud-Evidence** in verschiedenen Ländern\n- **Verschiedene Beweisstandards** (Common Law vs. Civil Law)\n- **Internationale Rechtshilfe** erforderlich\n\n## Qualitätssicherung und Audit\n\n### Peer Review Verfahren\n\n**4-Augen-Prinzip**:\n```\nImaging-Protokoll:\nTechniker A: _________________ (Durchführung)\nTechniker B: _________________ (Verifikation)\nSupervisor: __________________ (Freigabe)\n```\n\n**Hash-Verifikation Zeitplan**:\n```\nInitial: SHA256 bei Akquisition\nTransport: Hash-Check vor/nach Transport \nLabor: Hash-Check bei Laborankunft\nAnalyse: Hash-Check vor jeder Analyse\nArchiv: Hash-Check bei Archivierung\nVernichtung: Final Hash-Check vor Vernichtung\n```\n\n### Continuous Monitoring\n\n**Automated Integrity Checks**:\n```bash\n#!/bin/bash\n# integrity_monitor.sh\n\nEVIDENCE_DIR=\"/secure/evidence\"\nLOG_FILE=\"/var/log/evidence_integrity.log\"\n\nfor evidence_file in \"$EVIDENCE_DIR\"/*.dd; do\n stored_hash=$(cat \"${evidence_file}.sha256\")\n current_hash=$(sha256sum \"$evidence_file\" | cut -d' ' -f1)\n \n if [ \"$stored_hash\" != \"$current_hash\" ]; then\n echo \"ALERT: Integrity violation detected for $evidence_file\" | \\\n tee -a \"$LOG_FILE\"\n # Send immediate alert\n mail -s \"Evidence Integrity Alert\" admin@forensics.org \u003C \\\n \"$LOG_FILE\"\n fi\ndone\n```\n\n## Internationale Gerichtspraxis\n\n### Deutschland - BGH Rechtsprechung\n\n**BGH 1 StR 142/18** (2018):\n- Digitale Beweise müssen **nachvollziehbar erhoben** werden\n- **Hash-Werte allein** reichen nicht aus\n- **Gesamter Erhebungsprozess** muss dokumentiert sein\n\n### USA - Federal Courts\n\n**United States v. Tank (2018)**:\n- **Authentication** unter Federal Rule 901(b)(9)\n- **Best Practices** sind nicht immer **rechtlich erforderlich**\n- **Totality of circumstances** entscheidet\n\n### EU - EuGH Rechtsprechung\n\n**Rechtssache C-203/15** (2016):\n- **Grundrechte** vs. **Strafverfolgung**\n- **Verhältnismäßigkeit** der Beweiserhebung\n- **GDPR-Compliance** auch bei strafrechtlichen Ermittlungen\n\n## Fallstudien aus der Praxis\n\n### Case Study 1: Ransomware-Angriff Automobilhersteller\n\n**Szenario**: \nRansomware-Angriff auf Produktionssysteme, 50+ Systeme betroffen\n\n**CoC-Herausforderungen**:\n- **Zeitdruck** durch Produktionsstillstand\n- **Verschiedene Standorte** (Deutschland, Tschechien, Mexiko)\n- **Rechtliche Anforderungen** in 3 Jurisdiktionen\n\n**Lösung**:\n```\nParallel Teams:\n- Team 1: Incident Response (Live-Analyse)\n- Team 2: Evidence Preservation (Imaging)\n- Team 3: Documentation (CoC-Protokoll)\n\nZentrale Koordination:\n- Shared CoC-Database (Cloud-basiert)\n- Video-Calls für Custody-Transfers\n- Digital Signatures für Remote-Bestätigung\n```\n\n**Lessons Learned**:\n- **Vorab-Planung** für Multi-Jurisdiktion essentiell\n- **Remote-CoC-Verfahren** erforderlich\n- **24/7-Verfügbarkeit** der Dokumentationssysteme\n\n### Case Study 2: Betrugsermittlung Finanzdienstleister\n\n**Szenario**:\nVerdacht auf Insiderhandel, E-Mail-Analyse von 500+ Mitarbeitern\n\n**CoC-Komplexität**:\n- **Privacy Laws** (GDPR, Bankengeheimnis)\n- **Privileged Communications** (Anwalt-Mandant)\n- **Regulatory Oversight** (BaFin, SEC)\n\n**Chain of Custody Strategie**:\n```\nSegregated Processing:\n1. Initial Triage (Automated)\n2. Legal Review (Attorney-Client Privilege)\n3. Regulatory Notification (Compliance)\n4. Technical Analysis (Forensik-Team)\n\nAccess Controls:\n- Role-based Evidence Access\n- Need-to-know Principle\n- Audit Log for every Access\n```\n\n## Technologie-Trends und Zukunftsausblick\n\n### KI-basierte CoC-Automatisierung\n\n**Machine Learning für Anomalie-Erkennung**:\n```python\nfrom sklearn.ensemble import IsolationForest\nimport pandas as pd\n\n# CoC Event Anomaly Detection\ndef detect_custody_anomalies(custody_events):\n \"\"\"\n Detect unusual patterns in custody transfers\n \"\"\"\n features = pd.DataFrame(custody_events)\n \n # Feature Engineering\n features['time_delta'] = features['timestamp'].diff()\n features['handler_changes'] = features['handler'].ne(features['handler'].shift())\n \n # Anomaly Detection\n model = IsolationForest(contamination=0.1)\n anomalies = model.fit_predict(features.select_dtypes(include=[np.number]))\n \n return features[anomalies == -1]\n```\n\n### Quantum-Safe Cryptography\n\n**Vorbereitung auf Post-Quantum Era**:\n```\nCurrent: RSA-2048, SHA-256\nTransitional: RSA-4096, SHA-3\nFuture: Lattice-based, Hash-based Signatures\n```\n\n### Cloud-Native Evidence Management\n\n**Container-basierte Forensik-Pipelines**:\n```yaml\n# docker-compose.yml für Forensik-Lab\nversion: '3.8'\nservices:\n evidence-intake:\n image: forensics/evidence-intake:v2.1\n volumes:\n - ./evidence:/data\n environment:\n - AUTO_HASH=true\n - BLOCKCHAIN_LOGGING=true\n \n chain-tracker:\n image: forensics/chain-tracker:v1.5\n depends_on:\n - postgres\n environment:\n - DATABASE_URL=postgresql://user:pass@postgres:5432/custody\n```\n\n## Best Practices Zusammenfassung\n\n### Präventive Maßnahmen\n\n**1. Standardisierte Verfahren**\n```\n□ SOPs für alle Custody-Schritte\n□ Regelmäßige Team-Schulungen \n□ Tool-Kalibrierung und -Wartung\n□ Backup-Verfahren für Ausfälle\n```\n\n**2. Technische Safeguards**\n```\n□ Redundante Hash-Algorithmen\n□ Automated Integrity Monitoring\n□ Secure Transport Protocols\n□ Environmental Monitoring\n```\n\n**3. Rechtliche Compliance**\n```\n□ Jurisdiction-spezifische SOPs\n□ Regular Legal Updates\n□ Attorney Consultation Process\n□ International Cooperation Agreements\n```\n\n### Reaktive Maßnahmen\n\n**Incident Response bei CoC-Verletzungen**:\n```\n1. Immediate Containment\n - Stop all evidence processing\n - Secure affected items\n - Document incident details\n\n2. Impact Assessment \n - Determine scope of compromise\n - Identify affected cases\n - Assess legal implications\n\n3. Remediation\n - Re-establish chain where possible\n - Alternative evidence strategies\n - Legal notification requirements\n\n4. Prevention\n - Root cause analysis\n - Process improvements\n - Additional controls\n```\n\n## Fazit\n\nDie Chain of Custody ist mehr als eine administrative Pflicht - sie ist das **Fundament der digitalen Forensik**. Ohne ordnungsgemäße Beweiskette können selbst die stärksten technischen Beweise vor Gericht wertlos werden.\n\n**Schlüsselprinzipien für den Erfolg**:\n\n1. **Vorbereitung ist alles** - SOPs und Tools vor dem Incident\n2. **Dokumentation über alles** - Im Zweifel mehr dokumentieren\n3. **Technologie als Enabler** - Automatisierung wo möglich\n4. **Menschen im Fokus** - Training und Awareness entscheidend\n5. **Kontinuierliche Verbesserung** - Lessons Learned Integration\n\nDie Investition in robuste Chain of Custody Verfahren zahlt sich langfristig aus - durch höhere Erfolgsraten vor Gericht, reduzierte Compliance-Risiken und erhöhte Glaubwürdigkeit der forensischen Arbeit.\n\n> **Merksatz**: \"Eine Kette ist nur so stark wie ihr schwächstes Glied - in der digitalen Forensik ist das oft die menschliche Komponente, nicht die technische.\"\n\n## Weiterführende Ressourcen\n\n**Standards und Guidelines**:\n- [ISO/IEC 27037:2012](https://www.iso.org/standard/44381.html) - Digital Evidence Guidelines\n- [NIST SP 800-86](https://csrc.nist.gov/publications/detail/sp/800-86/final) - Computer Forensics Guide\n- [RFC 3227](https://tools.ietf.org/html/rfc3227) - Evidence Collection Guidelines\n\n**Training und Zertifizierung**:\n- SANS FOR500 (Windows Forensic Analysis)\n- SANS FOR508 (Advanced Incident Response)\n- IACIS Certified Forensic Computer Examiner (CFCE)\n- CISSP (Chain of Custody Domain)\n\n**Tools und Software**:\n- [FTK Imager](https://www.exterro.com/digital-forensics-software/ftk-imager) - Free Imaging Tool\n- [Autopsy](https://www.sleuthkit.org/autopsy/) - Open Source Platform\n- [MSAB XRY](https://www.msab.com/) - Mobile Forensics\n- [Cellebrite UFED](https://www.cellebrite.com/) - Mobile Evidence Extraction","src/content/knowledgebase/concept-digital-evidence-chain.md","3f9bf9b1bbdbd514",{"html":40,"metadata":41},"\u003Ch1 id=\"digital-evidence-chain-of-custody-lückenlose-beweisführung-in-der-digitalen-forensik\">Digital Evidence Chain of Custody: Lückenlose Beweisführung in der digitalen Forensik\u003C/h1>\n\u003Cp>Die \u003Cstrong>Chain of Custody\u003C/strong> (Beweiskette) ist das Rückgrat jeder forensischen Untersuchung und entscheidet oft über Erfolg oder Misserfolg vor Gericht. Dieser Leitfaden erklärt die rechtssicheren Verfahren für die lückenlose Dokumentation digitaler Beweise von der Sicherstellung bis zur Gerichtsverhandlung.\u003C/p>\n\u003Ch2 id=\"warum-ist-die-chain-of-custody-entscheidend\">Warum ist die Chain of Custody entscheidend?\u003C/h2>\n\u003Cp>In der digitalen Forensik können Beweise innerhalb von Sekunden manipuliert, gelöscht oder verfälscht werden. Eine ordnungsgemäße Chain of Custody gewährleistet:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Gerichtliche Verwertbarkeit\u003C/strong> der Beweise\u003C/li>\n\u003Cli>\u003Cstrong>Nachweis der Authentizität\u003C/strong> und Integrität\u003C/li>\n\u003Cli>\u003Cstrong>Schutz vor Manipulationsvorwürfen\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>Rechtssicherheit\u003C/strong> für alle Beteiligten\u003C/li>\n\u003Cli>\u003Cstrong>Compliance\u003C/strong> mit internationalen Standards\u003C/li>\n\u003C/ul>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Warnung\u003C/strong>: Bereits kleine Fehler in der Beweiskette können zur kompletten Verwerfung der Beweise führen und jahrelange Ermittlungsarbeit zunichte machen.\u003C/p>\n\u003C/blockquote>\n\u003Ch2 id=\"rechtliche-grundlagen-und-standards\">Rechtliche Grundlagen und Standards\u003C/h2>\n\u003Ch3 id=\"internationale-standards\">Internationale Standards\u003C/h3>\n\u003Cp>\u003Cstrong>ISO/IEC 27037:2012\u003C/strong> - “Guidelines for identification, collection, acquisition and preservation of digital evidence”\u003C/p>\n\u003Cul>\n\u003Cli>Definiert Best Practices für digitale Beweismittel\u003C/li>\n\u003Cli>International anerkannter Standard\u003C/li>\n\u003Cli>Basis für nationale Implementierungen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>ISO/IEC 27041:2015\u003C/strong> - “Guidance on assuring suitability and adequacy of incident investigative method”\u003C/p>\n\u003Cul>\n\u003Cli>Ergänzt ISO 27037 um Qualitätssicherung\u003C/li>\n\u003Cli>Fokus auf Angemessenheit der Methoden\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"nationale-rahmenwerke\">Nationale Rahmenwerke\u003C/h3>\n\u003Cp>\u003Cstrong>Deutschland\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>§ 81a StPO (Körperliche Untersuchung)\u003C/li>\n\u003Cli>§ 94 ff. StPO (Beschlagnahme)\u003C/li>\n\u003Cli>BSI-Standards zur IT-Forensik\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>USA\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>Federal Rules of Evidence (Rule 901, 902)\u003C/li>\n\u003Cli>NIST Special Publication 800-86\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>EU\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>GDPR-Compliance bei der Beweissicherung\u003C/li>\n\u003Cli>eIDAS-Verordnung für digitale Signaturen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"die-vier-säulen-der-chain-of-custody\">Die vier Säulen der Chain of Custody\u003C/h2>\n\u003Ch3 id=\"1-authentizität-echtheit\">1. Authentizität (Echtheit)\u003C/h3>\n\u003Cp>\u003Cstrong>Definition\u003C/strong>: Nachweis, dass die Beweise tatsächlich von der behaupteten Quelle stammen.\u003C/p>\n\u003Cp>\u003Cstrong>Praktische Umsetzung\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Cryptographic Hash Generation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb1\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence_hash.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb1\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence_hash.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit Zeitstempel\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"$(\u003C/span>\u003Cspan style=\"color:#B392F0\">date\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> +%Y-%m-%dT%H:%M:%SZ): $(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb1)\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> chain_log.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"2-integrität-unversehrtheit\">2. Integrität (Unversehrtheit)\u003C/h3>\n\u003Cp>\u003Cstrong>Definition\u003C/strong>: Sicherstellung, dass die Beweise seit der Sicherstellung unverändert geblieben sind.\u003C/p>\n\u003Cp>\u003Cstrong>Maßnahmen\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Write-Blocker\u003C/strong> bei allen Zugriffen\u003C/li>\n\u003Cli>\u003Cstrong>Hash-Verifizierung\u003C/strong> vor und nach jeder Bearbeitung\u003C/li>\n\u003Cli>\u003Cstrong>Versionskontrolle\u003C/strong> für alle Arbeitskopien\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"3-nachvollziehbarkeit-traceability\">3. Nachvollziehbarkeit (Traceability)\u003C/h3>\n\u003Cp>\u003Cstrong>Definition\u003C/strong>: Lückenlose Dokumentation aller Personen, die Zugang zu den Beweisen hatten.\u003C/p>\n\u003Cp>\u003Cstrong>Dokumentationspflicht\u003C/strong>: Wer, Was, Wann, Wo, Warum\u003C/p>\n\u003Ch3 id=\"4-nicht-abstreitbarkeit-non-repudiation\">4. Nicht-Abstreitbarkeit (Non-Repudiation)\u003C/h3>\n\u003Cp>\u003Cstrong>Definition\u003C/strong>: Verhinderung, dass Beteiligte ihre Handlungen später abstreiten können.\u003C/p>\n\u003Cp>\u003Cstrong>Technische Lösung\u003C/strong>: Digitale Signaturen, Blockchain-Timestamping\u003C/p>\n\u003Ch2 id=\"praktische-implementierung-schritt-für-schritt\">Praktische Implementierung: Schritt-für-Schritt\u003C/h2>\n\u003Ch3 id=\"phase-1-vorbereitung-der-sicherstellung\">Phase 1: Vorbereitung der Sicherstellung\u003C/h3>\n\u003Cp>\u003Cstrong>Equipment-Check\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>□ Kalibrierte Write-Blocker\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Forensische Imaging-Tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Chain of Custody Formulare\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Tamper-evident Bags/Labels\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Digitalkamera für Dokumentation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Messgeräte (falls erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Backup-Ausrüstung\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Dokumentation vor Ort\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Umgebungsfotografie\u003C/strong> (360°-Dokumentation)\u003C/li>\n\u003Cli>\u003Cstrong>Hardware-Identifikation\u003C/strong> (Seriennummern, Labels)\u003C/li>\n\u003Cli>\u003Cstrong>Netzwerkzustand\u003C/strong> (aktive Verbindungen)\u003C/li>\n\u003Cli>\u003Cstrong>Bildschirmzustand\u003C/strong> (Screenshots vor Herunterfahren)\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"phase-2-sichere-akquisition\">Phase 2: Sichere Akquisition\u003C/h3>\n\u003Cp>\u003Cstrong>Write-Blocker Setup\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hardware Write-Blocker Verification\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">lsblk\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> NAME,SIZE,RO,TYPE,MOUNTPOINT\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># RO sollte \"1\" anzeigen für geschützte Devices\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Software Write-Blocker (Linux)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">blockdev\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --setro\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">blockdev\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --getro\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Should return 1\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Imaging mit Integrity Check\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># dd mit Hash-Berechnung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/sdb\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> tee\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> >(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> image.sha256)\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder mit dcfldd für bessere Forensik-Features\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">dcfldd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/sdb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=evidence.dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hash=sha256,md5\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hashlog=hashlog.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> bs=\u003C/span>\u003Cspan style=\"color:#79B8FF\">4096\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"phase-3-dokumentation-und-versiegelung\">Phase 3: Dokumentation und Versiegelung\u003C/h3>\n\u003Cp>\u003Cstrong>Chain of Custody Form - Kernelemente\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>DIGITAL EVIDENCE CUSTODY FORM\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Fall-ID: _______________ Datum: _______________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Ermittler: _______________ Badge/ID: _______________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>BEWEISMITTEL DETAILS:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Beschreibung: ________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Seriennummer: _______________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Hersteller/Modell: ___________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Kapazität: __________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Hash-Werte:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> * SHA256: ___________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> * MD5: _____________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>CUSTODY CHAIN:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>[Datum/Zeit] [Übernommen von] [Übergeben an] [Zweck] [Unterschrift]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>_________________________________________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>_________________________________________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>INTEGRITÄT BESTÄTIGT:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Write-Blocker verwendet\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Hash-Werte verifiziert \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Tamper-evident versiegelt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Fotos dokumentiert\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Versiegelung\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Tamper-Evident Label Nummer: ______________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Siegeltyp: _______________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Platzierung: _____________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Foto-Referenz: ___________________________\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"phase-4-transport-und-lagerung\">Phase 4: Transport und Lagerung\u003C/h3>\n\u003Cp>\u003Cstrong>Sichere Aufbewahrung\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Klimakontrollierte Umgebung\u003C/strong> (15-25°C, <60% Luftfeuchtigkeit)\u003C/li>\n\u003Cli>\u003Cstrong>Elektromagnetische Abschirmung\u003C/strong> (Faraday-Käfig)\u003C/li>\n\u003Cli>\u003Cstrong>Zugangskontrolle\u003C/strong> (Biometrie, Kartenleser)\u003C/li>\n\u003Cli>\u003Cstrong>Überwachung\u003C/strong> (24/7 Video, Alarme)\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Transport-Protokoll\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>TRANSPORT LOG\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Von: ______________________ Nach: ______________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Datum/Zeit Start: _____________ Ankunft: _______________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Transportmittel: ___________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Begleitpersonen: ___________________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Spezielle Vorkehrungen: ____________________________\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Integrität bei Ankunft:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Siegel unversehrt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Hash-Werte überprüft\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Keine physischen Schäden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Dokumentation vollständig\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Empfänger: _________________ Unterschrift: _____________\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"digitale-chain-of-custody-tools\">Digitale Chain of Custody Tools\u003C/h2>\n\u003Ch3 id=\"laboratory-information-management-systems-lims\">Laboratory Information Management Systems (LIMS)\u003C/h3>\n\u003Cp>\u003Cstrong>Kommerzielle Lösungen\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>FRED (Forensic Recovery of Evidence Device)\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>CaseGuard\u003C/strong> von AccessData\u003C/li>\n\u003Cli>\u003Cstrong>EnCase Legal\u003C/strong> von OpenText\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Open Source Alternativen\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Beispiel: Python-basierte CoC Tracking\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> datetime\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> json\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> cryptography.fernet \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Fernet\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> ChainOfCustody\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#79B8FF\"> __init__\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.evidence_log \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.key \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Fernet.generate_key()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.cipher \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Fernet(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.key)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> add_custody_event\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, evidence_id, handler, action, location):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: datetime.datetime.utcnow().isoformat(),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'evidence_id'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: evidence_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'handler'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: handler,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'action'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: action,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'location'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: location,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'hash'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.calculate_hash(evidence_id)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Encrypt sensitive data\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> encrypted_event \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.cipher.encrypt(json.dumps(event).encode())\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.evidence_log.append(encrypted_event)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> event\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> calculate_hash\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, evidence_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Calculate SHA256 hash of evidence file\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hash_sha256 \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib.sha256()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(evidence_path, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"rb\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> chunk \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> iter\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">lambda\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: f.read(\u003C/span>\u003Cspan style=\"color:#79B8FF\">4096\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#F97583\">b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hash_sha256.update(chunk)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hash_sha256.hexdigest()\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"blockchain-basierte-lösungen\">Blockchain-basierte Lösungen\u003C/h3>\n\u003Cp>\u003Cstrong>Unveränderliche Timestamps\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"solidity\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">// Ethereum Smart Contract Beispiel\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">pragma\u003C/span>\u003Cspan style=\"color:#85E89D\"> solidity\u003C/span>\u003Cspan style=\"color:#79B8FF\"> ^0.8.0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">contract\u003C/span>\u003Cspan style=\"color:#B392F0\"> EvidenceChain\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> struct\u003C/span>\u003Cspan style=\"color:#B392F0\"> CustodyEvent\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> uint256\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timestamp;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> evidenceId;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> handler;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> action;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashValue;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> mapping\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">string\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> CustodyEvent[]) \u003C/span>\u003Cspan style=\"color:#F97583\">public\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> evidenceChain;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> event\u003C/span>\u003Cspan style=\"color:#B392F0\"> CustodyTransfer\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#F97583\"> indexed\u003C/span>\u003Cspan style=\"color:#FFAB70\"> evidenceId\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#FFAB70\"> handler\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> uint256\u003C/span>\u003Cspan style=\"color:#FFAB70\"> timestamp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> );\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> function\u003C/span>\u003Cspan style=\"color:#B392F0\"> addCustodyEvent\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#F97583\"> memory\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _evidenceId,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#F97583\"> memory\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _handler,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#F97583\"> memory\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _action,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> string\u003C/span>\u003Cspan style=\"color:#F97583\"> memory\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _hashValue\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ) \u003C/span>\u003Cspan style=\"color:#F97583\">public\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> evidenceChain[_evidenceId].\u003C/span>\u003Cspan style=\"color:#B392F0\">push\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#B392F0\">CustodyEvent\u003C/span>\u003Cspan style=\"color:#E1E4E8\">({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\"> block\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.timestamp,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> evidenceId\u003C/span>\u003Cspan style=\"color:#F97583\">:\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _evidenceId,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> handler\u003C/span>\u003Cspan style=\"color:#F97583\">:\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _handler,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> action\u003C/span>\u003Cspan style=\"color:#F97583\">:\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _action,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hashValue\u003C/span>\u003Cspan style=\"color:#F97583\">:\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _hashValue\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }));\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> emit\u003C/span>\u003Cspan style=\"color:#B392F0\"> CustodyTransfer\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(_evidenceId, _handler, \u003C/span>\u003Cspan style=\"color:#79B8FF\">block\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.timestamp);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-fehler-und-fallstricke\">Häufige Fehler und Fallstricke\u003C/h2>\n\u003Ch3 id=\"kritische-dokumentationsfehler\">Kritische Dokumentationsfehler\u003C/h3>\n\u003Cp>\u003Cstrong>1. Unvollständige Handler-Information\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>❌ Falsch: \"IT-Abteilung\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>✅ Richtig: \"Max Mustermann, IT-Administrator, Badge #12345, Abteilung IT-Security\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>2. Unspezifische Aktionsbeschreibungen\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>❌ Falsch: \"Analyse durchgeführt\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>✅ Richtig: \"Keyword-Suche nach 'vertraulich' mit EnCase v21.2, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> Read-Only Zugriff, Image Hash vor/nach verifiziert\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>3. Lückenhafte Zeiterfassung\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>❌ Falsch: \"15:30\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>✅ Richtig: \"2024-01-15T15:30:27Z (UTC), Zeitzone CET+1\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"technische-fallstricke\">Technische Fallstricke\u003C/h3>\n\u003Cp>\u003Cstrong>Hash-Algorithmus Schwächen\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vermeide MD5 für neue Fälle (Kollisionsanfällig)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">❌\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verwende stärkere Algorithmen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">✅\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">✅\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sha3-256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Noch sicherer\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Write-Blocker Bypass\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Prüfe IMMER Write-Protection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">blockdev\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --getro\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [ \u003C/span>\u003Cspan style=\"color:#79B8FF\">$?\u003C/span>\u003Cspan style=\"color:#F97583\"> -eq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ]; \u003C/span>\u003Cspan style=\"color:#F97583\">then\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Write protection AKTIV\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">else\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"WARNUNG: Write protection NICHT aktiv!\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> exit\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">fi\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"rechtliche-fallstricke\">Rechtliche Fallstricke\u003C/h3>\n\u003Cp>\u003Cstrong>GDPR-Compliance bei EU-Fällen\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Datenschutz-Folgenabschätzung\u003C/strong> vor Imaging\u003C/li>\n\u003Cli>\u003Cstrong>Zweckbindung\u003C/strong> der Beweiserhebung\u003C/li>\n\u003Cli>\u003Cstrong>Löschfristen\u003C/strong> nach Verfahrensabschluss\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Jurisdiktionsprobleme\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Cloud-Evidence\u003C/strong> in verschiedenen Ländern\u003C/li>\n\u003Cli>\u003Cstrong>Verschiedene Beweisstandards\u003C/strong> (Common Law vs. Civil Law)\u003C/li>\n\u003Cli>\u003Cstrong>Internationale Rechtshilfe\u003C/strong> erforderlich\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"qualitätssicherung-und-audit\">Qualitätssicherung und Audit\u003C/h2>\n\u003Ch3 id=\"peer-review-verfahren\">Peer Review Verfahren\u003C/h3>\n\u003Cp>\u003Cstrong>4-Augen-Prinzip\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Imaging-Protokoll:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Techniker A: _________________ (Durchführung)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Techniker B: _________________ (Verifikation)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Supervisor: __________________ (Freigabe)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Hash-Verifikation Zeitplan\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Initial: SHA256 bei Akquisition\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Transport: Hash-Check vor/nach Transport \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Labor: Hash-Check bei Laborankunft\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Analyse: Hash-Check vor jeder Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Archiv: Hash-Check bei Archivierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Vernichtung: Final Hash-Check vor Vernichtung\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"continuous-monitoring\">Continuous Monitoring\u003C/h3>\n\u003Cp>\u003Cstrong>Automated Integrity Checks\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/bin/bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># integrity_monitor.sh\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">EVIDENCE_DIR\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/secure/evidence\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">LOG_FILE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/var/log/evidence_integrity.log\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> evidence_file \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$EVIDENCE_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/*.dd\u003C/span>\u003Cspan style=\"color:#E1E4E8\">; \u003C/span>\u003Cspan style=\"color:#F97583\">do\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> stored_hash\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">cat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"${\u003C/span>\u003Cspan style=\"color:#E1E4E8\">evidence_file\u003C/span>\u003Cspan style=\"color:#9ECBFF\">}.sha256\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> current_hash\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$evidence_file\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [ \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$stored_hash\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> !=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$current_hash\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ]; \u003C/span>\u003Cspan style=\"color:#F97583\">then\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ALERT: Integrity violation detected for \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$evidence_file\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> tee\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -a\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$LOG_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Send immediate alert\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> mail\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -s\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Evidence Integrity Alert\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> admin@forensics.org\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$LOG_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> fi\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">done\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"internationale-gerichtspraxis\">Internationale Gerichtspraxis\u003C/h2>\n\u003Ch3 id=\"deutschland---bgh-rechtsprechung\">Deutschland - BGH Rechtsprechung\u003C/h3>\n\u003Cp>\u003Cstrong>BGH 1 StR 142/18\u003C/strong> (2018):\u003C/p>\n\u003Cul>\n\u003Cli>Digitale Beweise müssen \u003Cstrong>nachvollziehbar erhoben\u003C/strong> werden\u003C/li>\n\u003Cli>\u003Cstrong>Hash-Werte allein\u003C/strong> reichen nicht aus\u003C/li>\n\u003Cli>\u003Cstrong>Gesamter Erhebungsprozess\u003C/strong> muss dokumentiert sein\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"usa---federal-courts\">USA - Federal Courts\u003C/h3>\n\u003Cp>\u003Cstrong>United States v. Tank (2018)\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Authentication\u003C/strong> unter Federal Rule 901(b)(9)\u003C/li>\n\u003Cli>\u003Cstrong>Best Practices\u003C/strong> sind nicht immer \u003Cstrong>rechtlich erforderlich\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>Totality of circumstances\u003C/strong> entscheidet\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"eu---eugh-rechtsprechung\">EU - EuGH Rechtsprechung\u003C/h3>\n\u003Cp>\u003Cstrong>Rechtssache C-203/15\u003C/strong> (2016):\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Grundrechte\u003C/strong> vs. \u003Cstrong>Strafverfolgung\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>Verhältnismäßigkeit\u003C/strong> der Beweiserhebung\u003C/li>\n\u003Cli>\u003Cstrong>GDPR-Compliance\u003C/strong> auch bei strafrechtlichen Ermittlungen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"fallstudien-aus-der-praxis\">Fallstudien aus der Praxis\u003C/h2>\n\u003Ch3 id=\"case-study-1-ransomware-angriff-automobilhersteller\">Case Study 1: Ransomware-Angriff Automobilhersteller\u003C/h3>\n\u003Cp>\u003Cstrong>Szenario\u003C/strong>:\nRansomware-Angriff auf Produktionssysteme, 50+ Systeme betroffen\u003C/p>\n\u003Cp>\u003Cstrong>CoC-Herausforderungen\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Zeitdruck\u003C/strong> durch Produktionsstillstand\u003C/li>\n\u003Cli>\u003Cstrong>Verschiedene Standorte\u003C/strong> (Deutschland, Tschechien, Mexiko)\u003C/li>\n\u003Cli>\u003Cstrong>Rechtliche Anforderungen\u003C/strong> in 3 Jurisdiktionen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Lösung\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Parallel Teams:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Team 1: Incident Response (Live-Analyse)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Team 2: Evidence Preservation (Imaging)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Team 3: Documentation (CoC-Protokoll)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Zentrale Koordination:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Shared CoC-Database (Cloud-basiert)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Video-Calls für Custody-Transfers\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Digital Signatures für Remote-Bestätigung\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Lessons Learned\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Vorab-Planung\u003C/strong> für Multi-Jurisdiktion essentiell\u003C/li>\n\u003Cli>\u003Cstrong>Remote-CoC-Verfahren\u003C/strong> erforderlich\u003C/li>\n\u003Cli>\u003Cstrong>24/7-Verfügbarkeit\u003C/strong> der Dokumentationssysteme\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"case-study-2-betrugsermittlung-finanzdienstleister\">Case Study 2: Betrugsermittlung Finanzdienstleister\u003C/h3>\n\u003Cp>\u003Cstrong>Szenario\u003C/strong>:\nVerdacht auf Insiderhandel, E-Mail-Analyse von 500+ Mitarbeitern\u003C/p>\n\u003Cp>\u003Cstrong>CoC-Komplexität\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Privacy Laws\u003C/strong> (GDPR, Bankengeheimnis)\u003C/li>\n\u003Cli>\u003Cstrong>Privileged Communications\u003C/strong> (Anwalt-Mandant)\u003C/li>\n\u003Cli>\u003Cstrong>Regulatory Oversight\u003C/strong> (BaFin, SEC)\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Chain of Custody Strategie\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Segregated Processing:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>1. Initial Triage (Automated)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>2. Legal Review (Attorney-Client Privilege)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>3. Regulatory Notification (Compliance)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>4. Technical Analysis (Forensik-Team)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Access Controls:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Role-based Evidence Access\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Need-to-know Principle\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Audit Log for every Access\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"technologie-trends-und-zukunftsausblick\">Technologie-Trends und Zukunftsausblick\u003C/h2>\n\u003Ch3 id=\"ki-basierte-coc-automatisierung\">KI-basierte CoC-Automatisierung\u003C/h3>\n\u003Cp>\u003Cstrong>Machine Learning für Anomalie-Erkennung\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sklearn.ensemble \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> IsolationForest\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pandas \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># CoC Event Anomaly Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_custody_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(custody_events):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Detect unusual patterns in custody transfers\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> features \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.DataFrame(custody_events)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Feature Engineering\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> features[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'time_delta'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> features[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].diff()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> features[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'handler_changes'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> features[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'handler'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].ne(features[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'handler'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].shift())\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Anomaly Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> model \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> IsolationForest(\u003C/span>\u003Cspan style=\"color:#FFAB70\">contamination\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">0.1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalies \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> model.fit_predict(features.select_dtypes(\u003C/span>\u003Cspan style=\"color:#FFAB70\">include\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">[np.number]))\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> features[anomalies \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"quantum-safe-cryptography\">Quantum-Safe Cryptography\u003C/h3>\n\u003Cp>\u003Cstrong>Vorbereitung auf Post-Quantum Era\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Current: RSA-2048, SHA-256\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Transitional: RSA-4096, SHA-3\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Future: Lattice-based, Hash-based Signatures\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"cloud-native-evidence-management\">Cloud-Native Evidence Management\u003C/h3>\n\u003Cp>\u003Cstrong>Container-basierte Forensik-Pipelines\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"yaml\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># docker-compose.yml für Forensik-Lab\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">version\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'3.8'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">services\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> evidence-intake\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> image\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">forensics/evidence-intake:v2.1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> volumes\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> - \u003C/span>\u003Cspan style=\"color:#9ECBFF\">./evidence:/data\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> environment\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> - \u003C/span>\u003Cspan style=\"color:#9ECBFF\">AUTO_HASH=true\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> - \u003C/span>\u003Cspan style=\"color:#9ECBFF\">BLOCKCHAIN_LOGGING=true\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> chain-tracker\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> image\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">forensics/chain-tracker:v1.5\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> depends_on\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> - \u003C/span>\u003Cspan style=\"color:#9ECBFF\">postgres\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\"> environment\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> - \u003C/span>\u003Cspan style=\"color:#9ECBFF\">DATABASE_URL=postgresql://user:pass@postgres:5432/custody\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"best-practices-zusammenfassung\">Best Practices Zusammenfassung\u003C/h2>\n\u003Ch3 id=\"präventive-maßnahmen\">Präventive Maßnahmen\u003C/h3>\n\u003Cp>\u003Cstrong>1. Standardisierte Verfahren\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>□ SOPs für alle Custody-Schritte\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Regelmäßige Team-Schulungen \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Tool-Kalibrierung und -Wartung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Backup-Verfahren für Ausfälle\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>2. Technische Safeguards\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>□ Redundante Hash-Algorithmen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Automated Integrity Monitoring\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Secure Transport Protocols\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Environmental Monitoring\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>3. Rechtliche Compliance\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>□ Jurisdiction-spezifische SOPs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Regular Legal Updates\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ Attorney Consultation Process\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>□ International Cooperation Agreements\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"reaktive-maßnahmen\">Reaktive Maßnahmen\u003C/h3>\n\u003Cp>\u003Cstrong>Incident Response bei CoC-Verletzungen\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>1. Immediate Containment\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Stop all evidence processing\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Secure affected items\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Document incident details\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>2. Impact Assessment \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Determine scope of compromise\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Identify affected cases\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Assess legal implications\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>3. Remediation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Re-establish chain where possible\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Alternative evidence strategies\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Legal notification requirements\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>4. Prevention\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Root cause analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Process improvements\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> - Additional controls\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fazit\">Fazit\u003C/h2>\n\u003Cp>Die Chain of Custody ist mehr als eine administrative Pflicht - sie ist das \u003Cstrong>Fundament der digitalen Forensik\u003C/strong>. Ohne ordnungsgemäße Beweiskette können selbst die stärksten technischen Beweise vor Gericht wertlos werden.\u003C/p>\n\u003Cp>\u003Cstrong>Schlüsselprinzipien für den Erfolg\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Vorbereitung ist alles\u003C/strong> - SOPs und Tools vor dem Incident\u003C/li>\n\u003Cli>\u003Cstrong>Dokumentation über alles\u003C/strong> - Im Zweifel mehr dokumentieren\u003C/li>\n\u003Cli>\u003Cstrong>Technologie als Enabler\u003C/strong> - Automatisierung wo möglich\u003C/li>\n\u003Cli>\u003Cstrong>Menschen im Fokus\u003C/strong> - Training und Awareness entscheidend\u003C/li>\n\u003Cli>\u003Cstrong>Kontinuierliche Verbesserung\u003C/strong> - Lessons Learned Integration\u003C/li>\n\u003C/ol>\n\u003Cp>Die Investition in robuste Chain of Custody Verfahren zahlt sich langfristig aus - durch höhere Erfolgsraten vor Gericht, reduzierte Compliance-Risiken und erhöhte Glaubwürdigkeit der forensischen Arbeit.\u003C/p>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Merksatz\u003C/strong>: “Eine Kette ist nur so stark wie ihr schwächstes Glied - in der digitalen Forensik ist das oft die menschliche Komponente, nicht die technische.”\u003C/p>\n\u003C/blockquote>\n\u003Ch2 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h2>\n\u003Cp>\u003Cstrong>Standards und Guidelines\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://www.iso.org/standard/44381.html\">ISO/IEC 27037:2012\u003C/a> - Digital Evidence Guidelines\u003C/li>\n\u003Cli>\u003Ca href=\"https://csrc.nist.gov/publications/detail/sp/800-86/final\">NIST SP 800-86\u003C/a> - Computer Forensics Guide\u003C/li>\n\u003Cli>\u003Ca href=\"https://tools.ietf.org/html/rfc3227\">RFC 3227\u003C/a> - Evidence Collection Guidelines\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Training und Zertifizierung\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>SANS FOR500 (Windows Forensic Analysis)\u003C/li>\n\u003Cli>SANS FOR508 (Advanced Incident Response)\u003C/li>\n\u003Cli>IACIS Certified Forensic Computer Examiner (CFCE)\u003C/li>\n\u003Cli>CISSP (Chain of Custody Domain)\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Tools und Software\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://www.exterro.com/digital-forensics-software/ftk-imager\">FTK Imager\u003C/a> - Free Imaging Tool\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.sleuthkit.org/autopsy/\">Autopsy\u003C/a> - Open Source Platform\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.msab.com/\">MSAB XRY\u003C/a> - Mobile Forensics\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.cellebrite.com/\">Cellebrite UFED\u003C/a> - Mobile Evidence Extraction\u003C/li>\n\u003C/ul>",{"headings":42,"localImagePaths":168,"remoteImagePaths":169,"frontmatter":170,"imagePaths":174},[43,46,50,53,57,60,63,66,69,72,75,78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132,135,138,141,144,147,150,153,156,159,162,165],{"depth":44,"slug":45,"text":14},1,"digital-evidence-chain-of-custody-lückenlose-beweisführung-in-der-digitalen-forensik",{"depth":47,"slug":48,"text":49},2,"warum-ist-die-chain-of-custody-entscheidend","Warum ist die Chain of Custody entscheidend?",{"depth":47,"slug":51,"text":52},"rechtliche-grundlagen-und-standards","Rechtliche Grundlagen und Standards",{"depth":54,"slug":55,"text":56},3,"internationale-standards","Internationale Standards",{"depth":54,"slug":58,"text":59},"nationale-rahmenwerke","Nationale Rahmenwerke",{"depth":47,"slug":61,"text":62},"die-vier-säulen-der-chain-of-custody","Die vier Säulen der Chain of Custody",{"depth":54,"slug":64,"text":65},"1-authentizität-echtheit","1. Authentizität (Echtheit)",{"depth":54,"slug":67,"text":68},"2-integrität-unversehrtheit","2. Integrität (Unversehrtheit)",{"depth":54,"slug":70,"text":71},"3-nachvollziehbarkeit-traceability","3. Nachvollziehbarkeit (Traceability)",{"depth":54,"slug":73,"text":74},"4-nicht-abstreitbarkeit-non-repudiation","4. Nicht-Abstreitbarkeit (Non-Repudiation)",{"depth":47,"slug":76,"text":77},"praktische-implementierung-schritt-für-schritt","Praktische Implementierung: Schritt-für-Schritt",{"depth":54,"slug":79,"text":80},"phase-1-vorbereitung-der-sicherstellung","Phase 1: Vorbereitung der Sicherstellung",{"depth":54,"slug":82,"text":83},"phase-2-sichere-akquisition","Phase 2: Sichere Akquisition",{"depth":54,"slug":85,"text":86},"phase-3-dokumentation-und-versiegelung","Phase 3: Dokumentation und Versiegelung",{"depth":54,"slug":88,"text":89},"phase-4-transport-und-lagerung","Phase 4: Transport und Lagerung",{"depth":47,"slug":91,"text":92},"digitale-chain-of-custody-tools","Digitale Chain of Custody Tools",{"depth":54,"slug":94,"text":95},"laboratory-information-management-systems-lims","Laboratory Information Management Systems (LIMS)",{"depth":54,"slug":97,"text":98},"blockchain-basierte-lösungen","Blockchain-basierte Lösungen",{"depth":47,"slug":100,"text":101},"häufige-fehler-und-fallstricke","Häufige Fehler und Fallstricke",{"depth":54,"slug":103,"text":104},"kritische-dokumentationsfehler","Kritische Dokumentationsfehler",{"depth":54,"slug":106,"text":107},"technische-fallstricke","Technische Fallstricke",{"depth":54,"slug":109,"text":110},"rechtliche-fallstricke","Rechtliche Fallstricke",{"depth":47,"slug":112,"text":113},"qualitätssicherung-und-audit","Qualitätssicherung und Audit",{"depth":54,"slug":115,"text":116},"peer-review-verfahren","Peer Review Verfahren",{"depth":54,"slug":118,"text":119},"continuous-monitoring","Continuous Monitoring",{"depth":47,"slug":121,"text":122},"internationale-gerichtspraxis","Internationale Gerichtspraxis",{"depth":54,"slug":124,"text":125},"deutschland---bgh-rechtsprechung","Deutschland - BGH Rechtsprechung",{"depth":54,"slug":127,"text":128},"usa---federal-courts","USA - Federal Courts",{"depth":54,"slug":130,"text":131},"eu---eugh-rechtsprechung","EU - EuGH Rechtsprechung",{"depth":47,"slug":133,"text":134},"fallstudien-aus-der-praxis","Fallstudien aus der Praxis",{"depth":54,"slug":136,"text":137},"case-study-1-ransomware-angriff-automobilhersteller","Case Study 1: Ransomware-Angriff Automobilhersteller",{"depth":54,"slug":139,"text":140},"case-study-2-betrugsermittlung-finanzdienstleister","Case Study 2: Betrugsermittlung Finanzdienstleister",{"depth":47,"slug":142,"text":143},"technologie-trends-und-zukunftsausblick","Technologie-Trends und Zukunftsausblick",{"depth":54,"slug":145,"text":146},"ki-basierte-coc-automatisierung","KI-basierte CoC-Automatisierung",{"depth":54,"slug":148,"text":149},"quantum-safe-cryptography","Quantum-Safe Cryptography",{"depth":54,"slug":151,"text":152},"cloud-native-evidence-management","Cloud-Native Evidence Management",{"depth":47,"slug":154,"text":155},"best-practices-zusammenfassung","Best Practices Zusammenfassung",{"depth":54,"slug":157,"text":158},"präventive-maßnahmen","Präventive Maßnahmen",{"depth":54,"slug":160,"text":161},"reaktive-maßnahmen","Reaktive Maßnahmen",{"depth":47,"slug":163,"text":164},"fazit","Fazit",{"depth":47,"slug":166,"text":167},"weiterführende-ressourcen","Weiterführende Ressourcen",[],[],{"title":14,"description":15,"author":18,"last_updated":171,"difficulty":19,"categories":172,"tags":173,"published":34},["Date","2025-08-10T00:00:00.000Z"],[21,22,23,24],[26,27,28,29,30,31,23,22,32,33],[],"concept-digital-evidence-chain.md","concept-file-system-storage-forensics",{"id":176,"data":178,"body":207,"filePath":208,"digest":209,"rendered":210,"legacyId":342},{"title":179,"description":180,"last_updated":181,"tool_name":182,"related_tools":183,"author":18,"difficulty":189,"categories":190,"tags":194,"published":34,"gated_content":35},"Dateisystem-Forensik: Von NTFS-Strukturen bis Cloud-Storage-Artefakten","Umfassender Leitfaden zur forensischen Analyse von Dateisystemen - NTFS-Metadaten, ext4-Journaling, APFS-Snapshots und Cloud-Storage-Forensik für professionelle Datenrekonstruktion",["Date","2025-08-10T00:00:00.000Z"],"File Systems & Storage Forensics",[184,185,186,187,188],"Autopsy","The Sleuth Kit","FTK Imager","Volatility","X-Ways Forensics","intermediate",[191,192,193],"analysis","configuration","troubleshooting",[195,196,197,198,199,200,201,202,203,204,205,206],"filesystem-analysis","metadata-extraction","deleted-data-recovery","slack-space","journaling-analysis","timestamp-forensics","partition-analysis","cloud-storage","ntfs","ext4","apfs","data-carving","# Dateisystem-Forensik: Von NTFS-Strukturen bis Cloud-Storage-Artefakten\n\nDie forensische Analyse von Dateisystemen bildet das Fundament moderner Digital Forensics. Dieser umfassende Leitfaden behandelt die kritischen Aspekte der Dateisystem-Forensik von traditionellen lokalen Speichermedien bis hin zu modernen Cloud-Storage-Umgebungen.\n\n## Grundlagen der Dateisystem-Forensik\n\n### Was ist Dateisystem-Forensik?\n\nDateisystem-Forensik umfasst die systematische Untersuchung von Speicherstrukturen zur Rekonstruktion digitaler Beweise. Dabei werden nicht nur sichtbare Dateien analysiert, sondern auch Metadaten, gelöschte Inhalte und versteckte Artefakte untersucht.\n\n### Zentrale forensische Konzepte\n\n**Metadaten-Analyse**: Jedes Dateisystem speichert umfangreiche Metadaten über Dateien, Verzeichnisse und Systemaktivitäten. Diese Informationen sind oft aussagekräftiger als der eigentliche Dateiinhalt.\n\n**Slack Space**: Der ungenutzte Bereich zwischen dem Ende einer Datei und dem Ende des zugewiesenen Clusters kann Reste vorheriger Dateien enthalten.\n\n**Journaling**: Moderne Dateisysteme protokollieren Änderungen in Journal-Dateien, die wertvolle Timeline-Informationen liefern.\n\n**Timeline-Rekonstruktion**: Durch Kombination verschiedener Timestamp-Quellen lassen sich detaillierte Aktivitätszeitlinien erstellen.\n\n## NTFS-Forensik: Das Windows-Dateisystem im Detail\n\n### Master File Table (MFT) Analyse\n\nDie MFT ist das Herzstück von NTFS und enthält Einträge für jede Datei und jeden Ordner auf dem Volume.\n\n**Struktur eines MFT-Eintrags:**\n```\nOffset 0x00: FILE-Signatur\nOffset 0x04: Update Sequence Array Offset\nOffset 0x06: Update Sequence Array Größe\nOffset 0x08: $LogFile Sequence Number (LSN)\nOffset 0x10: Sequence Number\nOffset 0x12: Hard Link Count\nOffset 0x14: Erste Attribut-Offset\n```\n\n**Forensisch relevante Attribute:**\n- `$STANDARD_INFORMATION`: Timestamps, Dateiberechtigungen\n- `$FILE_NAME`: Dateiname, zusätzliche Timestamps\n- `$DATA`: Dateiinhalt oder Cluster-Referenzen\n- `$SECURITY_DESCRIPTOR`: Zugriffsberechtigungen\n\n**Praktische Analyse-Techniken:**\n\n1. **Gelöschte MFT-Einträge identifizieren**: Einträge mit FILE0-Signatur sind oft gelöschte Dateien\n2. **Timeline-Anomalien erkennen**: Vergleich zwischen $STANDARD_INFORMATION und $FILE_NAME Timestamps\n3. **Resident vs. Non-Resident Data**: Kleine Dateien (\u003C 700 Bytes) werden direkt in der MFT gespeichert\n\n### $LogFile Analyse für Aktivitäts-Tracking\n\nDas NTFS-Journal protokolliert alle Dateisystem-Änderungen und ermöglicht detaillierte Aktivitäts-Rekonstruktion.\n\n**Relevante Log-Record-Typen:**\n- `CreateFile`: Datei-/Ordnererstellung\n- `DeleteFile`: Löschvorgänge\n- `RenameFile`: Umbenennungen\n- `SetInformationFile`: Metadaten-Änderungen\n\n**Analyse-Workflow:**\n```bash\n# Mit istat (Sleuth Kit) MFT-Eintrag analysieren\nistat /dev/sda1 5 # MFT-Eintrag 5 anzeigen\n\n# Mit fls gelöschte Dateien auflisten\nfls -r -d /dev/sda1\n\n# Mit tsk_recover gelöschte Dateien wiederherstellen\ntsk_recover /dev/sda1 /recovery/\n```\n\n### Alternate Data Streams (ADS) Detection\n\nADS können zur Datenverbergung missbraucht werden und sind oft übersehen.\n\n**Erkennungsstrategien:**\n1. **MFT-Analyse auf mehrere $DATA-Attribute**: Dateien mit ADS haben multiple $DATA-Einträge\n2. **Powershell-Erkennung**: `Get-Item -Path C:\\file.txt -Stream *`\n3. **Forensik-Tools**: Autopsy zeigt ADS automatisch in der File-Analyse\n\n### Volume Shadow Copies für Timeline-Rekonstruktion\n\nVSCs bieten Snapshots des Dateisystems zu verschiedenen Zeitpunkten.\n\n**Forensische Relevanz:**\n- Wiederherstellung gelöschter/überschriebener Dateien\n- Timeline-Rekonstruktion über längere Zeiträume\n- Registry-Hive-Vergleiche zwischen Snapshots\n\n**Zugriff auf VSCs:**\n```cmd\n# VSCs auflisten\nvssadmin list shadows\n\n# VSC mounten\nvshadow -p C: -script=shadow.cmd\n```\n\n## ext4-Forensik: Linux-Dateisystem-Analyse\n\n### Ext4-Journal-Analyse\n\nDas ext4-Journal (`/journal`) protokolliert Transaktionen und bietet wertvolle forensische Artefakte.\n\n**Journal-Struktur:**\n- **Descriptor Blocks**: Beschreiben bevorstehende Transaktionen\n- **Data Blocks**: Enthalten die eigentlichen Datenänderungen\n- **Commit Blocks**: Markieren abgeschlossene Transaktionen\n- **Revoke Blocks**: Listen widerrufene Blöcke auf\n\n**Praktische Analyse:**\n```bash\n# Journal-Informationen anzeigen\ntune2fs -l /dev/sda1 | grep -i journal\n\n# Mit debugfs Journal untersuchen\ndebugfs /dev/sda1\ndebugfs: logdump -a journal_file\n\n# Ext4-Metadaten extrahieren\nicat /dev/sda1 8 > journal.raw # Inode 8 ist typisch das Journal\n```\n\n### Inode-Struktur und Deleted-File-Recovery\n\n**Ext4-Inode-Aufbau:**\n```\nstruct ext4_inode {\n __le16 i_mode; # Dateityp und Berechtigungen\n __le16 i_uid; # Benutzer-ID\n __le32 i_size; # Dateigröße\n __le32 i_atime; # Letzter Zugriff\n __le32 i_ctime; # Inode-Änderung\n __le32 i_mtime; # Letzte Modifikation\n __le32 i_dtime; # Löschzeitpunkt\n ...\n __le32 i_block[EXT4_N_BLOCKS]; # Block-Pointer\n};\n```\n\n**Recovery-Techniken:**\n1. **Inode-Scanning**: Suche nach Inodes mit gesetztem dtime aber erhaltenen Blöcken\n2. **Journal-Recovery**: Replay von Journal-Einträgen vor Löschzeitpunkt\n3. **Directory-Entry-Recovery**: Undelfs-Techniken für kürzlich gelöschte Dateien\n\n### Extended Attributes (xattr) Forensik\n\nExtended Attributes speichern zusätzliche Metadaten und Sicherheitskontext.\n\n**Forensisch relevante xattrs:**\n- `security.selinux`: SELinux-Kontext\n- `user.*`: Benutzerdefinierte Attribute\n- `system.posix_acl_*`: ACL-Informationen\n- `security.capability`: File-Capabilities\n\n```bash\n# Alle xattrs einer Datei anzeigen\ngetfattr -d /path/to/file\n\n# Spezifisches Attribut extrahieren\ngetfattr -n user.comment /path/to/file\n```\n\n## APFS und HFS+ Forensik: macOS-Dateisysteme\n\n### APFS-Snapshots für Point-in-Time-Analysis\n\nAPFS erstellt automatisch Snapshots, die forensische Goldgruben darstellen.\n\n**Snapshot-Management:**\n```bash\n# Snapshots auflisten\ntmutil listlocalsnapshots /\n\n# Snapshot mounten\ndiskutil apfs mount -snapshot snapshot_name\n\n# Snapshot-Metadaten analysieren\ndiskutil apfs list\n```\n\n**Forensische Anwendung:**\n- Vergleich von Dateisystem-Zuständen über Zeit\n- Recovery von gelöschten/modifizierten Dateien\n- Malware-Persistenz-Analyse\n\n### HFS+-Katalog-Datei-Forensik\n\nDie Katalog-Datei ist das Äquivalent zur NTFS-MFT in HFS+.\n\n**Struktur:**\n- **Header Node**: Baum-Metadaten\n- **Index Nodes**: Verweise auf Leaf Nodes\n- **Leaf Nodes**: Eigentliche Datei-/Ordner-Records\n- **Map Nodes**: Freie/belegte Nodes\n\n**Forensische Techniken:**\n```bash\n# Mit hfsdump Katalog analysieren\nhfsdump -c /dev/disk1s1\n\n# Gelöschte Dateien suchen\nfls -r -f hfsplus /dev/disk1s1\n```\n\n## Cloud Storage Forensics\n\n### OneDrive-Artefakt-Analyse\n\n**Lokale Artefakte:**\n- `%USERPROFILE%\\OneDrive\\*`: Synchronisierte Dateien\n- Registry: `HKCU\\Software\\Microsoft\\OneDrive`\n- Event Logs: OneDrive-spezifische Ereignisse\n\n**Forensische Analyse-Punkte:**\n1. **Sync-Status**: Welche Dateien wurden synchronisiert?\n2. **Conflict-Resolution**: Wie wurden Konflikte gelöst?\n3. **Version-History**: Zugriff auf vorherige Datei-Versionen\n4. **Sharing-Activities**: Geteilte Dateien und Berechtigungen\n\n```powershell\n# OneDrive-Status abfragen\nGet-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\OneDrive\\Accounts\\*\"\n\n# Sync-Engine-Logs analysieren\nGet-WinEvent -LogName \"Microsoft-Windows-OneDrive/Operational\"\n```\n\n### Google Drive Forensik\n\n**Client-seitige Artefakte:**\n- `%LOCALAPPDATA%\\Google\\Drive\\*`: Lokaler Cache\n- SQLite-Datenbanken: Sync-Metadaten\n- Temporary Files: Unvollständige Downloads\n\n**Wichtige Datenbanken:**\n- `sync_config.db`: Sync-Konfiguration\n- `cloud_graph.db`: Cloud-Dateienstruktur\n- `metadata_database`: Datei-Metadaten\n\n```bash\n# SQLite-Datenbank analysieren\nsqlite3 sync_config.db\n.tables\nSELECT * FROM data WHERE key LIKE '%sync%';\n```\n\n### Dropbox-Forensik\n\n**Forensische Artefakte:**\n- `%APPDATA%\\Dropbox\\*`: Konfiguration und Logs\n- `.dropbox.cache\\*`: Lokaler Cache\n- Database-Dateien: Sync-Historie\n\n**Wichtige Dateien:**\n- `config.dbx`: Verschlüsselte Konfiguration\n- `filecache.dbx`: Datei-Cache-Informationen\n- `deleted.dbx`: Gelöschte Dateien-Tracking\n\n## File Carving und Datenrekonstruktion\n\n### Header/Footer-basiertes Carving\n\n**Klassische Ansätze:**\n```bash\n# Mit foremost File-Carving durchführen\nforemost -t jpg,pdf,doc -i /dev/sda1 -o /recovery/\n\n# Mit scalpel erweiterte Pattern verwenden\nscalpel -b -o /recovery/ /dev/sda1\n\n# Mit photorec interaktives Recovery\nphotorec /dev/sda1\n```\n\n**Custom Carving-Patterns:**\n```\n# scalpel.conf Beispiel\njpg\ty\t200000000\t\\xff\\xd8\\xff\\xe0\\x00\\x10\t\\xff\\xd9\npdf\ty\t200000000\t%PDF-\t%%EOF\\x0d\nzip\ty\t100000000\tPK\\x03\\x04\tPK\\x05\\x06\n```\n\n### Fragmentierte Datei-Rekonstruktion\n\n**Bifragment-Gap-Carving:**\n1. Identifikation von Header-Fragmenten\n2. Berechnung wahrscheinlicher Fragment-Größen\n3. Gap-Analyse zwischen Fragmenten\n4. Reassembly mit Plausibilitätsprüfung\n\n**Smart-Carving-Techniken:**\n- Semantic-aware Carving für Office-Dokumente\n- JPEG-Quantization-Table-Matching\n- Video-Keyframe-basierte Rekonstruktion\n\n## Timestamp-Manipulation und -Analyse\n\n### MACB-Timeline-Erstellung\n\n**Timestamp-Kategorien:**\n- **M** (Modified): Letzter Schreibzugriff auf Dateiinhalt\n- **A** (Accessed): Letzter Lesezugriff (oft deaktiviert)\n- **C** (Changed): Metadaten-Änderung (Inode/MFT)\n- **B** (Born): Erstellungszeitpunkt\n\n```bash\n# Mit fls Timeline erstellen\nfls -r -m C: > timeline.bodyfile\nmactime -d -b timeline.bodyfile > timeline.csv\n\n# Mit log2timeline umfassende Timeline\nlog2timeline.py --storage-file timeline.plaso image.dd\npsort.py -o l2tcsv -w timeline_full.csv timeline.plaso\n```\n\n### Timestamp-Manipulation-Detection\n\n**Erkennungsstrategien:**\n1. **Chronologie-Anomalien**: Created > Modified Timestamps\n2. **Präzisions-Analyse**: Unnatürliche Rundung auf Sekunden/Minuten\n3. **Filesystem-Vergleich**: Inkonsistenzen zwischen verschiedenen Timestamp-Quellen\n4. **Batch-Manipulation**: Verdächtige Muster bei mehreren Dateien\n\n**Registry-basierte Evidenz:**\n```\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsDisableLastAccessUpdate\n```\n\n## Häufige Herausforderungen und Lösungsansätze\n\n### Performance-Optimierung bei großen Images\n\n**Problem**: Analyse von Multi-TB-Images dauert Tage\n**Lösungen**:\n1. **Selective Processing**: Nur relevante Partitionen analysieren\n2. **Parallel Processing**: Multi-threaded Tools verwenden\n3. **Hardware-Optimierung**: NVMe-SSDs für temporäre Dateien\n4. **Cloud-Processing**: Verteilte Analyse in der Cloud\n\n### Verschlüsselte Container und Volumes\n\n**BitLocker-Forensik**:\n```bash\n# Mit dislocker BitLocker-Volume mounten\ndislocker -r -V /dev/sda1 -p password -- /tmp/bitlocker\n\n# Recovery-Key-basierter Zugriff\ndislocker -r -V /dev/sda1 -k recovery.key -- /tmp/bitlocker\n```\n\n**VeraCrypt-Analyse**:\n- Header-Backup-Analyse für mögliche Passwort-Recovery\n- Hidden-Volume-Detection durch Entropie-Analyse\n- Keyfile-basierte Entschlüsselung\n\n### Anti-Forensik-Techniken erkennen\n\n**Wiping-Detection**:\n- Pattern-Analyse für DoD 5220.22-M Wiping\n- Random-Data vs. Encrypted-Data Unterscheidung\n- Unvollständige Wiping-Artefakte\n\n**Timestomp-Detection**:\n```bash\n# Mit analyzeMFT.py Timestamp-Anomalien finden\nanalyzeMFT.py -f $MFT -o analysis.csv\n# Analyse der $SI vs. $FN Timestamp-Diskrepanzen\n```\n\n## Tool-Integration und Workflows\n\n### Autopsy-Integration\n\n**Workflow-Setup**:\n1. **Image-Import**: E01/DD-Images mit Hash-Verifikation\n2. **Ingest-Module**: File-Type-Detection, Hash-Lookup, Timeline-Creation\n3. **Analysis**: Keyword-Search, Timeline-Analysis, File-Category-Review\n4. **Reporting**: Automatisierte Report-Generierung\n\n### TSK-Kommandozeilen-Pipeline\n\n```bash\n#!/bin/bash\n# Vollständiger Dateisystem-Analyse-Workflow\n\nIMAGE=\"/cases/evidence.dd\"\nOUTPUT=\"/analysis/case001\"\n\n# 1. Partitionstabelle analysieren\nmmls \"$IMAGE\" > \"$OUTPUT/partitions.txt\"\n\n# 2. Dateisystem-Info extrahieren\nfsstat \"$IMAGE\" > \"$OUTPUT/filesystem_info.txt\"\n\n# 3. Timeline erstellen\nfls -r -m \"$IMAGE\" > \"$OUTPUT/timeline.bodyfile\"\nmactime -d -b \"$OUTPUT/timeline.bodyfile\" > \"$OUTPUT/timeline.csv\"\n\n# 4. Gelöschte Dateien auflisten\nfls -r -d \"$IMAGE\" > \"$OUTPUT/deleted_files.txt\"\n\n# 5. File-Carving durchführen\nforemost -t all -i \"$IMAGE\" -o \"$OUTPUT/carved/\"\n\n# 6. Hash-Analyse\nhfind -i nsrl \"$OUTPUT/timeline.bodyfile\" > \"$OUTPUT/known_files.txt\"\n```\n\n## Best Practices und Methodologie\n\n### Dokumentation und Chain of Custody\n\n**Kritische Dokumentationspunkte**:\n1. **Acquisition-Details**: Tool, Version, Hash-Werte, Zeitstempel\n2. **Analysis-Methodik**: Verwendete Tools und Parameter\n3. **Findings-Dokumentation**: Screenshots, Befund-Zusammenfassung\n4. **Timeline-Rekonstruktion**: Chronologische Ereignis-Dokumentation\n\n### Qualitätssicherung\n\n**Verifikations-Checkliste**:\n- [ ] Hash-Integrität von Original-Images\n- [ ] Tool-Version-Dokumentation\n- [ ] Kreuz-Validierung mit verschiedenen Tools\n- [ ] Timeline-Plausibilitätsprüfung\n- [ ] Anti-Forensik-Artefakt-Suche\n\n### Rechtliche Aspekte\n\n**Admissibility-Faktoren**:\n1. **Tool-Reliability**: Verwendung etablierter, validierter Tools\n2. **Methodology-Documentation**: Nachvollziehbare Analyse-Schritte\n3. **Error-Rate-Analysis**: Bekannte Limitationen dokumentieren\n4. **Expert-Qualification**: Forensiker-Qualifikation nachweisen\n\n## Weiterführende Ressourcen\n\n### Spezialisierte Tools\n- **X-Ways Forensics**: Kommerzielle All-in-One-Lösung\n- **EnCase**: Enterprise-Forensik-Platform\n- **AXIOM**: Mobile und Computer-Forensik\n- **Oxygen Detective**: Mobile-Spezialist\n- **BlackBag**: macOS-Forensik-Spezialist\n\n### Fortgeschrittene Techniken\n- **Memory-Forensics**: Volatility für RAM-Analyse\n- **Network-Forensics**: Wireshark für Netzwerk-Traffic\n- **Mobile-Forensics**: Cellebrite/Oxygen für Smartphone-Analyse\n- **Cloud-Forensics**: KAPE für Cloud-Artefakt-Collection\n\n### Continuous Learning\n- **SANS FOR508**: Advanced Digital Forensics\n- **Volatility Training**: Memory-Forensics-Spezialisierung\n- **FIRST Conference**: Internationale Forensik-Community\n- **DFRWS**: Digital Forensics Research Workshop\n\nDie moderne Dateisystem-Forensik erfordert ein tiefes Verständnis verschiedener Speichertechnologien und deren forensischer Artefakte. Durch systematische Anwendung der beschriebenen Techniken und kontinuierliche Weiterbildung können Forensiker auch komplexeste Fälle erfolgreich bearbeiten und gerichtsfeste Beweise sicherstellen.","src/content/knowledgebase/concept-file-system-storage-forensics.md","1d40f0348ae68306",{"html":211,"metadata":212},"\u003Ch1 id=\"dateisystem-forensik-von-ntfs-strukturen-bis-cloud-storage-artefakten\">Dateisystem-Forensik: Von NTFS-Strukturen bis Cloud-Storage-Artefakten\u003C/h1>\n\u003Cp>Die forensische Analyse von Dateisystemen bildet das Fundament moderner Digital Forensics. Dieser umfassende Leitfaden behandelt die kritischen Aspekte der Dateisystem-Forensik von traditionellen lokalen Speichermedien bis hin zu modernen Cloud-Storage-Umgebungen.\u003C/p>\n\u003Ch2 id=\"grundlagen-der-dateisystem-forensik\">Grundlagen der Dateisystem-Forensik\u003C/h2>\n\u003Ch3 id=\"was-ist-dateisystem-forensik\">Was ist Dateisystem-Forensik?\u003C/h3>\n\u003Cp>Dateisystem-Forensik umfasst die systematische Untersuchung von Speicherstrukturen zur Rekonstruktion digitaler Beweise. Dabei werden nicht nur sichtbare Dateien analysiert, sondern auch Metadaten, gelöschte Inhalte und versteckte Artefakte untersucht.\u003C/p>\n\u003Ch3 id=\"zentrale-forensische-konzepte\">Zentrale forensische Konzepte\u003C/h3>\n\u003Cp>\u003Cstrong>Metadaten-Analyse\u003C/strong>: Jedes Dateisystem speichert umfangreiche Metadaten über Dateien, Verzeichnisse und Systemaktivitäten. Diese Informationen sind oft aussagekräftiger als der eigentliche Dateiinhalt.\u003C/p>\n\u003Cp>\u003Cstrong>Slack Space\u003C/strong>: Der ungenutzte Bereich zwischen dem Ende einer Datei und dem Ende des zugewiesenen Clusters kann Reste vorheriger Dateien enthalten.\u003C/p>\n\u003Cp>\u003Cstrong>Journaling\u003C/strong>: Moderne Dateisysteme protokollieren Änderungen in Journal-Dateien, die wertvolle Timeline-Informationen liefern.\u003C/p>\n\u003Cp>\u003Cstrong>Timeline-Rekonstruktion\u003C/strong>: Durch Kombination verschiedener Timestamp-Quellen lassen sich detaillierte Aktivitätszeitlinien erstellen.\u003C/p>\n\u003Ch2 id=\"ntfs-forensik-das-windows-dateisystem-im-detail\">NTFS-Forensik: Das Windows-Dateisystem im Detail\u003C/h2>\n\u003Ch3 id=\"master-file-table-mft-analyse\">Master File Table (MFT) Analyse\u003C/h3>\n\u003Cp>Die MFT ist das Herzstück von NTFS und enthält Einträge für jede Datei und jeden Ordner auf dem Volume.\u003C/p>\n\u003Cp>\u003Cstrong>Struktur eines MFT-Eintrags:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Offset 0x00: FILE-Signatur\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x04: Update Sequence Array Offset\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x06: Update Sequence Array Größe\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x08: $LogFile Sequence Number (LSN)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x10: Sequence Number\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x12: Hard Link Count\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Offset 0x14: Erste Attribut-Offset\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Forensisch relevante Attribute:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>$STANDARD_INFORMATION\u003C/code>: Timestamps, Dateiberechtigungen\u003C/li>\n\u003Cli>\u003Ccode>$FILE_NAME\u003C/code>: Dateiname, zusätzliche Timestamps\u003C/li>\n\u003Cli>\u003Ccode>$DATA\u003C/code>: Dateiinhalt oder Cluster-Referenzen\u003C/li>\n\u003Cli>\u003Ccode>$SECURITY_DESCRIPTOR\u003C/code>: Zugriffsberechtigungen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Praktische Analyse-Techniken:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Gelöschte MFT-Einträge identifizieren\u003C/strong>: Einträge mit FILE0-Signatur sind oft gelöschte Dateien\u003C/li>\n\u003Cli>\u003Cstrong>Timeline-Anomalien erkennen\u003C/strong>: Vergleich zwischen $STANDARD_INFORMATION und $FILE_NAME Timestamps\u003C/li>\n\u003Cli>\u003Cstrong>Resident vs. Non-Resident Data\u003C/strong>: Kleine Dateien (< 700 Bytes) werden direkt in der MFT gespeichert\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"logfile-analyse-für-aktivitäts-tracking\">$LogFile Analyse für Aktivitäts-Tracking\u003C/h3>\n\u003Cp>Das NTFS-Journal protokolliert alle Dateisystem-Änderungen und ermöglicht detaillierte Aktivitäts-Rekonstruktion.\u003C/p>\n\u003Cp>\u003Cstrong>Relevante Log-Record-Typen:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>CreateFile\u003C/code>: Datei-/Ordnererstellung\u003C/li>\n\u003Cli>\u003Ccode>DeleteFile\u003C/code>: Löschvorgänge\u003C/li>\n\u003Cli>\u003Ccode>RenameFile\u003C/code>: Umbenennungen\u003C/li>\n\u003Cli>\u003Ccode>SetInformationFile\u003C/code>: Metadaten-Änderungen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Analyse-Workflow:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit istat (Sleuth Kit) MFT-Eintrag analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">istat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 5\u003C/span>\u003Cspan style=\"color:#6A737D\"> # MFT-Eintrag 5 anzeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit fls gelöschte Dateien auflisten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit tsk_recover gelöschte Dateien wiederherstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tsk_recover\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /recovery/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"alternate-data-streams-ads-detection\">Alternate Data Streams (ADS) Detection\u003C/h3>\n\u003Cp>ADS können zur Datenverbergung missbraucht werden und sind oft übersehen.\u003C/p>\n\u003Cp>\u003Cstrong>Erkennungsstrategien:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>MFT-Analyse auf mehrere $DATA-Attribute\u003C/strong>: Dateien mit ADS haben multiple $DATA-Einträge\u003C/li>\n\u003Cli>\u003Cstrong>Powershell-Erkennung\u003C/strong>: \u003Ccode>Get-Item -Path C:\\file.txt -Stream *\u003C/code>\u003C/li>\n\u003Cli>\u003Cstrong>Forensik-Tools\u003C/strong>: Autopsy zeigt ADS automatisch in der File-Analyse\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"volume-shadow-copies-für-timeline-rekonstruktion\">Volume Shadow Copies für Timeline-Rekonstruktion\u003C/h3>\n\u003Cp>VSCs bieten Snapshots des Dateisystems zu verschiedenen Zeitpunkten.\u003C/p>\n\u003Cp>\u003Cstrong>Forensische Relevanz:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Wiederherstellung gelöschter/überschriebener Dateien\u003C/li>\n\u003Cli>Timeline-Rekonstruktion über längere Zeiträume\u003C/li>\n\u003Cli>Registry-Hive-Vergleiche zwischen Snapshots\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Zugriff auf VSCs:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"cmd\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"># VSCs auflisten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">vssadmin list shadows\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"># VSC mounten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">vshadow \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\">p C: \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\">script\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">shadow.cmd\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"ext4-forensik-linux-dateisystem-analyse\">ext4-Forensik: Linux-Dateisystem-Analyse\u003C/h2>\n\u003Ch3 id=\"ext4-journal-analyse\">Ext4-Journal-Analyse\u003C/h3>\n\u003Cp>Das ext4-Journal (\u003Ccode>/journal\u003C/code>) protokolliert Transaktionen und bietet wertvolle forensische Artefakte.\u003C/p>\n\u003Cp>\u003Cstrong>Journal-Struktur:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Descriptor Blocks\u003C/strong>: Beschreiben bevorstehende Transaktionen\u003C/li>\n\u003Cli>\u003Cstrong>Data Blocks\u003C/strong>: Enthalten die eigentlichen Datenänderungen\u003C/li>\n\u003Cli>\u003Cstrong>Commit Blocks\u003C/strong>: Markieren abgeschlossene Transaktionen\u003C/li>\n\u003Cli>\u003Cstrong>Revoke Blocks\u003C/strong>: Listen widerrufene Blöcke auf\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Praktische Analyse:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Journal-Informationen anzeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tune2fs\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -l\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> journal\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit debugfs Journal untersuchen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">debugfs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">debugfs:\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> logdump\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -a\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> journal_file\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ext4-Metadaten extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">icat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 8\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> journal.raw\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Inode 8 ist typisch das Journal\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"inode-struktur-und-deleted-file-recovery\">Inode-Struktur und Deleted-File-Recovery\u003C/h3>\n\u003Cp>\u003Cstrong>Ext4-Inode-Aufbau:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>struct ext4_inode {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le16 i_mode; # Dateityp und Berechtigungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le16 i_uid; # Benutzer-ID\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_size; # Dateigröße\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_atime; # Letzter Zugriff\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_ctime; # Inode-Änderung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_mtime; # Letzte Modifikation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_dtime; # Löschzeitpunkt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> ...\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> __le32 i_block[EXT4_N_BLOCKS]; # Block-Pointer\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>};\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Recovery-Techniken:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Inode-Scanning\u003C/strong>: Suche nach Inodes mit gesetztem dtime aber erhaltenen Blöcken\u003C/li>\n\u003Cli>\u003Cstrong>Journal-Recovery\u003C/strong>: Replay von Journal-Einträgen vor Löschzeitpunkt\u003C/li>\n\u003Cli>\u003Cstrong>Directory-Entry-Recovery\u003C/strong>: Undelfs-Techniken für kürzlich gelöschte Dateien\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"extended-attributes-xattr-forensik\">Extended Attributes (xattr) Forensik\u003C/h3>\n\u003Cp>Extended Attributes speichern zusätzliche Metadaten und Sicherheitskontext.\u003C/p>\n\u003Cp>\u003Cstrong>Forensisch relevante xattrs:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>security.selinux\u003C/code>: SELinux-Kontext\u003C/li>\n\u003Cli>\u003Ccode>user.*\u003C/code>: Benutzerdefinierte Attribute\u003C/li>\n\u003Cli>\u003Ccode>system.posix_acl_*\u003C/code>: ACL-Informationen\u003C/li>\n\u003Cli>\u003Ccode>security.capability\u003C/code>: File-Capabilities\u003C/li>\n\u003C/ul>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Alle xattrs einer Datei anzeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">getfattr\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/file\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Spezifisches Attribut extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">getfattr\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -n\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> user.comment\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/file\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"apfs-und-hfs-forensik-macos-dateisysteme\">APFS und HFS+ Forensik: macOS-Dateisysteme\u003C/h2>\n\u003Ch3 id=\"apfs-snapshots-für-point-in-time-analysis\">APFS-Snapshots für Point-in-Time-Analysis\u003C/h3>\n\u003Cp>APFS erstellt automatisch Snapshots, die forensische Goldgruben darstellen.\u003C/p>\n\u003Cp>\u003Cstrong>Snapshot-Management:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Snapshots auflisten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tmutil\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> listlocalsnapshots\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Snapshot mounten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">diskutil\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apfs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -snapshot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> snapshot_name\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Snapshot-Metadaten analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">diskutil\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apfs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> list\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Forensische Anwendung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Vergleich von Dateisystem-Zuständen über Zeit\u003C/li>\n\u003Cli>Recovery von gelöschten/modifizierten Dateien\u003C/li>\n\u003Cli>Malware-Persistenz-Analyse\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"hfs-katalog-datei-forensik\">HFS+-Katalog-Datei-Forensik\u003C/h3>\n\u003Cp>Die Katalog-Datei ist das Äquivalent zur NTFS-MFT in HFS+.\u003C/p>\n\u003Cp>\u003Cstrong>Struktur:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Header Node\u003C/strong>: Baum-Metadaten\u003C/li>\n\u003Cli>\u003Cstrong>Index Nodes\u003C/strong>: Verweise auf Leaf Nodes\u003C/li>\n\u003Cli>\u003Cstrong>Leaf Nodes\u003C/strong>: Eigentliche Datei-/Ordner-Records\u003C/li>\n\u003Cli>\u003Cstrong>Map Nodes\u003C/strong>: Freie/belegte Nodes\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Forensische Techniken:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit hfsdump Katalog analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hfsdump\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/disk1s1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Gelöschte Dateien suchen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hfsplus\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/disk1s1\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"cloud-storage-forensics\">Cloud Storage Forensics\u003C/h2>\n\u003Ch3 id=\"onedrive-artefakt-analyse\">OneDrive-Artefakt-Analyse\u003C/h3>\n\u003Cp>\u003Cstrong>Lokale Artefakte:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>%USERPROFILE%\\OneDrive\\*\u003C/code>: Synchronisierte Dateien\u003C/li>\n\u003Cli>Registry: \u003Ccode>HKCU\\Software\\Microsoft\\OneDrive\u003C/code>\u003C/li>\n\u003Cli>Event Logs: OneDrive-spezifische Ereignisse\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Forensische Analyse-Punkte:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Sync-Status\u003C/strong>: Welche Dateien wurden synchronisiert?\u003C/li>\n\u003Cli>\u003Cstrong>Conflict-Resolution\u003C/strong>: Wie wurden Konflikte gelöst?\u003C/li>\n\u003Cli>\u003Cstrong>Version-History\u003C/strong>: Zugriff auf vorherige Datei-Versionen\u003C/li>\n\u003Cli>\u003Cstrong>Sharing-Activities\u003C/strong>: Geteilte Dateien und Berechtigungen\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"powershell\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># OneDrive-Status abfragen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">Get-ItemProperty\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Path \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"HKCU:\\Software\\Microsoft\\OneDrive\\Accounts\\*\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Sync-Engine-Logs analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">Get-WinEvent\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">LogName \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"Microsoft-Windows-OneDrive/Operational\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"google-drive-forensik\">Google Drive Forensik\u003C/h3>\n\u003Cp>\u003Cstrong>Client-seitige Artefakte:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>%LOCALAPPDATA%\\Google\\Drive\\*\u003C/code>: Lokaler Cache\u003C/li>\n\u003Cli>SQLite-Datenbanken: Sync-Metadaten\u003C/li>\n\u003Cli>Temporary Files: Unvollständige Downloads\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Wichtige Datenbanken:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>sync_config.db\u003C/code>: Sync-Konfiguration\u003C/li>\n\u003Cli>\u003Ccode>cloud_graph.db\u003C/code>: Cloud-Dateienstruktur\u003C/li>\n\u003Cli>\u003Ccode>metadata_database\u003C/code>: Datei-Metadaten\u003C/li>\n\u003C/ul>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SQLite-Datenbank analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sync_config.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">.tables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">SELECT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> *\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> FROM\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> WHERE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> key\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%sync%'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"dropbox-forensik\">Dropbox-Forensik\u003C/h3>\n\u003Cp>\u003Cstrong>Forensische Artefakte:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>%APPDATA%\\Dropbox\\*\u003C/code>: Konfiguration und Logs\u003C/li>\n\u003Cli>\u003Ccode>.dropbox.cache\\*\u003C/code>: Lokaler Cache\u003C/li>\n\u003Cli>Database-Dateien: Sync-Historie\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Wichtige Dateien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>config.dbx\u003C/code>: Verschlüsselte Konfiguration\u003C/li>\n\u003Cli>\u003Ccode>filecache.dbx\u003C/code>: Datei-Cache-Informationen\u003C/li>\n\u003Cli>\u003Ccode>deleted.dbx\u003C/code>: Gelöschte Dateien-Tracking\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"file-carving-und-datenrekonstruktion\">File Carving und Datenrekonstruktion\u003C/h2>\n\u003Ch3 id=\"headerfooter-basiertes-carving\">Header/Footer-basiertes Carving\u003C/h3>\n\u003Cp>\u003Cstrong>Klassische Ansätze:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit foremost File-Carving durchführen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">foremost\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> jpg,pdf,doc\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /recovery/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit scalpel erweiterte Pattern verwenden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">scalpel\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -b\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /recovery/\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit photorec interaktives Recovery\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">photorec\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Custom Carving-Patterns:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan># scalpel.conf Beispiel\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>jpg\ty\t200000000\t\\xff\\xd8\\xff\\xe0\\x00\\x10\t\\xff\\xd9\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>pdf\ty\t200000000\t%PDF-\t%%EOF\\x0d\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>zip\ty\t100000000\tPK\\x03\\x04\tPK\\x05\\x06\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"fragmentierte-datei-rekonstruktion\">Fragmentierte Datei-Rekonstruktion\u003C/h3>\n\u003Cp>\u003Cstrong>Bifragment-Gap-Carving:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>Identifikation von Header-Fragmenten\u003C/li>\n\u003Cli>Berechnung wahrscheinlicher Fragment-Größen\u003C/li>\n\u003Cli>Gap-Analyse zwischen Fragmenten\u003C/li>\n\u003Cli>Reassembly mit Plausibilitätsprüfung\u003C/li>\n\u003C/ol>\n\u003Cp>\u003Cstrong>Smart-Carving-Techniken:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Semantic-aware Carving für Office-Dokumente\u003C/li>\n\u003Cli>JPEG-Quantization-Table-Matching\u003C/li>\n\u003Cli>Video-Keyframe-basierte Rekonstruktion\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"timestamp-manipulation-und--analyse\">Timestamp-Manipulation und -Analyse\u003C/h2>\n\u003Ch3 id=\"macb-timeline-erstellung\">MACB-Timeline-Erstellung\u003C/h3>\n\u003Cp>\u003Cstrong>Timestamp-Kategorien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>M\u003C/strong> (Modified): Letzter Schreibzugriff auf Dateiinhalt\u003C/li>\n\u003Cli>\u003Cstrong>A\u003C/strong> (Accessed): Letzter Lesezugriff (oft deaktiviert)\u003C/li>\n\u003Cli>\u003Cstrong>C\u003C/strong> (Changed): Metadaten-Änderung (Inode/MFT)\u003C/li>\n\u003Cli>\u003Cstrong>B\u003C/strong> (Born): Erstellungszeitpunkt\u003C/li>\n\u003C/ul>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit fls Timeline erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -m\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> C:\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.bodyfile\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mactime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -b\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.bodyfile\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit log2timeline umfassende Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">log2timeline.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --storage-file\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> image.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> l2tcsv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline_full.csv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"timestamp-manipulation-detection\">Timestamp-Manipulation-Detection\u003C/h3>\n\u003Cp>\u003Cstrong>Erkennungsstrategien:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Chronologie-Anomalien\u003C/strong>: Created > Modified Timestamps\u003C/li>\n\u003Cli>\u003Cstrong>Präzisions-Analyse\u003C/strong>: Unnatürliche Rundung auf Sekunden/Minuten\u003C/li>\n\u003Cli>\u003Cstrong>Filesystem-Vergleich\u003C/strong>: Inkonsistenzen zwischen verschiedenen Timestamp-Quellen\u003C/li>\n\u003Cli>\u003Cstrong>Batch-Manipulation\u003C/strong>: Verdächtige Muster bei mehreren Dateien\u003C/li>\n\u003C/ol>\n\u003Cp>\u003Cstrong>Registry-basierte Evidenz:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsDisableLastAccessUpdate\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-herausforderungen-und-lösungsansätze\">Häufige Herausforderungen und Lösungsansätze\u003C/h2>\n\u003Ch3 id=\"performance-optimierung-bei-großen-images\">Performance-Optimierung bei großen Images\u003C/h3>\n\u003Cp>\u003Cstrong>Problem\u003C/strong>: Analyse von Multi-TB-Images dauert Tage\n\u003Cstrong>Lösungen\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Selective Processing\u003C/strong>: Nur relevante Partitionen analysieren\u003C/li>\n\u003Cli>\u003Cstrong>Parallel Processing\u003C/strong>: Multi-threaded Tools verwenden\u003C/li>\n\u003Cli>\u003Cstrong>Hardware-Optimierung\u003C/strong>: NVMe-SSDs für temporäre Dateien\u003C/li>\n\u003Cli>\u003Cstrong>Cloud-Processing\u003C/strong>: Verteilte Analyse in der Cloud\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"verschlüsselte-container-und-volumes\">Verschlüsselte Container und Volumes\u003C/h3>\n\u003Cp>\u003Cstrong>BitLocker-Forensik\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit dislocker BitLocker-Volume mounten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">dislocker\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -V\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -p\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> password\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /tmp/bitlocker\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Recovery-Key-basierter Zugriff\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">dislocker\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -V\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sda1\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -k\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> recovery.key\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /tmp/bitlocker\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>VeraCrypt-Analyse\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>Header-Backup-Analyse für mögliche Passwort-Recovery\u003C/li>\n\u003Cli>Hidden-Volume-Detection durch Entropie-Analyse\u003C/li>\n\u003Cli>Keyfile-basierte Entschlüsselung\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"anti-forensik-techniken-erkennen\">Anti-Forensik-Techniken erkennen\u003C/h3>\n\u003Cp>\u003Cstrong>Wiping-Detection\u003C/strong>:\u003C/p>\n\u003Cul>\n\u003Cli>Pattern-Analyse für DoD 5220.22-M Wiping\u003C/li>\n\u003Cli>Random-Data vs. Encrypted-Data Unterscheidung\u003C/li>\n\u003Cli>Unvollständige Wiping-Artefakte\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Timestomp-Detection\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit analyzeMFT.py Timestamp-Anomalien finden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">analyzeMFT.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $MFT \u003C/span>\u003Cspan style=\"color:#79B8FF\">-o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> analysis.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Analyse der $SI vs. $FN Timestamp-Diskrepanzen\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"tool-integration-und-workflows\">Tool-Integration und Workflows\u003C/h2>\n\u003Ch3 id=\"autopsy-integration\">Autopsy-Integration\u003C/h3>\n\u003Cp>\u003Cstrong>Workflow-Setup\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Image-Import\u003C/strong>: E01/DD-Images mit Hash-Verifikation\u003C/li>\n\u003Cli>\u003Cstrong>Ingest-Module\u003C/strong>: File-Type-Detection, Hash-Lookup, Timeline-Creation\u003C/li>\n\u003Cli>\u003Cstrong>Analysis\u003C/strong>: Keyword-Search, Timeline-Analysis, File-Category-Review\u003C/li>\n\u003Cli>\u003Cstrong>Reporting\u003C/strong>: Automatisierte Report-Generierung\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"tsk-kommandozeilen-pipeline\">TSK-Kommandozeilen-Pipeline\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/bin/bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständiger Dateisystem-Analyse-Workflow\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">IMAGE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/cases/evidence.dd\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">OUTPUT\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/analysis/case001\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 1. Partitionstabelle analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mmls\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$IMAGE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/partitions.txt\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 2. Dateisystem-Info extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fsstat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$IMAGE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/filesystem_info.txt\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 3. Timeline erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -m\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$IMAGE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/timeline.bodyfile\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mactime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -b\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/timeline.bodyfile\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/timeline.csv\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 4. Gelöschte Dateien auflisten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$IMAGE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/deleted_files.txt\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 5. File-Carving durchführen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">foremost\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> all\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$IMAGE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/carved/\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 6. Hash-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hfind\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> nsrl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/timeline.bodyfile\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$OUTPUT\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/known_files.txt\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"best-practices-und-methodologie\">Best Practices und Methodologie\u003C/h2>\n\u003Ch3 id=\"dokumentation-und-chain-of-custody\">Dokumentation und Chain of Custody\u003C/h3>\n\u003Cp>\u003Cstrong>Kritische Dokumentationspunkte\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Acquisition-Details\u003C/strong>: Tool, Version, Hash-Werte, Zeitstempel\u003C/li>\n\u003Cli>\u003Cstrong>Analysis-Methodik\u003C/strong>: Verwendete Tools und Parameter\u003C/li>\n\u003Cli>\u003Cstrong>Findings-Dokumentation\u003C/strong>: Screenshots, Befund-Zusammenfassung\u003C/li>\n\u003Cli>\u003Cstrong>Timeline-Rekonstruktion\u003C/strong>: Chronologische Ereignis-Dokumentation\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"qualitätssicherung\">Qualitätssicherung\u003C/h3>\n\u003Cp>\u003Cstrong>Verifikations-Checkliste\u003C/strong>:\u003C/p>\n\u003Cul class=\"contains-task-list\">\n\u003Cli class=\"task-list-item\">\u003Cinput type=\"checkbox\" disabled> Hash-Integrität von Original-Images\u003C/li>\n\u003Cli class=\"task-list-item\">\u003Cinput type=\"checkbox\" disabled> Tool-Version-Dokumentation\u003C/li>\n\u003Cli class=\"task-list-item\">\u003Cinput type=\"checkbox\" disabled> Kreuz-Validierung mit verschiedenen Tools\u003C/li>\n\u003Cli class=\"task-list-item\">\u003Cinput type=\"checkbox\" disabled> Timeline-Plausibilitätsprüfung\u003C/li>\n\u003Cli class=\"task-list-item\">\u003Cinput type=\"checkbox\" disabled> Anti-Forensik-Artefakt-Suche\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"rechtliche-aspekte\">Rechtliche Aspekte\u003C/h3>\n\u003Cp>\u003Cstrong>Admissibility-Faktoren\u003C/strong>:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Tool-Reliability\u003C/strong>: Verwendung etablierter, validierter Tools\u003C/li>\n\u003Cli>\u003Cstrong>Methodology-Documentation\u003C/strong>: Nachvollziehbare Analyse-Schritte\u003C/li>\n\u003Cli>\u003Cstrong>Error-Rate-Analysis\u003C/strong>: Bekannte Limitationen dokumentieren\u003C/li>\n\u003Cli>\u003Cstrong>Expert-Qualification\u003C/strong>: Forensiker-Qualifikation nachweisen\u003C/li>\n\u003C/ol>\n\u003Ch2 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h2>\n\u003Ch3 id=\"spezialisierte-tools\">Spezialisierte Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>X-Ways Forensics\u003C/strong>: Kommerzielle All-in-One-Lösung\u003C/li>\n\u003Cli>\u003Cstrong>EnCase\u003C/strong>: Enterprise-Forensik-Platform\u003C/li>\n\u003Cli>\u003Cstrong>AXIOM\u003C/strong>: Mobile und Computer-Forensik\u003C/li>\n\u003Cli>\u003Cstrong>Oxygen Detective\u003C/strong>: Mobile-Spezialist\u003C/li>\n\u003Cli>\u003Cstrong>BlackBag\u003C/strong>: macOS-Forensik-Spezialist\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"fortgeschrittene-techniken\">Fortgeschrittene Techniken\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Memory-Forensics\u003C/strong>: Volatility für RAM-Analyse\u003C/li>\n\u003Cli>\u003Cstrong>Network-Forensics\u003C/strong>: Wireshark für Netzwerk-Traffic\u003C/li>\n\u003Cli>\u003Cstrong>Mobile-Forensics\u003C/strong>: Cellebrite/Oxygen für Smartphone-Analyse\u003C/li>\n\u003Cli>\u003Cstrong>Cloud-Forensics\u003C/strong>: KAPE für Cloud-Artefakt-Collection\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"continuous-learning\">Continuous Learning\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>SANS FOR508\u003C/strong>: Advanced Digital Forensics\u003C/li>\n\u003Cli>\u003Cstrong>Volatility Training\u003C/strong>: Memory-Forensics-Spezialisierung\u003C/li>\n\u003Cli>\u003Cstrong>FIRST Conference\u003C/strong>: Internationale Forensik-Community\u003C/li>\n\u003Cli>\u003Cstrong>DFRWS\u003C/strong>: Digital Forensics Research Workshop\u003C/li>\n\u003C/ul>\n\u003Cp>Die moderne Dateisystem-Forensik erfordert ein tiefes Verständnis verschiedener Speichertechnologien und deren forensischer Artefakte. Durch systematische Anwendung der beschriebenen Techniken und kontinuierliche Weiterbildung können Forensiker auch komplexeste Fälle erfolgreich bearbeiten und gerichtsfeste Beweise sicherstellen.\u003C/p>",{"headings":213,"localImagePaths":334,"remoteImagePaths":335,"frontmatter":336,"imagePaths":341},[214,216,219,222,225,228,231,234,237,240,243,246,249,252,255,258,261,264,267,270,273,276,279,282,285,288,291,294,297,300,303,306,309,312,315,318,321,324,325,328,331],{"depth":44,"slug":215,"text":179},"dateisystem-forensik-von-ntfs-strukturen-bis-cloud-storage-artefakten",{"depth":47,"slug":217,"text":218},"grundlagen-der-dateisystem-forensik","Grundlagen der Dateisystem-Forensik",{"depth":54,"slug":220,"text":221},"was-ist-dateisystem-forensik","Was ist Dateisystem-Forensik?",{"depth":54,"slug":223,"text":224},"zentrale-forensische-konzepte","Zentrale forensische Konzepte",{"depth":47,"slug":226,"text":227},"ntfs-forensik-das-windows-dateisystem-im-detail","NTFS-Forensik: Das Windows-Dateisystem im Detail",{"depth":54,"slug":229,"text":230},"master-file-table-mft-analyse","Master File Table (MFT) Analyse",{"depth":54,"slug":232,"text":233},"logfile-analyse-für-aktivitäts-tracking","$LogFile Analyse für Aktivitäts-Tracking",{"depth":54,"slug":235,"text":236},"alternate-data-streams-ads-detection","Alternate Data Streams (ADS) Detection",{"depth":54,"slug":238,"text":239},"volume-shadow-copies-für-timeline-rekonstruktion","Volume Shadow Copies für Timeline-Rekonstruktion",{"depth":47,"slug":241,"text":242},"ext4-forensik-linux-dateisystem-analyse","ext4-Forensik: Linux-Dateisystem-Analyse",{"depth":54,"slug":244,"text":245},"ext4-journal-analyse","Ext4-Journal-Analyse",{"depth":54,"slug":247,"text":248},"inode-struktur-und-deleted-file-recovery","Inode-Struktur und Deleted-File-Recovery",{"depth":54,"slug":250,"text":251},"extended-attributes-xattr-forensik","Extended Attributes (xattr) Forensik",{"depth":47,"slug":253,"text":254},"apfs-und-hfs-forensik-macos-dateisysteme","APFS und HFS+ Forensik: macOS-Dateisysteme",{"depth":54,"slug":256,"text":257},"apfs-snapshots-für-point-in-time-analysis","APFS-Snapshots für Point-in-Time-Analysis",{"depth":54,"slug":259,"text":260},"hfs-katalog-datei-forensik","HFS+-Katalog-Datei-Forensik",{"depth":47,"slug":262,"text":263},"cloud-storage-forensics","Cloud Storage Forensics",{"depth":54,"slug":265,"text":266},"onedrive-artefakt-analyse","OneDrive-Artefakt-Analyse",{"depth":54,"slug":268,"text":269},"google-drive-forensik","Google Drive Forensik",{"depth":54,"slug":271,"text":272},"dropbox-forensik","Dropbox-Forensik",{"depth":47,"slug":274,"text":275},"file-carving-und-datenrekonstruktion","File Carving und Datenrekonstruktion",{"depth":54,"slug":277,"text":278},"headerfooter-basiertes-carving","Header/Footer-basiertes Carving",{"depth":54,"slug":280,"text":281},"fragmentierte-datei-rekonstruktion","Fragmentierte Datei-Rekonstruktion",{"depth":47,"slug":283,"text":284},"timestamp-manipulation-und--analyse","Timestamp-Manipulation und -Analyse",{"depth":54,"slug":286,"text":287},"macb-timeline-erstellung","MACB-Timeline-Erstellung",{"depth":54,"slug":289,"text":290},"timestamp-manipulation-detection","Timestamp-Manipulation-Detection",{"depth":47,"slug":292,"text":293},"häufige-herausforderungen-und-lösungsansätze","Häufige Herausforderungen und Lösungsansätze",{"depth":54,"slug":295,"text":296},"performance-optimierung-bei-großen-images","Performance-Optimierung bei großen Images",{"depth":54,"slug":298,"text":299},"verschlüsselte-container-und-volumes","Verschlüsselte Container und Volumes",{"depth":54,"slug":301,"text":302},"anti-forensik-techniken-erkennen","Anti-Forensik-Techniken erkennen",{"depth":47,"slug":304,"text":305},"tool-integration-und-workflows","Tool-Integration und Workflows",{"depth":54,"slug":307,"text":308},"autopsy-integration","Autopsy-Integration",{"depth":54,"slug":310,"text":311},"tsk-kommandozeilen-pipeline","TSK-Kommandozeilen-Pipeline",{"depth":47,"slug":313,"text":314},"best-practices-und-methodologie","Best Practices und Methodologie",{"depth":54,"slug":316,"text":317},"dokumentation-und-chain-of-custody","Dokumentation und Chain of Custody",{"depth":54,"slug":319,"text":320},"qualitätssicherung","Qualitätssicherung",{"depth":54,"slug":322,"text":323},"rechtliche-aspekte","Rechtliche Aspekte",{"depth":47,"slug":166,"text":167},{"depth":54,"slug":326,"text":327},"spezialisierte-tools","Spezialisierte Tools",{"depth":54,"slug":329,"text":330},"fortgeschrittene-techniken","Fortgeschrittene Techniken",{"depth":54,"slug":332,"text":333},"continuous-learning","Continuous Learning",[],[],{"title":179,"description":180,"author":18,"last_updated":337,"difficulty":189,"categories":338,"tags":339,"tool_name":182,"related_tools":340,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,192,193],[195,196,197,198,199,200,201,202,203,204,205,206],[184,185,186,187,188],[],"concept-file-system-storage-forensics.md","concept-hash-functions",{"id":343,"data":345,"body":366,"filePath":367,"digest":368,"rendered":369,"legacyId":489},{"title":346,"description":347,"last_updated":348,"tool_name":349,"related_tools":350,"author":18,"difficulty":19,"categories":351,"tags":353,"published":34,"gated_content":35},"Hash-Funktionen und digitale Signaturen: Grundlagen der digitalen Beweissicherung","Umfassender Leitfaden zu kryptographischen Hash-Funktionen, digitalen Signaturen und deren praktischer Anwendung in der digitalen Forensik für Integritätsprüfung und Beweissicherung",["Date","2025-08-10T00:00:00.000Z"],"Hash Functions & Digital Signatures",[],[191,192,352],"case-study",[354,355,26,356,357,358,359,360,361,362,363,364,365],"hashing","integrity-check","standards-compliant","deduplication","known-bad-detection","fuzzy-hashing","digital-signatures","timestamping","blockchain-evidence","md5","sha256","ssdeep","# Hash-Funktionen und digitale Signaturen: Grundlagen der digitalen Beweissicherung\n\nHash-Funktionen und digitale Signaturen bilden das fundamentale Rückgrat der digitalen Forensik. Sie gewährleisten die Integrität von Beweismitteln, ermöglichen die Authentifizierung von Daten und sind essentiell für die rechtssichere Dokumentation forensischer Untersuchungen.\n\n## Was sind kryptographische Hash-Funktionen?\n\nEine kryptographische Hash-Funktion ist ein mathematisches Verfahren, das aus beliebig großen Eingabedaten einen festen, eindeutigen \"Fingerabdruck\" (Hash-Wert) erzeugt. Dieser Wert verändert sich drastisch, wenn auch nur ein einzelnes Bit der Eingabe modifiziert wird.\n\n### Eigenschaften einer kryptographischen Hash-Funktion\n\n**Einwegfunktion (One-Way Function)**\n- Aus dem Hash-Wert kann nicht auf die ursprünglichen Daten geschlossen werden\n- Mathematisch praktisch irreversibel\n\n**Determinismus**\n- Identische Eingabe erzeugt immer identischen Hash-Wert\n- Reproduzierbare Ergebnisse für forensische Dokumentation\n\n**Kollisionsresistenz**\n- Extrem schwierig, zwei verschiedene Eingaben zu finden, die denselben Hash erzeugen\n- Gewährleistet Eindeutigkeit in forensischen Anwendungen\n\n**Lawineneffekt**\n- Minimale Änderung der Eingabe führt zu völlig anderem Hash-Wert\n- Erkennung von Manipulationen\n\n## Wichtige Hash-Algorithmen in der Forensik\n\n### MD5 (Message Digest Algorithm 5)\n```bash\n# MD5-Hash berechnen\nmd5sum evidence.dd\n# Output: 5d41402abc4b2a76b9719d911017c592 evidence.dd\n```\n\n**Eigenschaften:**\n- 128-Bit Hash-Wert (32 Hexadezimal-Zeichen)\n- Entwickelt 1991, kryptographisch gebrochen seit 2004\n- **Nicht mehr sicher**, aber weit verbreitet in Legacy-Systemen\n- Kollisionen sind praktisch erzeugbar\n\n**Forensische Relevanz:**\n- Noch in vielen bestehenden Systemen verwendet\n- Für forensische Zwecke nur bei bereits vorhandenen MD5-Hashes\n- Niemals für neue forensische Implementierungen verwenden\n\n### SHA-1 (Secure Hash Algorithm 1)\n```bash\n# SHA-1-Hash berechnen\nsha1sum evidence.dd\n# Output: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d evidence.dd\n```\n\n**Eigenschaften:**\n- 160-Bit Hash-Wert (40 Hexadezimal-Zeichen)\n- Entwickelt von NSA, standardisiert 1995\n- **Deprecated seit 2017** aufgrund praktischer Kollisionsangriffe\n- SHAttered-Angriff bewies Schwachstellen 2017\n\n### SHA-2-Familie (SHA-256, SHA-512)\n```bash\n# SHA-256-Hash berechnen\nsha256sum evidence.dd\n# Output: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 evidence.dd\n\n# SHA-512-Hash berechnen\nsha512sum evidence.dd\n```\n\n**SHA-256 Eigenschaften:**\n- 256-Bit Hash-Wert (64 Hexadezimal-Zeichen)\n- Aktueller Standard für forensische Anwendungen\n- NIST-approved, FIPS 180-4 konform\n- Keine bekannten praktischen Angriffe\n\n**SHA-512 Eigenschaften:**\n- 512-Bit Hash-Wert (128 Hexadezimal-Zeichen)\n- Höhere Sicherheit, aber größerer Hash-Wert\n- Optimal für hochsensible Ermittlungen\n\n### SHA-3 (Keccak)\n- Neuester Standard (seit 2015)\n- Andere mathematische Grundlage als SHA-2\n- Zukünftiger Standard bei SHA-2-Kompromittierung\n\n## Forensische Anwendungen von Hash-Funktionen\n\n### 1. Datenträger-Imaging und Verifikation\n\n**Vor dem Imaging:**\n```bash\n# Original-Datenträger hashen\nsha256sum /dev/sdb > original_hash.txt\n```\n\n**Nach dem Imaging:**\n```bash\n# Image-Datei hashen\nsha256sum evidence.dd > image_hash.txt\n\n# Vergleichen\ndiff original_hash.txt image_hash.txt\n```\n\n**Best Practice:**\n- Immer mehrere Hash-Algorithmen verwenden (SHA-256 + SHA-512)\n- Hash-Berechnung vor, während und nach dem Imaging\n- Dokumentation in Chain-of-Custody-Protokoll\n\n### 2. Deduplizierung mit Hash-Sets\n\nHash-Sets ermöglichen die Identifikation bekannter Dateien zur Effizienzsteigerung:\n\n**NSRL (National Software Reference Library)**\n```bash\n# NSRL-Hash-Set laden\nautopsy --load-hashset /path/to/nsrl/NSRLFile.txt\n\n# Bekannte Dateien ausschließen\nhashdeep -s -e nsrl_hashes.txt /evidence/mount/\n```\n\n**Eigene Hash-Sets erstellen:**\n```bash\n# Hash-Set von bekannten guten Dateien\nhashdeep -r /clean_system/ > clean_system_hashes.txt\n\n# Vergleich mit verdächtigem System\nhashdeep -s -e clean_system_hashes.txt /suspect_system/\n```\n\n### 3. Known-Bad-Erkennung\n\n**Malware-Hash-Datenbanken:**\n- VirusTotal API-Integration\n- Threat Intelligence Feeds\n- Custom IoC-Listen\n\n```python\n# Beispiel: Datei-Hash gegen Known-Bad-Liste prüfen\nimport hashlib\n\ndef check_malware_hash(filepath, malware_hashes):\n with open(filepath, 'rb') as f:\n file_hash = hashlib.sha256(f.read()).hexdigest()\n \n if file_hash in malware_hashes:\n return True, file_hash\n return False, file_hash\n```\n\n### 4. Fuzzy Hashing mit ssdeep\n\nFuzzy Hashing erkennt ähnliche, aber nicht identische Dateien:\n\n```bash\n# ssdeep-Hash berechnen\nssdeep malware.exe\n# Output: 768:gQA1M2Ua3QqQm8+1QV7Q8+1QG8+1Q:gQ1Ma3qmP1QV7P1QGP1Q\n\n# Ähnlichkeit zwischen Dateien prüfen\nssdeep -d malware_v1.exe malware_v2.exe\n# Output: 85 (85% Ähnlichkeit)\n```\n\n**Anwendungsfälle:**\n- Erkennung von Malware-Varianten\n- Identifikation modifizierter Dokumente\n- Versionsverfolgung von Dateien\n\n### 5. Timeline-Analyse und Integritätsprüfung\n\n```bash\n# Erweiterte Metadaten mit Hashes\nfind /evidence/mount -type f -exec stat -c \"%Y %n\" {} \\; | while read timestamp file; do\n hash=$(sha256sum \"$file\" | cut -d' ' -f1)\n echo \"$timestamp $hash $file\"\ndone > timeline_with_hashes.txt\n```\n\n## Digitale Signaturen in der Forensik\n\nDigitale Signaturen verwenden asymmetrische Kryptographie zur Authentifizierung und Integritätssicherung.\n\n### Funktionsweise digitaler Signaturen\n\n1. **Erstellung:**\n - Hash des Dokuments wird mit privatem Schlüssel verschlüsselt\n - Verschlüsselter Hash = digitale Signatur\n\n2. **Verifikation:**\n - Signatur wird mit öffentlichem Schlüssel entschlüsselt\n - Entschlüsselter Hash wird mit neuem Hash des Dokuments verglichen\n\n### Certificate Chain Analysis\n\n**X.509-Zertifikate untersuchen:**\n```bash\n# Zertifikat-Details anzeigen\nopenssl x509 -in certificate.crt -text -noout\n\n# Zertifikatskette verfolgen\nopenssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt certificate.crt\n```\n\n**Forensische Relevanz:**\n- Authentizität von Software-Downloads\n- Erkennung gefälschter Zertifikate\n- APT-Gruppenattribution durch Code-Signing-Zertifikate\n\n### Timestamping für Chain-of-Custody\n\n**RFC 3161-Zeitstempel:**\n```bash\n# Zeitstempel für Beweisdatei erstellen\nopenssl ts -query -data evidence.dd -no_nonce -sha256 -out request.tsq\nopenssl ts -verify -in response.tsr -data evidence.dd -CAfile tsa-ca.crt\n```\n\n**Blockchain-basierte Zeitstempel:**\n- Unveränderliche Zeitstempel in öffentlichen Blockchains\n- OriginStamp, OpenTimestamps für forensische Anwendungen\n\n## Praktische Tools und Integration\n\n### Autopsy Integration\n```xml\n\u003C!-- Autopsy Hash Database Configuration -->\n\u003ChashDb>\n \u003CdbType>NSRL\u003C/dbType>\n \u003CdbPath>/usr/share/autopsy/nsrl/NSRLFile.txt\u003C/dbPath>\n \u003CsearchDuringIngest>true\u003C/searchDuringIngest>\n\u003C/hashDb>\n```\n\n### YARA-Integration mit Hash-Regeln\n```yara\nrule Malware_Hash_Detection {\n condition:\n hash.sha256(0, filesize) == \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"\n}\n```\n\n### FTK Imager Hash-Verifikation\n- Automatische Hash-Berechnung während Imaging\n- MD5, SHA-1, SHA-256 parallel\n- Verify-Funktion für Image-Integrität\n\n## Advanced Topics\n\n### Rainbow Table Attacks\n**Funktionsweise:**\n- Vorberechnete Hash-Tabellen für Passwort-Cracking\n- Trade-off zwischen Speicher und Rechenzeit\n- Effektiv gegen unsalted Hashes\n\n**Forensische Anwendung:**\n```bash\n# Hashcat mit Rainbow Tables\nhashcat -m 0 -a 0 hashes.txt wordlist.txt\n\n# John the Ripper mit Rainbow Tables\njohn --format=NT --wordlist=rockyou.txt ntlm_hashes.txt\n```\n\n### Blockchain Evidence Management\n**Konzept:**\n- Unveränderliche Speicherung von Hash-Werten\n- Distributed Ledger für Chain-of-Custody\n- Smart Contracts für automatisierte Verifikation\n\n**Implementierung:**\n```solidity\n// Ethereum Smart Contract für Evidence Hashes\ncontract EvidenceRegistry {\n mapping(bytes32 => bool) public evidenceHashes;\n \n function registerEvidence(bytes32 _hash) public {\n evidenceHashes[_hash] = true;\n }\n}\n```\n\n## Häufige Probleme und Lösungsansätze\n\n### Hash-Kollisionen\n**Problem:** Zwei verschiedene Dateien mit identischem Hash\n**Lösung:**\n- Verwendung mehrerer Hash-Algorithmen\n- Sichere Algorithmen (SHA-256+) verwenden\n- Bei Verdacht: Bitweise Vergleich der Originaldateien\n\n### Performance bei großen Datenmengen\n**Problem:** Langsame Hash-Berechnung bei TB-großen Images\n**Optimierung:**\n```bash\n# Parallele Hash-Berechnung\nhashdeep -r -j 8 /large_dataset/ # 8 Threads\n\n# Hardware-beschleunigte Hashing\nsha256sum --tag /dev/nvme0n1 # NVMe für bessere I/O\n```\n\n### Rechtliche Anforderungen\n**Problem:** Verschiedene Standards in verschiedenen Jurisdiktionen\n**Lösung:**\n- NIST-konforme Algorithmen verwenden\n- Dokumentation aller verwendeten Verfahren\n- Regelmäßige Algorithmus-Updates\n\n## Best Practices\n\n### 1. Algorithmus-Auswahl\n- **Neu:** SHA-256 oder SHA-3 verwenden\n- **Legacy:** MD5/SHA-1 nur bei vorhandenen Systemen\n- **High-Security:** SHA-512 oder SHA-3-512\n\n### 2. Dokumentation\n```text\nEvidence Hash Verification Report\n=================================\nEvidence ID: CASE-2024-001-HDD\nOriginal Hash (SHA-256): a1b2c3d4...\nImage Hash (SHA-256): a1b2c3d4...\nVerification Status: VERIFIED\nTimestamp: 2024-01-15 14:30:00 UTC\nInvestigator: John Doe\n```\n\n### 3. Redundanz\n- Mindestens zwei verschiedene Hash-Algorithmen\n- Mehrfache Verifikation zu verschiedenen Zeitpunkten\n- Verschiedene Tools für Cross-Validation\n\n### 4. Automation\n```bash\n#!/bin/bash\n# Automatisiertes Hash-Verification-Script\nEVIDENCE_FILE=\"$1\"\nLOG_FILE=\"hash_verification.log\"\n\necho \"Starting hash verification for $EVIDENCE_FILE\" >> $LOG_FILE\nMD5_HASH=$(md5sum \"$EVIDENCE_FILE\" | cut -d' ' -f1)\nSHA256_HASH=$(sha256sum \"$EVIDENCE_FILE\" | cut -d' ' -f1)\nSHA512_HASH=$(sha512sum \"$EVIDENCE_FILE\" | cut -d' ' -f1)\n\necho \"MD5: $MD5_HASH\" >> $LOG_FILE\necho \"SHA-256: $SHA256_HASH\" >> $LOG_FILE\necho \"SHA-512: $SHA512_HASH\" >> $LOG_FILE\necho \"Verification completed at $(date)\" >> $LOG_FILE\n```\n\n## Zukunftsperspektiven\n\n### Quantum-Resistant Hashing\n- Vorbereitung auf Quantum Computing\n- NIST Post-Quantum Cryptography Standards\n- Migration bestehender Systeme\n\n### AI/ML-Integration\n- Anomalie-Erkennung in Hash-Mustern\n- Automated Similarity Analysis\n- Intelligent Deduplizierung\n\nHash-Funktionen und digitale Signaturen sind und bleiben das Fundament der digitalen Forensik. Das Verständnis ihrer mathematischen Grundlagen, praktischen Anwendungen und rechtlichen Implikationen unterscheidet professionelle Forensiker von Amateuren. Mit der kontinuierlichen Weiterentwicklung der Technologie müssen auch forensische Praktiken angepasst werden, um die Integrität und Authentizität digitaler Beweise zu gewährleisten.","src/content/knowledgebase/concept-hash-functions.md","0cced77e3cc77263",{"html":370,"metadata":371},"\u003Ch1 id=\"hash-funktionen-und-digitale-signaturen-grundlagen-der-digitalen-beweissicherung\">Hash-Funktionen und digitale Signaturen: Grundlagen der digitalen Beweissicherung\u003C/h1>\n\u003Cp>Hash-Funktionen und digitale Signaturen bilden das fundamentale Rückgrat der digitalen Forensik. Sie gewährleisten die Integrität von Beweismitteln, ermöglichen die Authentifizierung von Daten und sind essentiell für die rechtssichere Dokumentation forensischer Untersuchungen.\u003C/p>\n\u003Ch2 id=\"was-sind-kryptographische-hash-funktionen\">Was sind kryptographische Hash-Funktionen?\u003C/h2>\n\u003Cp>Eine kryptographische Hash-Funktion ist ein mathematisches Verfahren, das aus beliebig großen Eingabedaten einen festen, eindeutigen “Fingerabdruck” (Hash-Wert) erzeugt. Dieser Wert verändert sich drastisch, wenn auch nur ein einzelnes Bit der Eingabe modifiziert wird.\u003C/p>\n\u003Ch3 id=\"eigenschaften-einer-kryptographischen-hash-funktion\">Eigenschaften einer kryptographischen Hash-Funktion\u003C/h3>\n\u003Cp>\u003Cstrong>Einwegfunktion (One-Way Function)\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Aus dem Hash-Wert kann nicht auf die ursprünglichen Daten geschlossen werden\u003C/li>\n\u003Cli>Mathematisch praktisch irreversibel\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Determinismus\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Identische Eingabe erzeugt immer identischen Hash-Wert\u003C/li>\n\u003Cli>Reproduzierbare Ergebnisse für forensische Dokumentation\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Kollisionsresistenz\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Extrem schwierig, zwei verschiedene Eingaben zu finden, die denselben Hash erzeugen\u003C/li>\n\u003Cli>Gewährleistet Eindeutigkeit in forensischen Anwendungen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Lawineneffekt\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Minimale Änderung der Eingabe führt zu völlig anderem Hash-Wert\u003C/li>\n\u003Cli>Erkennung von Manipulationen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"wichtige-hash-algorithmen-in-der-forensik\">Wichtige Hash-Algorithmen in der Forensik\u003C/h2>\n\u003Ch3 id=\"md5-message-digest-algorithm-5\">MD5 (Message Digest Algorithm 5)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MD5-Hash berechnen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Output: 5d41402abc4b2a76b9719d911017c592 evidence.dd\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Eigenschaften:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>128-Bit Hash-Wert (32 Hexadezimal-Zeichen)\u003C/li>\n\u003Cli>Entwickelt 1991, kryptographisch gebrochen seit 2004\u003C/li>\n\u003Cli>\u003Cstrong>Nicht mehr sicher\u003C/strong>, aber weit verbreitet in Legacy-Systemen\u003C/li>\n\u003Cli>Kollisionen sind praktisch erzeugbar\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Forensische Relevanz:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Noch in vielen bestehenden Systemen verwendet\u003C/li>\n\u003Cli>Für forensische Zwecke nur bei bereits vorhandenen MD5-Hashes\u003C/li>\n\u003Cli>Niemals für neue forensische Implementierungen verwenden\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"sha-1-secure-hash-algorithm-1\">SHA-1 (Secure Hash Algorithm 1)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SHA-1-Hash berechnen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha1sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Output: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d evidence.dd\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Eigenschaften:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>160-Bit Hash-Wert (40 Hexadezimal-Zeichen)\u003C/li>\n\u003Cli>Entwickelt von NSA, standardisiert 1995\u003C/li>\n\u003Cli>\u003Cstrong>Deprecated seit 2017\u003C/strong> aufgrund praktischer Kollisionsangriffe\u003C/li>\n\u003Cli>SHAttered-Angriff bewies Schwachstellen 2017\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"sha-2-familie-sha-256-sha-512\">SHA-2-Familie (SHA-256, SHA-512)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SHA-256-Hash berechnen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Output: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 evidence.dd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SHA-512-Hash berechnen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha512sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>SHA-256 Eigenschaften:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>256-Bit Hash-Wert (64 Hexadezimal-Zeichen)\u003C/li>\n\u003Cli>Aktueller Standard für forensische Anwendungen\u003C/li>\n\u003Cli>NIST-approved, FIPS 180-4 konform\u003C/li>\n\u003Cli>Keine bekannten praktischen Angriffe\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>SHA-512 Eigenschaften:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>512-Bit Hash-Wert (128 Hexadezimal-Zeichen)\u003C/li>\n\u003Cli>Höhere Sicherheit, aber größerer Hash-Wert\u003C/li>\n\u003Cli>Optimal für hochsensible Ermittlungen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"sha-3-keccak\">SHA-3 (Keccak)\u003C/h3>\n\u003Cul>\n\u003Cli>Neuester Standard (seit 2015)\u003C/li>\n\u003Cli>Andere mathematische Grundlage als SHA-2\u003C/li>\n\u003Cli>Zukünftiger Standard bei SHA-2-Kompromittierung\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"forensische-anwendungen-von-hash-funktionen\">Forensische Anwendungen von Hash-Funktionen\u003C/h2>\n\u003Ch3 id=\"1-datenträger-imaging-und-verifikation\">1. Datenträger-Imaging und Verifikation\u003C/h3>\n\u003Cp>\u003Cstrong>Vor dem Imaging:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Original-Datenträger hashen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/sdb\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_hash.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Nach dem Imaging:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Image-Datei hashen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> image_hash.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vergleichen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">diff\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_hash.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> image_hash.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Best Practice:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Immer mehrere Hash-Algorithmen verwenden (SHA-256 + SHA-512)\u003C/li>\n\u003Cli>Hash-Berechnung vor, während und nach dem Imaging\u003C/li>\n\u003Cli>Dokumentation in Chain-of-Custody-Protokoll\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"2-deduplizierung-mit-hash-sets\">2. Deduplizierung mit Hash-Sets\u003C/h3>\n\u003Cp>Hash-Sets ermöglichen die Identifikation bekannter Dateien zur Effizienzsteigerung:\u003C/p>\n\u003Cp>\u003Cstrong>NSRL (National Software Reference Library)\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># NSRL-Hash-Set laden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">autopsy\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --load-hashset\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/nsrl/NSRLFile.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Bekannte Dateien ausschließen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hashdeep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -s\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> nsrl_hashes.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /evidence/mount/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Eigene Hash-Sets erstellen:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash-Set von bekannten guten Dateien\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hashdeep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /clean_system/\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clean_system_hashes.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vergleich mit verdächtigem System\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hashdeep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -s\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clean_system_hashes.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /suspect_system/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-known-bad-erkennung\">3. Known-Bad-Erkennung\u003C/h3>\n\u003Cp>\u003Cstrong>Malware-Hash-Datenbanken:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>VirusTotal API-Integration\u003C/li>\n\u003Cli>Threat Intelligence Feeds\u003C/li>\n\u003Cli>Custom IoC-Listen\u003C/li>\n\u003C/ul>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Beispiel: Datei-Hash gegen Known-Bad-Liste prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> check_malware_hash\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(filepath, malware_hashes):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(filepath, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'rb'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> file_hash \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib.sha256(f.read()).hexdigest()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_hash \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> malware_hashes:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> True\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, file_hash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, file_hash\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"4-fuzzy-hashing-mit-ssdeep\">4. Fuzzy Hashing mit ssdeep\u003C/h3>\n\u003Cp>Fuzzy Hashing erkennt ähnliche, aber nicht identische Dateien:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ssdeep-Hash berechnen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">ssdeep\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> malware.exe\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Output: 768:gQA1M2Ua3QqQm8+1QV7Q8+1QG8+1Q:gQ1Ma3qmP1QV7P1QGP1Q\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ähnlichkeit zwischen Dateien prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">ssdeep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> malware_v1.exe\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> malware_v2.exe\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Output: 85 (85% Ähnlichkeit)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Anwendungsfälle:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Erkennung von Malware-Varianten\u003C/li>\n\u003Cli>Identifikation modifizierter Dokumente\u003C/li>\n\u003Cli>Versionsverfolgung von Dateien\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"5-timeline-analyse-und-integritätsprüfung\">5. Timeline-Analyse und Integritätsprüfung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Erweiterte Metadaten mit Hashes\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">find\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /evidence/mount\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -type\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> f\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -exec\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> stat\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"%Y %n\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> {}\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\;\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#F97583\"> while\u003C/span>\u003Cspan style=\"color:#79B8FF\"> read\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timestamp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> file\u003C/span>\u003Cspan style=\"color:#E1E4E8\">; \u003C/span>\u003Cspan style=\"color:#F97583\">do\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hash\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$file\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $hash\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $file\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">done\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_with_hashes.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"digitale-signaturen-in-der-forensik\">Digitale Signaturen in der Forensik\u003C/h2>\n\u003Cp>Digitale Signaturen verwenden asymmetrische Kryptographie zur Authentifizierung und Integritätssicherung.\u003C/p>\n\u003Ch3 id=\"funktionsweise-digitaler-signaturen\">Funktionsweise digitaler Signaturen\u003C/h3>\n\u003Col>\n\u003Cli>\n\u003Cp>\u003Cstrong>Erstellung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Hash des Dokuments wird mit privatem Schlüssel verschlüsselt\u003C/li>\n\u003Cli>Verschlüsselter Hash = digitale Signatur\u003C/li>\n\u003C/ul>\n\u003C/li>\n\u003Cli>\n\u003Cp>\u003Cstrong>Verifikation:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Signatur wird mit öffentlichem Schlüssel entschlüsselt\u003C/li>\n\u003Cli>Entschlüsselter Hash wird mit neuem Hash des Dokuments verglichen\u003C/li>\n\u003C/ul>\n\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"certificate-chain-analysis\">Certificate Chain Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>X.509-Zertifikate untersuchen:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zertifikat-Details anzeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">openssl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> x509\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -in\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> certificate.crt\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -text\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -noout\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zertifikatskette verfolgen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">openssl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> verify\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -CAfile\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ca-bundle.crt\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -untrusted\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> intermediate.crt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> certificate.crt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Forensische Relevanz:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Authentizität von Software-Downloads\u003C/li>\n\u003Cli>Erkennung gefälschter Zertifikate\u003C/li>\n\u003Cli>APT-Gruppenattribution durch Code-Signing-Zertifikate\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"timestamping-für-chain-of-custody\">Timestamping für Chain-of-Custody\u003C/h3>\n\u003Cp>\u003Cstrong>RFC 3161-Zeitstempel:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zeitstempel für Beweisdatei erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">openssl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ts\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -query\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -no_nonce\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -sha256\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -out\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> request.tsq\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">openssl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ts\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -verify\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -in\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> response.tsr\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.dd\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -CAfile\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tsa-ca.crt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Blockchain-basierte Zeitstempel:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Unveränderliche Zeitstempel in öffentlichen Blockchains\u003C/li>\n\u003Cli>OriginStamp, OpenTimestamps für forensische Anwendungen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"praktische-tools-und-integration\">Praktische Tools und Integration\u003C/h2>\n\u003Ch3 id=\"autopsy-integration\">Autopsy Integration\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"xml\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"><!-- Autopsy Hash Database Configuration -->\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"><\u003C/span>\u003Cspan style=\"color:#85E89D\">hashDb\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> <\u003C/span>\u003Cspan style=\"color:#85E89D\">dbType\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>NSRL</\u003C/span>\u003Cspan style=\"color:#85E89D\">dbType\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> <\u003C/span>\u003Cspan style=\"color:#85E89D\">dbPath\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>/usr/share/autopsy/nsrl/NSRLFile.txt</\u003C/span>\u003Cspan style=\"color:#85E89D\">dbPath\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> <\u003C/span>\u003Cspan style=\"color:#85E89D\">searchDuringIngest\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>true</\u003C/span>\u003Cspan style=\"color:#85E89D\">searchDuringIngest\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"></\u003C/span>\u003Cspan style=\"color:#85E89D\">hashDb\u003C/span>\u003Cspan style=\"color:#E1E4E8\">>\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"yara-integration-mit-hash-regeln\">YARA-Integration mit Hash-Regeln\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>rule Malware_Hash_Detection {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> condition:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> hash.sha256(0, filesize) == \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"ftk-imager-hash-verifikation\">FTK Imager Hash-Verifikation\u003C/h3>\n\u003Cul>\n\u003Cli>Automatische Hash-Berechnung während Imaging\u003C/li>\n\u003Cli>MD5, SHA-1, SHA-256 parallel\u003C/li>\n\u003Cli>Verify-Funktion für Image-Integrität\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"advanced-topics\">Advanced Topics\u003C/h2>\n\u003Ch3 id=\"rainbow-table-attacks\">Rainbow Table Attacks\u003C/h3>\n\u003Cp>\u003Cstrong>Funktionsweise:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Vorberechnete Hash-Tabellen für Passwort-Cracking\u003C/li>\n\u003Cli>Trade-off zwischen Speicher und Rechenzeit\u003C/li>\n\u003Cli>Effektiv gegen unsalted Hashes\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Forensische Anwendung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hashcat mit Rainbow Tables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hashcat\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -m\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -a\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hashes.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> wordlist.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># John the Ripper mit Rainbow Tables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">john\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --format=NT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --wordlist=rockyou.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ntlm_hashes.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"blockchain-evidence-management\">Blockchain Evidence Management\u003C/h3>\n\u003Cp>\u003Cstrong>Konzept:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Unveränderliche Speicherung von Hash-Werten\u003C/li>\n\u003Cli>Distributed Ledger für Chain-of-Custody\u003C/li>\n\u003Cli>Smart Contracts für automatisierte Verifikation\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Implementierung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"solidity\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">// Ethereum Smart Contract für Evidence Hashes\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">contract\u003C/span>\u003Cspan style=\"color:#B392F0\"> EvidenceRegistry\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> mapping\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">bytes32\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> bool\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">public\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> evidenceHashes;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> function\u003C/span>\u003Cspan style=\"color:#B392F0\"> registerEvidence\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">bytes32\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _hash) \u003C/span>\u003Cspan style=\"color:#F97583\">public\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> evidenceHashes[_hash] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> true\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-probleme-und-lösungsansätze\">Häufige Probleme und Lösungsansätze\u003C/h2>\n\u003Ch3 id=\"hash-kollisionen\">Hash-Kollisionen\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> Zwei verschiedene Dateien mit identischem Hash\n\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Verwendung mehrerer Hash-Algorithmen\u003C/li>\n\u003Cli>Sichere Algorithmen (SHA-256+) verwenden\u003C/li>\n\u003Cli>Bei Verdacht: Bitweise Vergleich der Originaldateien\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"performance-bei-großen-datenmengen\">Performance bei großen Datenmengen\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> Langsame Hash-Berechnung bei TB-großen Images\n\u003Cstrong>Optimierung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Parallele Hash-Berechnung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">hashdeep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -j\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 8\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /large_dataset/\u003C/span>\u003Cspan style=\"color:#6A737D\"> # 8 Threads\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hardware-beschleunigte Hashing\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --tag\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/nvme0n1\u003C/span>\u003Cspan style=\"color:#6A737D\"> # NVMe für bessere I/O\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"rechtliche-anforderungen\">Rechtliche Anforderungen\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> Verschiedene Standards in verschiedenen Jurisdiktionen\n\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>NIST-konforme Algorithmen verwenden\u003C/li>\n\u003Cli>Dokumentation aller verwendeten Verfahren\u003C/li>\n\u003Cli>Regelmäßige Algorithmus-Updates\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Ch3 id=\"1-algorithmus-auswahl\">1. Algorithmus-Auswahl\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Neu:\u003C/strong> SHA-256 oder SHA-3 verwenden\u003C/li>\n\u003Cli>\u003Cstrong>Legacy:\u003C/strong> MD5/SHA-1 nur bei vorhandenen Systemen\u003C/li>\n\u003Cli>\u003Cstrong>High-Security:\u003C/strong> SHA-512 oder SHA-3-512\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"2-dokumentation\">2. Dokumentation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"text\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Evidence Hash Verification Report\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>=================================\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Evidence ID: CASE-2024-001-HDD\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Original Hash (SHA-256): a1b2c3d4...\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Image Hash (SHA-256): a1b2c3d4...\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Verification Status: VERIFIED\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Timestamp: 2024-01-15 14:30:00 UTC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>Investigator: John Doe\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-redundanz\">3. Redundanz\u003C/h3>\n\u003Cul>\n\u003Cli>Mindestens zwei verschiedene Hash-Algorithmen\u003C/li>\n\u003Cli>Mehrfache Verifikation zu verschiedenen Zeitpunkten\u003C/li>\n\u003Cli>Verschiedene Tools für Cross-Validation\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"4-automation\">4. Automation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/bin/bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Automatisiertes Hash-Verification-Script\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">EVIDENCE_FILE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#79B8FF\">$1\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">LOG_FILE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"hash_verification.log\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Starting hash verification for \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$EVIDENCE_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_FILE\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">MD5_HASH\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$EVIDENCE_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">SHA256_HASH\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$EVIDENCE_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">SHA512_HASH\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha512sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$EVIDENCE_FILE\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"MD5: \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$MD5_HASH\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_FILE\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"SHA-256: \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$SHA256_HASH\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_FILE\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"SHA-512: \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$SHA512_HASH\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_FILE\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Verification completed at $(\u003C/span>\u003Cspan style=\"color:#B392F0\">date\u003C/span>\u003Cspan style=\"color:#9ECBFF\">)\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_FILE\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"zukunftsperspektiven\">Zukunftsperspektiven\u003C/h2>\n\u003Ch3 id=\"quantum-resistant-hashing\">Quantum-Resistant Hashing\u003C/h3>\n\u003Cul>\n\u003Cli>Vorbereitung auf Quantum Computing\u003C/li>\n\u003Cli>NIST Post-Quantum Cryptography Standards\u003C/li>\n\u003Cli>Migration bestehender Systeme\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"aiml-integration\">AI/ML-Integration\u003C/h3>\n\u003Cul>\n\u003Cli>Anomalie-Erkennung in Hash-Mustern\u003C/li>\n\u003Cli>Automated Similarity Analysis\u003C/li>\n\u003Cli>Intelligent Deduplizierung\u003C/li>\n\u003C/ul>\n\u003Cp>Hash-Funktionen und digitale Signaturen sind und bleiben das Fundament der digitalen Forensik. Das Verständnis ihrer mathematischen Grundlagen, praktischen Anwendungen und rechtlichen Implikationen unterscheidet professionelle Forensiker von Amateuren. Mit der kontinuierlichen Weiterentwicklung der Technologie müssen auch forensische Praktiken angepasst werden, um die Integrität und Authentizität digitaler Beweise zu gewährleisten.\u003C/p>",{"headings":372,"localImagePaths":482,"remoteImagePaths":483,"frontmatter":484,"imagePaths":488},[373,375,378,381,384,387,390,393,396,399,402,405,408,411,414,417,420,423,426,429,431,434,437,440,443,446,449,452,455,458,461,464,467,470,473,476,479],{"depth":44,"slug":374,"text":346},"hash-funktionen-und-digitale-signaturen-grundlagen-der-digitalen-beweissicherung",{"depth":47,"slug":376,"text":377},"was-sind-kryptographische-hash-funktionen","Was sind kryptographische Hash-Funktionen?",{"depth":54,"slug":379,"text":380},"eigenschaften-einer-kryptographischen-hash-funktion","Eigenschaften einer kryptographischen Hash-Funktion",{"depth":47,"slug":382,"text":383},"wichtige-hash-algorithmen-in-der-forensik","Wichtige Hash-Algorithmen in der Forensik",{"depth":54,"slug":385,"text":386},"md5-message-digest-algorithm-5","MD5 (Message Digest Algorithm 5)",{"depth":54,"slug":388,"text":389},"sha-1-secure-hash-algorithm-1","SHA-1 (Secure Hash Algorithm 1)",{"depth":54,"slug":391,"text":392},"sha-2-familie-sha-256-sha-512","SHA-2-Familie (SHA-256, SHA-512)",{"depth":54,"slug":394,"text":395},"sha-3-keccak","SHA-3 (Keccak)",{"depth":47,"slug":397,"text":398},"forensische-anwendungen-von-hash-funktionen","Forensische Anwendungen von Hash-Funktionen",{"depth":54,"slug":400,"text":401},"1-datenträger-imaging-und-verifikation","1. Datenträger-Imaging und Verifikation",{"depth":54,"slug":403,"text":404},"2-deduplizierung-mit-hash-sets","2. Deduplizierung mit Hash-Sets",{"depth":54,"slug":406,"text":407},"3-known-bad-erkennung","3. Known-Bad-Erkennung",{"depth":54,"slug":409,"text":410},"4-fuzzy-hashing-mit-ssdeep","4. Fuzzy Hashing mit ssdeep",{"depth":54,"slug":412,"text":413},"5-timeline-analyse-und-integritätsprüfung","5. Timeline-Analyse und Integritätsprüfung",{"depth":47,"slug":415,"text":416},"digitale-signaturen-in-der-forensik","Digitale Signaturen in der Forensik",{"depth":54,"slug":418,"text":419},"funktionsweise-digitaler-signaturen","Funktionsweise digitaler Signaturen",{"depth":54,"slug":421,"text":422},"certificate-chain-analysis","Certificate Chain Analysis",{"depth":54,"slug":424,"text":425},"timestamping-für-chain-of-custody","Timestamping für Chain-of-Custody",{"depth":47,"slug":427,"text":428},"praktische-tools-und-integration","Praktische Tools und Integration",{"depth":54,"slug":307,"text":430},"Autopsy Integration",{"depth":54,"slug":432,"text":433},"yara-integration-mit-hash-regeln","YARA-Integration mit Hash-Regeln",{"depth":54,"slug":435,"text":436},"ftk-imager-hash-verifikation","FTK Imager Hash-Verifikation",{"depth":47,"slug":438,"text":439},"advanced-topics","Advanced Topics",{"depth":54,"slug":441,"text":442},"rainbow-table-attacks","Rainbow Table Attacks",{"depth":54,"slug":444,"text":445},"blockchain-evidence-management","Blockchain Evidence Management",{"depth":47,"slug":447,"text":448},"häufige-probleme-und-lösungsansätze","Häufige Probleme und Lösungsansätze",{"depth":54,"slug":450,"text":451},"hash-kollisionen","Hash-Kollisionen",{"depth":54,"slug":453,"text":454},"performance-bei-großen-datenmengen","Performance bei großen Datenmengen",{"depth":54,"slug":456,"text":457},"rechtliche-anforderungen","Rechtliche Anforderungen",{"depth":47,"slug":459,"text":460},"best-practices","Best Practices",{"depth":54,"slug":462,"text":463},"1-algorithmus-auswahl","1. Algorithmus-Auswahl",{"depth":54,"slug":465,"text":466},"2-dokumentation","2. Dokumentation",{"depth":54,"slug":468,"text":469},"3-redundanz","3. Redundanz",{"depth":54,"slug":471,"text":472},"4-automation","4. Automation",{"depth":47,"slug":474,"text":475},"zukunftsperspektiven","Zukunftsperspektiven",{"depth":54,"slug":477,"text":478},"quantum-resistant-hashing","Quantum-Resistant Hashing",{"depth":54,"slug":480,"text":481},"aiml-integration","AI/ML-Integration",[],[],{"title":346,"description":347,"author":18,"last_updated":485,"difficulty":19,"categories":486,"tags":487,"tool_name":349,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,192,352],[354,355,26,356,357,358,359,360,361,362,363,364,365],[],"concept-hash-functions.md","concept-memory-forensics",{"id":490,"data":492,"body":516,"filePath":517,"digest":518,"rendered":519,"legacyId":675},{"title":493,"description":494,"last_updated":495,"related_tools":496,"author":18,"difficulty":19,"categories":501,"tags":504,"published":34,"gated_content":35},"Memory Forensics und Process Analysis: Advanced Malware Detection in Volatile Memory","Umfassender Leitfaden zur forensischen Analyse von Arbeitsspeicher-Strukturen, Process-Injection-Techniken und Advanced-Malware-Detection. Von Kernel-Analysis bis Cross-Platform-Memory-Forensik.",["Date","2025-08-10T00:00:00.000Z"],[497,498,499,500],"Volatility 3","Rekall","WinDbg","GDB",[191,502,503],"advanced-techniques","malware-investigation",[505,506,507,508,509,510,511,512,513,514,515],"memory-structures","process-injection","rootkit-detection","kernel-analysis","address-space","live-analysis","malware-hiding","system-internals","volatility","dll-hollowing","process-ghosting","# Memory Forensics und Process Analysis: Advanced Malware Detection in Volatile Memory\n\nMemory Forensics stellt eine der komplexesten und gleichzeitig aufschlussreichsten Disziplinen der digitalen Forensik dar. Während traditionelle Festplatten-Forensik auf persistente Daten zugreift, ermöglicht die Analyse des Arbeitsspeichers Einblicke in aktive Prozesse, verschleierte Malware und Angriffstechniken, die keine Spuren auf der Festplatte hinterlassen.\n\n## Einführung in Memory Forensics\n\n### Was ist Memory Forensics?\n\nMemory Forensics ist die Wissenschaft der Analyse von Computer-Arbeitsspeicher (RAM) zur Aufdeckung digitaler Artefakte. Im Gegensatz zur traditionellen Festplatten-Forensik konzentriert sich Memory Forensics auf volatile Daten, die nur temporär im Speicher existieren.\n\n**Zentrale Vorteile:**\n- Erkennung von Malware, die nur im Speicher residiert\n- Aufdeckung von Process-Injection und Code-Hiding-Techniken\n- Analyse von verschlüsselten oder obfuscierten Prozessen\n- Rekonstruktion von Netzwerkverbindungen und Benutzeraktivitäten\n- Untersuchung von Kernel-Level-Rootkits\n\n### Virtual Memory Layout verstehen\n\nDas Virtual Memory System moderner Betriebssysteme bildet die Grundlage für Memory Forensics. Jeder Prozess erhält einen eigenen virtuellen Adressraum, der in verschiedene Segmente unterteilt ist:\n\n**Windows Virtual Memory Layout:**\n```\n0x00000000 - 0x7FFFFFFF: User Space (2GB)\n0x80000000 - 0xFFFFFFFF: Kernel Space (2GB)\n\nUser Space Segmente:\n- 0x00000000 - 0x0000FFFF: NULL Pointer Region\n- 0x00010000 - 0x7FFEFFFF: User Code und Data\n- 0x7FFF0000 - 0x7FFFFFFF: System DLLs (ntdll.dll)\n```\n\n**Linux Virtual Memory Layout:**\n```\n0x00000000 - 0xBFFFFFFF: User Space (3GB)\n0xC0000000 - 0xFFFFFFFF: Kernel Space (1GB)\n\nUser Space Segmente:\n- Text Segment: Executable Code\n- Data Segment: Initialized Variables\n- BSS Segment: Uninitialized Variables\n- Heap: Dynamic Memory Allocation\n- Stack: Function Calls und Local Variables\n```\n\n## Process Internals und Strukturen\n\n### Process Control Blocks (PCB)\n\nJeder Prozess wird durch eine zentrale Datenstruktur repräsentiert, die alle relevanten Informationen enthält:\n\n**Windows EPROCESS Structure:**\n```c\ntypedef struct _EPROCESS {\n KPROCESS Pcb; // Process Control Block\n EX_PUSH_LOCK ProcessLock; // Process Lock\n LARGE_INTEGER CreateTime; // Creation Timestamp\n LARGE_INTEGER ExitTime; // Exit Timestamp\n EX_RUNDOWN_REF RundownProtect; // Rundown Protection\n HANDLE UniqueProcessId; // Process ID (PID)\n LIST_ENTRY ActiveProcessLinks; // Double Linked List\n RTL_AVL_TREE VadRoot; // Virtual Address Descriptors\n // ... weitere Felder\n} EPROCESS, *PEPROCESS;\n```\n\n**Wichtige Felder für Forensik:**\n- `ImageFileName`: Name der ausführbaren Datei\n- `Peb`: Process Environment Block Pointer\n- `VadRoot`: Virtual Address Descriptor Tree\n- `Token`: Security Token des Prozesses\n- `HandleTable`: Tabelle geöffneter Handles\n\n### Thread Control Blocks (TCB)\n\nThreads sind die ausführbaren Einheiten innerhalb eines Prozesses:\n\n**Windows ETHREAD Structure:**\n```c\ntypedef struct _ETHREAD {\n KTHREAD Tcb; // Thread Control Block\n LARGE_INTEGER CreateTime; // Thread Creation Time\n LIST_ENTRY ThreadListEntry; // Process Thread List\n EX_RUNDOWN_REF RundownProtect; // Rundown Protection\n PEPROCESS ThreadsProcess; // Parent Process Pointer\n PVOID StartAddress; // Thread Start Address\n // ... weitere Felder\n} ETHREAD, *PETHREAD;\n```\n\n## Advanced Malware Detection Techniken\n\n### Process Injection Erkennung\n\nProcess Injection ist eine häufig verwendete Technik zur Umgehung von Security-Lösungen. Verschiedene Injection-Methoden erfordern spezifische Erkennungsansätze:\n\n#### DLL Injection Detection\n\n**Erkennungsmerkmale:**\n```bash\n# Volatility 3 Command\npython vol.py -f memory.dmp windows.dlllist.DllList --pid 1234\n\n# Verdächtige Indikatoren:\n# - Ungewöhnliche DLL-Pfade\n# - DLLs ohne digitale Signatur\n# - Temporäre oder versteckte Pfade\n# - Diskrepanzen zwischen Image und Memory\n```\n\n**Manuelle Verifikation:**\n```python\n# Pseudocode für DLL-Validierung\ndef validate_dll_integrity(dll_base, dll_path):\n memory_hash = calculate_memory_hash(dll_base)\n disk_hash = calculate_file_hash(dll_path)\n \n if memory_hash != disk_hash:\n return \"POTENTIAL_INJECTION_DETECTED\"\n return \"CLEAN\"\n```\n\n#### Process Hollowing Detection\n\nProcess Hollowing ersetzt den ursprünglichen Code eines legitimen Prozesses:\n\n**Erkennungsmerkmale:**\n- Diskrepanz zwischen ImageFileName und tatsächlichem Code\n- Ungewöhnliche Memory Protection Flags\n- Fehlende oder modifizierte PE Header\n- Unerwartete Entry Points\n\n**Volatility Detection:**\n```bash\n# Process Hollowing Indicators\npython vol.py -f memory.dmp windows.malfind.Malfind\npython vol.py -f memory.dmp windows.vadinfo.VadInfo --pid 1234\n```\n\n#### Process Ghosting Detection\n\nEine der neuesten Evasion-Techniken, die Prozesse ohne korrespondierende Dateien auf der Festplatte erstellt:\n\n**Erkennungsmerkmale:**\n```bash\n# File Object Analysis\npython vol.py -f memory.dmp windows.handles.Handles --pid 1234\n\n# Suche nach:\n# - Deleted File Objects\n# - Processes ohne korrespondierende Image Files\n# - Ungewöhnliche Creation Patterns\n```\n\n### DLL Hollowing und Memory Manipulation\n\nDLL Hollowing überschreibt legitimierte DLL-Sektionen mit malicious Code:\n\n**Detection Workflow:**\n1. **Section Analysis:**\n ```bash\n python vol.py -f memory.dmp windows.vadinfo.VadInfo --pid 1234\n ```\n\n2. **Memory Permission Analysis:**\n ```bash\n # Suche nach ungewöhnlichen Permissions\n # RWX (Read-Write-Execute) Bereiche sind verdächtig\n ```\n\n3. **Entropy Analysis:**\n ```python\n def calculate_section_entropy(memory_region):\n entropy = 0\n for byte_value in range(256):\n probability = memory_region.count(byte_value) / len(memory_region)\n if probability > 0:\n entropy += probability * math.log2(probability)\n return -entropy\n ```\n\n## Kernel-Level Analysis\n\n### System Call Hooking Detection\n\nRootkits manipulieren häufig System Call Tables (SSDT):\n\n**Windows SSDT Analysis:**\n```bash\n# System Service Descriptor Table\npython vol.py -f memory.dmp windows.ssdt.SSDT\n\n# Verdächtige Indikatoren:\n# - Hooks außerhalb bekannter Module\n# - Ungewöhnliche Sprungadressen\n# - Modifizierte System Call Nummern\n```\n\n**Linux System Call Table:**\n```bash\n# System Call Table Analysis für Linux\npython vol.py -f linux.dmp linux.check_syscall.Check_syscall\n```\n\n### Driver Analysis\n\nKernel-Mode-Rootkits nutzen Device Driver für persistente Angriffe:\n\n**Windows Driver Enumeration:**\n```bash\n# Loaded Modules Analysis\npython vol.py -f memory.dmp windows.modules.Modules\n\n# Driver IRP Analysis\npython vol.py -f memory.dmp windows.driverscan.DriverScan\n```\n\n**Verdächtige Driver-Eigenschaften:**\n- Fehlende Code-Signierung\n- Ungewöhnliche Load-Adressen\n- Versteckte oder gelöschte Driver-Files\n- Modifizierte IRP (I/O Request Packet) Handler\n\n### Rootkit Detection Methoden\n\n#### Direct Kernel Object Manipulation (DKOM)\n\nDKOM-Rootkits manipulieren Kernel-Datenstrukturen direkt:\n\n**Process Hiding Detection:**\n```bash\n# Process Scan vs. Process List Comparison\npython vol.py -f memory.dmp windows.psscan.PsScan > psscan.txt\npython vol.py -f memory.dmp windows.pslist.PsList > pslist.txt\n\n# Vergleich zeigt versteckte Prozesse\ndiff psscan.txt pslist.txt\n```\n\n#### EPROCESS Link Manipulation\n\n```python\n# Pseudocode für EPROCESS Validation\ndef validate_process_links(eprocess_list):\n for process in eprocess_list:\n flink = process.ActiveProcessLinks.Flink\n blink = process.ActiveProcessLinks.Blink\n \n # Validate bidirectional links\n if flink.Blink != process or blink.Flink != process:\n return \"LINK_MANIPULATION_DETECTED\"\n```\n\n## Memory Dump Acquisition Strategien\n\n### Live Memory Acquisition\n\n**Windows Memory Acquisition:**\n```bash\n# DumpIt (Comae)\nDumpIt.exe /output C:\\memory.dmp\n\n# WinPmem\nwinpmem-2.1.post4.exe C:\\memory.raw\n\n# Magnet RAM Capture\nMRCv1.20.exe /go /output C:\\memory.dmp\n```\n\n**Linux Memory Acquisition:**\n```bash\n# LiME (Linux Memory Extractor)\ninsmod lime.ko \"path=/tmp/memory.lime format=lime\"\n\n# AVML (Azure Virtual Machine Memory Extractor)\n./avml memory.dmp\n\n# dd (für /dev/mem falls verfügbar)\ndd if=/dev/mem of=memory.dd bs=1M\n```\n\n### Memory Acquisition Challenges\n\n**Volatility Considerations:**\n- Memory-Inhalte ändern sich kontinuierlich\n- Acquisition-Tools können Memory-Layout beeinflussen\n- Anti-Forensic-Techniken können Acquisition verhindern\n- Verschlüsselte Memory-Bereiche\n\n**Best Practices:**\n- Multiple Acquisition-Methoden verwenden\n- Acquisition-Logs dokumentieren\n- Hash-Werte für Integrität generieren\n- Timestamp-Synchronisation\n\n## Address Space Reconstruction\n\n### Virtual Address Translation\n\nDas Verständnis der Address Translation ist essentiell für Memory Forensics:\n\n**Windows Page Table Walkthrough:**\n```\nVirtual Address (32-bit): \n┌─────────────┬─────────────┬──────────────┐\n│ PDE (10bit) │ PTE (10bit) │ Offset(12bit)│\n└─────────────┴─────────────┴──────────────┘\n\n1. Page Directory Entry → Page Table Base\n2. Page Table Entry → Physical Page Frame\n3. Offset → Byte within Physical Page\n```\n\n**Linux Page Table Structure:**\n```\nVirtual Address (64-bit):\n┌───┬───┬───┬───┬──────────┐\n│PGD│PUD│PMD│PTE│ Offset │\n└───┴───┴───┴───┴──────────┘\n\n4-Level Page Table (x86_64):\n- PGD: Page Global Directory\n- PUD: Page Upper Directory \n- PMD: Page Middle Directory\n- PTE: Page Table Entry\n```\n\n### Memory Mapping Analysis\n\n**Windows VAD (Virtual Address Descriptor) Trees:**\n```bash\n# VAD Tree Analysis\npython vol.py -f memory.dmp windows.vadinfo.VadInfo --pid 1234\n\n# Memory Mapping Details\npython vol.py -f memory.dmp windows.memmap.Memmap --pid 1234\n```\n\n**Linux Memory Maps:**\n```bash\n# Process Memory Maps\npython vol.py -f linux.dmp linux.proc_maps.Maps --pid 1234\n```\n\n## Cross-Platform Memory Forensics\n\n### Windows-Specific Artefakte\n\n**Registry in Memory:**\n```bash\n# Registry Hives\npython vol.py -f memory.dmp windows.registry.hivelist.HiveList\n\n# Registry Keys\npython vol.py -f memory.dmp windows.registry.printkey.PrintKey --key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n```\n\n**Windows Event Logs:**\n```bash\n# Event Log Analysis\npython vol.py -f memory.dmp windows.evtlogs.EvtLogs\n```\n\n### Linux-Specific Artefakte\n\n**Process Environment:**\n```bash\n# Environment Variables\npython vol.py -f linux.dmp linux.envars.Envars\n\n# Process Arguments\npython vol.py -f linux.dmp linux.psaux.PsAux\n```\n\n**Network Connections:**\n```bash\n# Network Sockets\npython vol.py -f linux.dmp linux.netstat.Netstat\n```\n\n### macOS Memory Forensics\n\n**Darwin Kernel Structures:**\n```bash\n# Process List (macOS)\npython vol.py -f macos.dmp mac.pslist.PsList\n\n# Network Connections\npython vol.py -f macos.dmp mac.netstat.Netstat\n```\n\n## Live Analysis vs. Dead Analysis\n\n### Live Memory Analysis\n\n**Vorteile:**\n- Vollständige System-Sicht\n- Kontinuierliche Überwachung möglich\n- Interaktive Analysis-Möglichkeiten\n- Integration mit Incident Response\n\n**Tools für Live Analysis:**\n- Rekall (Live Mode)\n- WinDbg (Live Debugging)\n- GDB (Linux Live Debugging)\n- Volatility mit Live Memory Plugins\n\n**Live Analysis Workflow:**\n```bash\n# Rekall Live Analysis\nrekall --live Memory\n\n# Memory-basierte Malware Detection\nrekall> pslist\nrekall> malfind\nrekall> hollowfind\n```\n\n### Dead Memory Analysis\n\n**Vorteile:**\n- Stabile Analysis-Umgebung\n- Reproduzierbare Ergebnisse\n- Tiefere forensische Untersuchung\n- Legal-konforme Beweisführung\n\n**Typical Workflow:**\n```bash\n# 1. Memory Dump Analysis\npython vol.py -f memory.dmp windows.info.Info\n\n# 2. Process Analysis\npython vol.py -f memory.dmp windows.pslist.PsList\npython vol.py -f memory.dmp windows.pstree.PsTree\n\n# 3. Malware Detection\npython vol.py -f memory.dmp windows.malfind.Malfind\n\n# 4. Network Analysis\npython vol.py -f memory.dmp windows.netstat.NetStat\n\n# 5. Registry Analysis\npython vol.py -f memory.dmp windows.registry.hivelist.HiveList\n```\n\n## Encrypted Memory Handling\n\n### Windows BitLocker Memory\n\nBitLocker-verschlüsselte Systeme stellen besondere Herausforderungen dar:\n\n**Memory Encryption Bypass:**\n- Cold Boot Attacks auf Encryption Keys\n- DMA (Direct Memory Access) Attacks\n- Hibernation File Analysis\n\n### Full Memory Encryption (TME)\n\nIntel Total Memory Encryption (TME) verschlüsselt den gesamten Arbeitsspeicher:\n\n**Forensic Implications:**\n- Hardware-basierte Key-Extraktion erforderlich\n- Firmware-Level-Access notwendig\n- Acquisition vor Memory-Locking\n\n## Advanced Analysis Techniken\n\n### Machine Learning in Memory Forensics\n\n**Anomaly Detection:**\n```python\n# Pseudocode für ML-basierte Process Analysis\ndef detect_process_anomalies(memory_dump):\n features = extract_process_features(memory_dump)\n # Features: Memory Permissions, API Calls, Network Connections\n \n model = load_trained_model('process_anomaly_detection.pkl')\n anomalies = model.predict(features)\n \n return anomalies\n```\n\n### Timeline Reconstruction\n\n**Memory-basierte Timeline:**\n```bash\n# Process Creation Timeline\npython vol.py -f memory.dmp windows.pslist.PsList --output-format=timeline\n\n# File Object Timeline\npython vol.py -f memory.dmp windows.handles.Handles --object-type=File\n```\n\n### Memory Forensics Automation\n\n**Automated Analysis Framework:**\n```python\n#!/usr/bin/env python3\nclass MemoryForensicsAutomation:\n def __init__(self, memory_dump):\n self.dump = memory_dump\n self.results = {}\n \n def run_baseline_analysis(self):\n # Basic System Information\n self.results['info'] = self.run_volatility_plugin('windows.info.Info')\n \n # Process Analysis\n self.results['processes'] = self.run_volatility_plugin('windows.pslist.PsList')\n \n # Malware Detection\n self.results['malware'] = self.run_volatility_plugin('windows.malfind.Malfind')\n \n # Network Analysis\n self.results['network'] = self.run_volatility_plugin('windows.netstat.NetStat')\n \n return self.results\n \n def detect_anomalies(self):\n # Implementation für automatisierte Anomaly Detection\n pass\n```\n\n## Häufige Herausforderungen und Lösungsansätze\n\n### Anti-Forensic Techniken\n\n**Memory Wiping:**\n- Erkennung durch Memory Allocation Patterns\n- Analyse von Memory Page Timestamps\n- Reconstruction durch Memory Slack\n\n**Process Masquerading:**\n- PE Header Validation\n- Import Address Table (IAT) Analysis\n- Code Signing Verification\n\n**Timing Attacks:**\n- Memory Acquisition Race Conditions\n- Process Termination während Acquisition\n- Kontinuierliche Monitoring-Strategien\n\n### Performance Optimierung\n\n**Large Memory Dumps:**\n```bash\n# Parallel Processing\npython vol.py -f memory.dmp --parallel=4 windows.pslist.PsList\n\n# Targeted Analysis\npython vol.py -f memory.dmp windows.pslist.PsList --pid 1234,5678\n```\n\n**Memory Usage Optimization:**\n- Streaming Analysis für große Dumps\n- Indexed Memory Access\n- Selective Plugin Execution\n\n## Tools und Framework Integration\n\n### Volatility 3 Framework\n\n**Plugin Development:**\n```python\nclass CustomMalwareDetector(interfaces.plugins.PluginInterface):\n \"\"\"Custom Plugin für Advanced Malware Detection\"\"\"\n \n @classmethod\n def get_requirements(cls):\n return [requirements.TranslationLayerRequirement(name='primary'),\n requirements.SymbolTableRequirement(name=\"nt_symbols\")]\n \n def run(self):\n # Implementation der Detection-Logik\n pass\n```\n\n### Integration mit SIEM-Systemen\n\n**ElasticSearch Integration:**\n```python\ndef export_to_elasticsearch(memory_analysis_results):\n es = Elasticsearch(['localhost:9200'])\n \n for artifact in memory_analysis_results:\n doc = {\n 'timestamp': artifact.timestamp,\n 'process_name': artifact.process_name,\n 'suspicious_score': artifact.score,\n 'detection_method': artifact.method\n }\n es.index(index='memory-forensics', body=doc)\n```\n\n## Best Practices und Empfehlungen\n\n### Forensic Methodology\n\n1. **Preservation First**: Memory Dump Acquisition vor anderen Aktionen\n2. **Documentation**: Vollständige Dokumentation aller Analysis-Schritte\n3. **Validation**: Cross-Referencing verschiedener Evidence Sources\n4. **Chain of Custody**: Lückenlose Beweiskette\n5. **Reproducibility**: Wiederholbare Analysis-Prozesse\n\n### Quality Assurance\n\n**Hash Verification:**\n```bash\n# MD5/SHA256 Hashes für Memory Dumps\nmd5sum memory.dmp > memory.dmp.md5\nsha256sum memory.dmp > memory.dmp.sha256\n```\n\n**Analysis Documentation:**\n```markdown\n# Memory Forensics Analysis Report\n\n## System Information\n- OS Version: Windows 10 Pro 1909\n- Architecture: x64\n- Memory Size: 16GB\n- Acquisition Time: 2024-01-15 14:30:00 UTC\n\n## Tools Used\n- Volatility 3.2.0\n- Rekall 1.7.2\n- Custom Scripts: malware_detector.py\n\n## Key Findings\n1. Process Injection detected in explorer.exe (PID 1234)\n2. Unknown driver loaded: malicious.sys\n3. Network connections to suspicious IPs\n```\n\n## Fazit\n\nMemory Forensics stellt ein mächtiges Werkzeug für die Aufdeckung komplexer Angriffe dar, die traditionelle Festplatten-Forensik umgehen. Die kontinuierliche Weiterentwicklung von Angriffstechniken erfordert eine entsprechende Evolution der forensischen Methoden.\n\n**Zukünftige Entwicklungen:**\n- Hardware-basierte Memory Protection Bypass\n- Machine Learning für Automated Threat Detection\n- Cloud Memory Forensics\n- Containerized Environment Analysis\n- Real-time Memory Threat Hunting\n\nDie Beherrschung von Memory Forensics erfordert ein tiefes Verständnis von Betriebssystem-Internals, Malware-Techniken und forensischen Methoden. Kontinuierliche Weiterbildung und praktische Erfahrung sind essentiell für erfolgreiche Memory-basierte Investigations.\n\n## Weiterführende Ressourcen\n\n- **Volatility Labs Blog**: Aktuelle Research zu Memory Forensics\n- **SANS FOR508**: Advanced Incident Response und Digital Forensics\n- **Black Hat/DEF CON**: Security Conference Presentations\n- **Academic Papers**: IEEE Security & Privacy, USENIX Security\n- **Open Source Tools**: GitHub Repositories für Custom Plugins","src/content/knowledgebase/concept-memory-forensics.md","569082484c784cc4",{"html":520,"metadata":521},"\u003Ch1 id=\"memory-forensics-und-process-analysis-advanced-malware-detection-in-volatile-memory\">Memory Forensics und Process Analysis: Advanced Malware Detection in Volatile Memory\u003C/h1>\n\u003Cp>Memory Forensics stellt eine der komplexesten und gleichzeitig aufschlussreichsten Disziplinen der digitalen Forensik dar. Während traditionelle Festplatten-Forensik auf persistente Daten zugreift, ermöglicht die Analyse des Arbeitsspeichers Einblicke in aktive Prozesse, verschleierte Malware und Angriffstechniken, die keine Spuren auf der Festplatte hinterlassen.\u003C/p>\n\u003Ch2 id=\"einführung-in-memory-forensics\">Einführung in Memory Forensics\u003C/h2>\n\u003Ch3 id=\"was-ist-memory-forensics\">Was ist Memory Forensics?\u003C/h3>\n\u003Cp>Memory Forensics ist die Wissenschaft der Analyse von Computer-Arbeitsspeicher (RAM) zur Aufdeckung digitaler Artefakte. Im Gegensatz zur traditionellen Festplatten-Forensik konzentriert sich Memory Forensics auf volatile Daten, die nur temporär im Speicher existieren.\u003C/p>\n\u003Cp>\u003Cstrong>Zentrale Vorteile:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Erkennung von Malware, die nur im Speicher residiert\u003C/li>\n\u003Cli>Aufdeckung von Process-Injection und Code-Hiding-Techniken\u003C/li>\n\u003Cli>Analyse von verschlüsselten oder obfuscierten Prozessen\u003C/li>\n\u003Cli>Rekonstruktion von Netzwerkverbindungen und Benutzeraktivitäten\u003C/li>\n\u003Cli>Untersuchung von Kernel-Level-Rootkits\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"virtual-memory-layout-verstehen\">Virtual Memory Layout verstehen\u003C/h3>\n\u003Cp>Das Virtual Memory System moderner Betriebssysteme bildet die Grundlage für Memory Forensics. Jeder Prozess erhält einen eigenen virtuellen Adressraum, der in verschiedene Segmente unterteilt ist:\u003C/p>\n\u003Cp>\u003Cstrong>Windows Virtual Memory Layout:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>0x00000000 - 0x7FFFFFFF: User Space (2GB)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>0x80000000 - 0xFFFFFFFF: Kernel Space (2GB)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>User Space Segmente:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- 0x00000000 - 0x0000FFFF: NULL Pointer Region\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- 0x00010000 - 0x7FFEFFFF: User Code und Data\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- 0x7FFF0000 - 0x7FFFFFFF: System DLLs (ntdll.dll)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Linux Virtual Memory Layout:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>0x00000000 - 0xBFFFFFFF: User Space (3GB)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>0xC0000000 - 0xFFFFFFFF: Kernel Space (1GB)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>User Space Segmente:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Text Segment: Executable Code\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Data Segment: Initialized Variables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- BSS Segment: Uninitialized Variables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Heap: Dynamic Memory Allocation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Stack: Function Calls und Local Variables\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"process-internals-und-strukturen\">Process Internals und Strukturen\u003C/h2>\n\u003Ch3 id=\"process-control-blocks-pcb\">Process Control Blocks (PCB)\u003C/h3>\n\u003Cp>Jeder Prozess wird durch eine zentrale Datenstruktur repräsentiert, die alle relevanten Informationen enthält:\u003C/p>\n\u003Cp>\u003Cstrong>Windows EPROCESS Structure:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"c\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">typedef\u003C/span>\u003Cspan style=\"color:#F97583\"> struct\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _EPROCESS {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> KPROCESS Pcb;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Process Control Block\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> EX_PUSH_LOCK ProcessLock;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Process Lock\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> LARGE_INTEGER CreateTime;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Creation Timestamp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> LARGE_INTEGER ExitTime;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Exit Timestamp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> EX_RUNDOWN_REF RundownProtect;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Rundown Protection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> HANDLE UniqueProcessId;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Process ID (PID)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> LIST_ENTRY ActiveProcessLinks;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Double Linked List\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> RTL_AVL_TREE VadRoot;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Virtual Address Descriptors\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> // ... weitere Felder\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">} EPROCESS, \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">PEPROCESS;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Wichtige Felder für Forensik:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ccode>ImageFileName\u003C/code>: Name der ausführbaren Datei\u003C/li>\n\u003Cli>\u003Ccode>Peb\u003C/code>: Process Environment Block Pointer\u003C/li>\n\u003Cli>\u003Ccode>VadRoot\u003C/code>: Virtual Address Descriptor Tree\u003C/li>\n\u003Cli>\u003Ccode>Token\u003C/code>: Security Token des Prozesses\u003C/li>\n\u003Cli>\u003Ccode>HandleTable\u003C/code>: Tabelle geöffneter Handles\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"thread-control-blocks-tcb\">Thread Control Blocks (TCB)\u003C/h3>\n\u003Cp>Threads sind die ausführbaren Einheiten innerhalb eines Prozesses:\u003C/p>\n\u003Cp>\u003Cstrong>Windows ETHREAD Structure:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"c\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">typedef\u003C/span>\u003Cspan style=\"color:#F97583\"> struct\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _ETHREAD {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> KTHREAD Tcb;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Thread Control Block\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> LARGE_INTEGER CreateTime;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Thread Creation Time\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> LIST_ENTRY ThreadListEntry;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Process Thread List\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> EX_RUNDOWN_REF RundownProtect;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Rundown Protection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> PEPROCESS ThreadsProcess;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Parent Process Pointer\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> PVOID StartAddress;\u003C/span>\u003Cspan style=\"color:#6A737D\"> // Thread Start Address\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> // ... weitere Felder\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">} ETHREAD, \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">PETHREAD;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"advanced-malware-detection-techniken\">Advanced Malware Detection Techniken\u003C/h2>\n\u003Ch3 id=\"process-injection-erkennung\">Process Injection Erkennung\u003C/h3>\n\u003Cp>Process Injection ist eine häufig verwendete Technik zur Umgehung von Security-Lösungen. Verschiedene Injection-Methoden erfordern spezifische Erkennungsansätze:\u003C/p>\n\u003Ch4 id=\"dll-injection-detection\">DLL Injection Detection\u003C/h4>\n\u003Cp>\u003Cstrong>Erkennungsmerkmale:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Volatility 3 Command\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.dlllist.DllList\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verdächtige Indikatoren:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Ungewöhnliche DLL-Pfade\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - DLLs ohne digitale Signatur\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Temporäre oder versteckte Pfade\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Diskrepanzen zwischen Image und Memory\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Manuelle Verifikation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Pseudocode für DLL-Validierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> validate_dll_integrity\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(dll_base, dll_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> memory_hash \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> calculate_memory_hash(dll_base)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> disk_hash \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> calculate_file_hash(dll_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> memory_hash \u003C/span>\u003Cspan style=\"color:#F97583\">!=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> disk_hash:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"POTENTIAL_INJECTION_DETECTED\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"CLEAN\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch4 id=\"process-hollowing-detection\">Process Hollowing Detection\u003C/h4>\n\u003Cp>Process Hollowing ersetzt den ursprünglichen Code eines legitimen Prozesses:\u003C/p>\n\u003Cp>\u003Cstrong>Erkennungsmerkmale:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Diskrepanz zwischen ImageFileName und tatsächlichem Code\u003C/li>\n\u003Cli>Ungewöhnliche Memory Protection Flags\u003C/li>\n\u003Cli>Fehlende oder modifizierte PE Header\u003C/li>\n\u003Cli>Unerwartete Entry Points\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Volatility Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process Hollowing Indicators\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.malfind.Malfind\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.vadinfo.VadInfo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch4 id=\"process-ghosting-detection\">Process Ghosting Detection\u003C/h4>\n\u003Cp>Eine der neuesten Evasion-Techniken, die Prozesse ohne korrespondierende Dateien auf der Festplatte erstellt:\u003C/p>\n\u003Cp>\u003Cstrong>Erkennungsmerkmale:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># File Object Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.handles.Handles\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suche nach:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Deleted File Objects\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Processes ohne korrespondierende Image Files\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Ungewöhnliche Creation Patterns\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"dll-hollowing-und-memory-manipulation\">DLL Hollowing und Memory Manipulation\u003C/h3>\n\u003Cp>DLL Hollowing überschreibt legitimierte DLL-Sektionen mit malicious Code:\u003C/p>\n\u003Cp>\u003Cstrong>Detection Workflow:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\n\u003Cp>\u003Cstrong>Section Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.vadinfo.VadInfo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>\u003Cstrong>Memory Permission Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suche nach ungewöhnlichen Permissions\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># RWX (Read-Write-Execute) Bereiche sind verdächtig\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>\u003Cstrong>Entropy Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> calculate_section_entropy\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(memory_region):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> entropy \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> byte_value \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> range\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">256\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> probability \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> memory_region.count(byte_value) \u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\"> len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(memory_region)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> probability \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> entropy \u003C/span>\u003Cspan style=\"color:#F97583\">+=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> probability \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> math.log2(probability)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">entropy\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003C/ol>\n\u003Ch2 id=\"kernel-level-analysis\">Kernel-Level Analysis\u003C/h2>\n\u003Ch3 id=\"system-call-hooking-detection\">System Call Hooking Detection\u003C/h3>\n\u003Cp>Rootkits manipulieren häufig System Call Tables (SSDT):\u003C/p>\n\u003Cp>\u003Cstrong>Windows SSDT Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># System Service Descriptor Table\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.ssdt.SSDT\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verdächtige Indikatoren:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Hooks außerhalb bekannter Module\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Ungewöhnliche Sprungadressen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># - Modifizierte System Call Nummern\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Linux System Call Table:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># System Call Table Analysis für Linux\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.check_syscall.Check_syscall\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"driver-analysis\">Driver Analysis\u003C/h3>\n\u003Cp>Kernel-Mode-Rootkits nutzen Device Driver für persistente Angriffe:\u003C/p>\n\u003Cp>\u003Cstrong>Windows Driver Enumeration:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Loaded Modules Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.modules.Modules\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Driver IRP Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.driverscan.DriverScan\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Verdächtige Driver-Eigenschaften:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Fehlende Code-Signierung\u003C/li>\n\u003Cli>Ungewöhnliche Load-Adressen\u003C/li>\n\u003Cli>Versteckte oder gelöschte Driver-Files\u003C/li>\n\u003Cli>Modifizierte IRP (I/O Request Packet) Handler\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"rootkit-detection-methoden\">Rootkit Detection Methoden\u003C/h3>\n\u003Ch4 id=\"direct-kernel-object-manipulation-dkom\">Direct Kernel Object Manipulation (DKOM)\u003C/h4>\n\u003Cp>DKOM-Rootkits manipulieren Kernel-Datenstrukturen direkt:\u003C/p>\n\u003Cp>\u003Cstrong>Process Hiding Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process Scan vs. Process List Comparison\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.psscan.PsScan\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> psscan.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pslist.PsList\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pslist.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vergleich zeigt versteckte Prozesse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">diff\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> psscan.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pslist.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch4 id=\"eprocess-link-manipulation\">EPROCESS Link Manipulation\u003C/h4>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Pseudocode für EPROCESS Validation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> validate_process_links\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(eprocess_list):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> process \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> eprocess_list:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> flink \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> process.ActiveProcessLinks.Flink\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> blink \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> process.ActiveProcessLinks.Blink\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Validate bidirectional links\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> flink.Blink \u003C/span>\u003Cspan style=\"color:#F97583\">!=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> process \u003C/span>\u003Cspan style=\"color:#F97583\">or\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> blink.Flink \u003C/span>\u003Cspan style=\"color:#F97583\">!=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> process:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"LINK_MANIPULATION_DETECTED\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"memory-dump-acquisition-strategien\">Memory Dump Acquisition Strategien\u003C/h2>\n\u003Ch3 id=\"live-memory-acquisition\">Live Memory Acquisition\u003C/h3>\n\u003Cp>\u003Cstrong>Windows Memory Acquisition:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># DumpIt (Comae)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">DumpIt.exe\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> C:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\m\u003C/span>\u003Cspan style=\"color:#9ECBFF\">emory.dmp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WinPmem\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">winpmem-2.1.post4.exe\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> C:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\m\u003C/span>\u003Cspan style=\"color:#9ECBFF\">emory.raw\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Magnet RAM Capture\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">MRCv1.20.exe\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /go\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> C:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\m\u003C/span>\u003Cspan style=\"color:#9ECBFF\">emory.dmp\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Linux Memory Acquisition:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># LiME (Linux Memory Extractor)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">insmod\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> lime.ko\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"path=/tmp/memory.lime format=lime\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># AVML (Azure Virtual Machine Memory Extractor)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">./avml\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># dd (für /dev/mem falls verfügbar)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/mem\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=memory.dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> bs=1M\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"memory-acquisition-challenges\">Memory Acquisition Challenges\u003C/h3>\n\u003Cp>\u003Cstrong>Volatility Considerations:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Memory-Inhalte ändern sich kontinuierlich\u003C/li>\n\u003Cli>Acquisition-Tools können Memory-Layout beeinflussen\u003C/li>\n\u003Cli>Anti-Forensic-Techniken können Acquisition verhindern\u003C/li>\n\u003Cli>Verschlüsselte Memory-Bereiche\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Best Practices:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Multiple Acquisition-Methoden verwenden\u003C/li>\n\u003Cli>Acquisition-Logs dokumentieren\u003C/li>\n\u003Cli>Hash-Werte für Integrität generieren\u003C/li>\n\u003Cli>Timestamp-Synchronisation\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"address-space-reconstruction\">Address Space Reconstruction\u003C/h2>\n\u003Ch3 id=\"virtual-address-translation\">Virtual Address Translation\u003C/h3>\n\u003Cp>Das Verständnis der Address Translation ist essentiell für Memory Forensics:\u003C/p>\n\u003Cp>\u003Cstrong>Windows Page Table Walkthrough:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Virtual Address (32-bit): \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>┌─────────────┬─────────────┬──────────────┐\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>│ PDE (10bit) │ PTE (10bit) │ Offset(12bit)│\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>└─────────────┴─────────────┴──────────────┘\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>1. Page Directory Entry → Page Table Base\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>2. Page Table Entry → Physical Page Frame\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>3. Offset → Byte within Physical Page\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Linux Page Table Structure:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Virtual Address (64-bit):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>┌───┬───┬───┬───┬──────────┐\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>│PGD│PUD│PMD│PTE│ Offset │\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>└───┴───┴───┴───┴──────────┘\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>4-Level Page Table (x86_64):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- PGD: Page Global Directory\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- PUD: Page Upper Directory \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- PMD: Page Middle Directory\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- PTE: Page Table Entry\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"memory-mapping-analysis\">Memory Mapping Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>Windows VAD (Virtual Address Descriptor) Trees:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># VAD Tree Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.vadinfo.VadInfo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory Mapping Details\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.memmap.Memmap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Linux Memory Maps:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process Memory Maps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.proc_maps.Maps\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1234\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"cross-platform-memory-forensics\">Cross-Platform Memory Forensics\u003C/h2>\n\u003Ch3 id=\"windows-specific-artefakte\">Windows-Specific Artefakte\u003C/h3>\n\u003Cp>\u003Cstrong>Registry in Memory:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Registry Hives\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.registry.hivelist.HiveList\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Registry Keys\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.registry.printkey.PrintKey\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --key\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Windows Event Logs:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Event Log Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.evtlogs.EvtLogs\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"linux-specific-artefakte\">Linux-Specific Artefakte\u003C/h3>\n\u003Cp>\u003Cstrong>Process Environment:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Environment Variables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.envars.Envars\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process Arguments\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.psaux.PsAux\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Network Connections:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Network Sockets\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.netstat.Netstat\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"macos-memory-forensics\">macOS Memory Forensics\u003C/h3>\n\u003Cp>\u003Cstrong>Darwin Kernel Structures:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process List (macOS)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> macos.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mac.pslist.PsList\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Network Connections\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> macos.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mac.netstat.Netstat\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"live-analysis-vs-dead-analysis\">Live Analysis vs. Dead Analysis\u003C/h2>\n\u003Ch3 id=\"live-memory-analysis\">Live Memory Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>Vorteile:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Vollständige System-Sicht\u003C/li>\n\u003Cli>Kontinuierliche Überwachung möglich\u003C/li>\n\u003Cli>Interaktive Analysis-Möglichkeiten\u003C/li>\n\u003Cli>Integration mit Incident Response\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Tools für Live Analysis:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Rekall (Live Mode)\u003C/li>\n\u003Cli>WinDbg (Live Debugging)\u003C/li>\n\u003Cli>GDB (Linux Live Debugging)\u003C/li>\n\u003Cli>Volatility mit Live Memory Plugins\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Live Analysis Workflow:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Rekall Live Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">rekall\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --live\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> Memory\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory-basierte Malware Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">rekall\u003C/span>\u003Cspan style=\"color:#E1E4E8\">> \u003C/span>\u003Cspan style=\"color:#9ECBFF\">pslist\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">rekall\u003C/span>\u003Cspan style=\"color:#E1E4E8\">> \u003C/span>\u003Cspan style=\"color:#9ECBFF\">malfind\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">rekall\u003C/span>\u003Cspan style=\"color:#E1E4E8\">> \u003C/span>\u003Cspan style=\"color:#9ECBFF\">hollowfind\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"dead-memory-analysis\">Dead Memory Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>Vorteile:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Stabile Analysis-Umgebung\u003C/li>\n\u003Cli>Reproduzierbare Ergebnisse\u003C/li>\n\u003Cli>Tiefere forensische Untersuchung\u003C/li>\n\u003Cli>Legal-konforme Beweisführung\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Typical Workflow:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 1. Memory Dump Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.info.Info\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 2. Process Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pslist.PsList\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pstree.PsTree\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 3. Malware Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.malfind.Malfind\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 4. Network Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.netstat.NetStat\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 5. Registry Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.registry.hivelist.HiveList\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"encrypted-memory-handling\">Encrypted Memory Handling\u003C/h2>\n\u003Ch3 id=\"windows-bitlocker-memory\">Windows BitLocker Memory\u003C/h3>\n\u003Cp>BitLocker-verschlüsselte Systeme stellen besondere Herausforderungen dar:\u003C/p>\n\u003Cp>\u003Cstrong>Memory Encryption Bypass:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Cold Boot Attacks auf Encryption Keys\u003C/li>\n\u003Cli>DMA (Direct Memory Access) Attacks\u003C/li>\n\u003Cli>Hibernation File Analysis\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"full-memory-encryption-tme\">Full Memory Encryption (TME)\u003C/h3>\n\u003Cp>Intel Total Memory Encryption (TME) verschlüsselt den gesamten Arbeitsspeicher:\u003C/p>\n\u003Cp>\u003Cstrong>Forensic Implications:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Hardware-basierte Key-Extraktion erforderlich\u003C/li>\n\u003Cli>Firmware-Level-Access notwendig\u003C/li>\n\u003Cli>Acquisition vor Memory-Locking\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"advanced-analysis-techniken\">Advanced Analysis Techniken\u003C/h2>\n\u003Ch3 id=\"machine-learning-in-memory-forensics\">Machine Learning in Memory Forensics\u003C/h3>\n\u003Cp>\u003Cstrong>Anomaly Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Pseudocode für ML-basierte Process Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_process_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(memory_dump):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> features \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> extract_process_features(memory_dump)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Features: Memory Permissions, API Calls, Network Connections\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> model \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> load_trained_model(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'process_anomaly_detection.pkl'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalies \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> model.predict(features)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalies\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"timeline-reconstruction\">Timeline Reconstruction\u003C/h3>\n\u003Cp>\u003Cstrong>Memory-basierte Timeline:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process Creation Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pslist.PsList\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output-format=timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># File Object Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.handles.Handles\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --object-type=File\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"memory-forensics-automation\">Memory Forensics Automation\u003C/h3>\n\u003Cp>\u003Cstrong>Automated Analysis Framework:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/usr/bin/env python3\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> MemoryForensicsAutomation\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#79B8FF\"> __init__\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, memory_dump):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.dump \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> memory_dump\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> run_baseline_analysis\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Basic System Information\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'info'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.run_volatility_plugin(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'windows.info.Info'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Process Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'processes'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.run_volatility_plugin(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'windows.pslist.PsList'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Malware Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'malware'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.run_volatility_plugin(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'windows.malfind.Malfind'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Network Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'network'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.run_volatility_plugin(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'windows.netstat.NetStat'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.results\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Implementation für automatisierte Anomaly Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> pass\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-herausforderungen-und-lösungsansätze\">Häufige Herausforderungen und Lösungsansätze\u003C/h2>\n\u003Ch3 id=\"anti-forensic-techniken\">Anti-Forensic Techniken\u003C/h3>\n\u003Cp>\u003Cstrong>Memory Wiping:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Erkennung durch Memory Allocation Patterns\u003C/li>\n\u003Cli>Analyse von Memory Page Timestamps\u003C/li>\n\u003Cli>Reconstruction durch Memory Slack\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Process Masquerading:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>PE Header Validation\u003C/li>\n\u003Cli>Import Address Table (IAT) Analysis\u003C/li>\n\u003Cli>Code Signing Verification\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Timing Attacks:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Memory Acquisition Race Conditions\u003C/li>\n\u003Cli>Process Termination während Acquisition\u003C/li>\n\u003Cli>Kontinuierliche Monitoring-Strategien\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"performance-optimierung\">Performance Optimierung\u003C/h3>\n\u003Cp>\u003Cstrong>Large Memory Dumps:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Parallel Processing\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --parallel=4\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pslist.PsList\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Targeted Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> windows.pslist.PsList\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pid\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 1234,5678\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Memory Usage Optimization:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Streaming Analysis für große Dumps\u003C/li>\n\u003Cli>Indexed Memory Access\u003C/li>\n\u003Cli>Selective Plugin Execution\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"tools-und-framework-integration\">Tools und Framework Integration\u003C/h2>\n\u003Ch3 id=\"volatility-3-framework\">Volatility 3 Framework\u003C/h3>\n\u003Cp>\u003Cstrong>Plugin Development:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> CustomMalwareDetector\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#B392F0\">interfaces\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#B392F0\">plugins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#B392F0\">PluginInterface\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Custom Plugin für Advanced Malware Detection\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> @\u003C/span>\u003Cspan style=\"color:#79B8FF\">classmethod\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> get_requirements\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(cls):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [requirements.TranslationLayerRequirement(\u003C/span>\u003Cspan style=\"color:#FFAB70\">name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'primary'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> requirements.SymbolTableRequirement(\u003C/span>\u003Cspan style=\"color:#FFAB70\">name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"nt_symbols\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> run\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Implementation der Detection-Logik\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> pass\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"integration-mit-siem-systemen\">Integration mit SIEM-Systemen\u003C/h3>\n\u003Cp>\u003Cstrong>ElasticSearch Integration:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> export_to_elasticsearch\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(memory_analysis_results):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> es \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Elasticsearch([\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localhost:9200'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> artifact \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> memory_analysis_results:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> doc \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: artifact.timestamp,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'process_name'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: artifact.process_name,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'suspicious_score'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: artifact.score,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'detection_method'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: artifact.method\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> es.index(\u003C/span>\u003Cspan style=\"color:#FFAB70\">index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'memory-forensics'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">body\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">doc)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"best-practices-und-empfehlungen\">Best Practices und Empfehlungen\u003C/h2>\n\u003Ch3 id=\"forensic-methodology\">Forensic Methodology\u003C/h3>\n\u003Col>\n\u003Cli>\u003Cstrong>Preservation First\u003C/strong>: Memory Dump Acquisition vor anderen Aktionen\u003C/li>\n\u003Cli>\u003Cstrong>Documentation\u003C/strong>: Vollständige Dokumentation aller Analysis-Schritte\u003C/li>\n\u003Cli>\u003Cstrong>Validation\u003C/strong>: Cross-Referencing verschiedener Evidence Sources\u003C/li>\n\u003Cli>\u003Cstrong>Chain of Custody\u003C/strong>: Lückenlose Beweiskette\u003C/li>\n\u003Cli>\u003Cstrong>Reproducibility\u003C/strong>: Wiederholbare Analysis-Prozesse\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"quality-assurance\">Quality Assurance\u003C/h3>\n\u003Cp>\u003Cstrong>Hash Verification:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MD5/SHA256 Hashes für Memory Dumps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp.md5\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.dmp.sha256\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Analysis Documentation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"markdown\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF;font-weight:bold\"># Memory Forensics Analysis Report\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF;font-weight:bold\">## System Information\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> OS Version: Windows 10 Pro 1909\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Architecture: x64\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Memory Size: 16GB\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Acquisition Time: 2024-01-15 14:30:00 UTC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF;font-weight:bold\">## Tools Used\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Volatility 3.2.0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Rekall 1.7.2\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Custom Scripts: malware_detector.py\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF;font-weight:bold\">## Key Findings\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">1.\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Process Injection detected in explorer.exe (PID 1234)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">2.\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Unknown driver loaded: malicious.sys\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\">3.\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Network connections to suspicious IPs\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fazit\">Fazit\u003C/h2>\n\u003Cp>Memory Forensics stellt ein mächtiges Werkzeug für die Aufdeckung komplexer Angriffe dar, die traditionelle Festplatten-Forensik umgehen. Die kontinuierliche Weiterentwicklung von Angriffstechniken erfordert eine entsprechende Evolution der forensischen Methoden.\u003C/p>\n\u003Cp>\u003Cstrong>Zukünftige Entwicklungen:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Hardware-basierte Memory Protection Bypass\u003C/li>\n\u003Cli>Machine Learning für Automated Threat Detection\u003C/li>\n\u003Cli>Cloud Memory Forensics\u003C/li>\n\u003Cli>Containerized Environment Analysis\u003C/li>\n\u003Cli>Real-time Memory Threat Hunting\u003C/li>\n\u003C/ul>\n\u003Cp>Die Beherrschung von Memory Forensics erfordert ein tiefes Verständnis von Betriebssystem-Internals, Malware-Techniken und forensischen Methoden. Kontinuierliche Weiterbildung und praktische Erfahrung sind essentiell für erfolgreiche Memory-basierte Investigations.\u003C/p>\n\u003Ch2 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Volatility Labs Blog\u003C/strong>: Aktuelle Research zu Memory Forensics\u003C/li>\n\u003Cli>\u003Cstrong>SANS FOR508\u003C/strong>: Advanced Incident Response und Digital Forensics\u003C/li>\n\u003Cli>\u003Cstrong>Black Hat/DEF CON\u003C/strong>: Security Conference Presentations\u003C/li>\n\u003Cli>\u003Cstrong>Academic Papers\u003C/strong>: IEEE Security & Privacy, USENIX Security\u003C/li>\n\u003Cli>\u003Cstrong>Open Source Tools\u003C/strong>: GitHub Repositories für Custom Plugins\u003C/li>\n\u003C/ul>",{"headings":522,"localImagePaths":667,"remoteImagePaths":668,"frontmatter":669,"imagePaths":674},[523,525,528,531,534,537,540,543,546,549,553,556,559,562,565,568,571,574,577,580,583,586,589,592,595,598,601,604,607,610,613,616,619,622,625,628,631,634,637,640,641,644,647,650,653,656,659,662,665,666],{"depth":44,"slug":524,"text":493},"memory-forensics-und-process-analysis-advanced-malware-detection-in-volatile-memory",{"depth":47,"slug":526,"text":527},"einführung-in-memory-forensics","Einführung in Memory Forensics",{"depth":54,"slug":529,"text":530},"was-ist-memory-forensics","Was ist Memory Forensics?",{"depth":54,"slug":532,"text":533},"virtual-memory-layout-verstehen","Virtual Memory Layout verstehen",{"depth":47,"slug":535,"text":536},"process-internals-und-strukturen","Process Internals und Strukturen",{"depth":54,"slug":538,"text":539},"process-control-blocks-pcb","Process Control Blocks (PCB)",{"depth":54,"slug":541,"text":542},"thread-control-blocks-tcb","Thread Control Blocks (TCB)",{"depth":47,"slug":544,"text":545},"advanced-malware-detection-techniken","Advanced Malware Detection Techniken",{"depth":54,"slug":547,"text":548},"process-injection-erkennung","Process Injection Erkennung",{"depth":550,"slug":551,"text":552},4,"dll-injection-detection","DLL Injection Detection",{"depth":550,"slug":554,"text":555},"process-hollowing-detection","Process Hollowing Detection",{"depth":550,"slug":557,"text":558},"process-ghosting-detection","Process Ghosting Detection",{"depth":54,"slug":560,"text":561},"dll-hollowing-und-memory-manipulation","DLL Hollowing und Memory Manipulation",{"depth":47,"slug":563,"text":564},"kernel-level-analysis","Kernel-Level Analysis",{"depth":54,"slug":566,"text":567},"system-call-hooking-detection","System Call Hooking Detection",{"depth":54,"slug":569,"text":570},"driver-analysis","Driver Analysis",{"depth":54,"slug":572,"text":573},"rootkit-detection-methoden","Rootkit Detection Methoden",{"depth":550,"slug":575,"text":576},"direct-kernel-object-manipulation-dkom","Direct Kernel Object Manipulation (DKOM)",{"depth":550,"slug":578,"text":579},"eprocess-link-manipulation","EPROCESS Link Manipulation",{"depth":47,"slug":581,"text":582},"memory-dump-acquisition-strategien","Memory Dump Acquisition Strategien",{"depth":54,"slug":584,"text":585},"live-memory-acquisition","Live Memory Acquisition",{"depth":54,"slug":587,"text":588},"memory-acquisition-challenges","Memory Acquisition Challenges",{"depth":47,"slug":590,"text":591},"address-space-reconstruction","Address Space Reconstruction",{"depth":54,"slug":593,"text":594},"virtual-address-translation","Virtual Address Translation",{"depth":54,"slug":596,"text":597},"memory-mapping-analysis","Memory Mapping Analysis",{"depth":47,"slug":599,"text":600},"cross-platform-memory-forensics","Cross-Platform Memory Forensics",{"depth":54,"slug":602,"text":603},"windows-specific-artefakte","Windows-Specific Artefakte",{"depth":54,"slug":605,"text":606},"linux-specific-artefakte","Linux-Specific Artefakte",{"depth":54,"slug":608,"text":609},"macos-memory-forensics","macOS Memory Forensics",{"depth":47,"slug":611,"text":612},"live-analysis-vs-dead-analysis","Live Analysis vs. Dead Analysis",{"depth":54,"slug":614,"text":615},"live-memory-analysis","Live Memory Analysis",{"depth":54,"slug":617,"text":618},"dead-memory-analysis","Dead Memory Analysis",{"depth":47,"slug":620,"text":621},"encrypted-memory-handling","Encrypted Memory Handling",{"depth":54,"slug":623,"text":624},"windows-bitlocker-memory","Windows BitLocker Memory",{"depth":54,"slug":626,"text":627},"full-memory-encryption-tme","Full Memory Encryption (TME)",{"depth":47,"slug":629,"text":630},"advanced-analysis-techniken","Advanced Analysis Techniken",{"depth":54,"slug":632,"text":633},"machine-learning-in-memory-forensics","Machine Learning in Memory Forensics",{"depth":54,"slug":635,"text":636},"timeline-reconstruction","Timeline Reconstruction",{"depth":54,"slug":638,"text":639},"memory-forensics-automation","Memory Forensics Automation",{"depth":47,"slug":292,"text":293},{"depth":54,"slug":642,"text":643},"anti-forensic-techniken","Anti-Forensic Techniken",{"depth":54,"slug":645,"text":646},"performance-optimierung","Performance Optimierung",{"depth":47,"slug":648,"text":649},"tools-und-framework-integration","Tools und Framework Integration",{"depth":54,"slug":651,"text":652},"volatility-3-framework","Volatility 3 Framework",{"depth":54,"slug":654,"text":655},"integration-mit-siem-systemen","Integration mit SIEM-Systemen",{"depth":47,"slug":657,"text":658},"best-practices-und-empfehlungen","Best Practices und Empfehlungen",{"depth":54,"slug":660,"text":661},"forensic-methodology","Forensic Methodology",{"depth":54,"slug":663,"text":664},"quality-assurance","Quality Assurance",{"depth":47,"slug":163,"text":164},{"depth":47,"slug":166,"text":167},[],[],{"title":493,"description":494,"author":18,"last_updated":670,"difficulty":19,"categories":671,"tags":672,"related_tools":673,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,502,503],[505,506,507,508,509,510,511,512,513,514,515],[497,498,499,500],[],"concept-memory-forensics.md","concept-network-protocols",{"id":676,"data":678,"body":699,"filePath":700,"digest":701,"rendered":702,"legacyId":845},{"title":679,"description":680,"last_updated":681,"tool_name":682,"related_tools":683,"author":18,"difficulty":189,"categories":687,"tags":688,"published":34,"gated_content":35},"Netzwerkprotokoll-Analyse für forensische Untersuchungen","Umfassender Leitfaden zur forensischen Analyse von Netzwerkprotokollen Layer 2-7, Session-Rekonstruktion aus PCAP-Dateien, C2-Kommunikations-Pattern-Erkennung und APT-Hunting-Techniken für Incident Response.",["Date","2025-08-10T00:00:00.000Z"],"Network Protocols & Packet Analysis",[684,685,686],"Wireshark","NetworkMiner","tcpdump",[191,193,352],[689,690,691,692,693,694,695,696,697,698],"protocol-analysis","packet-inspection","session-reconstruction","c2-analysis","traffic-patterns","network-baseline","payload-extraction","anomaly-detection","incident-response","apt-hunting","# Netzwerkprotokoll-Analyse für forensische Untersuchungen\n\nDie forensische Analyse von Netzwerkprotokollen ist ein fundamentaler Baustein moderner Incident Response und APT-Hunting-Aktivitäten. Dieser Leitfaden vermittelt systematische Methoden zur Untersuchung von Netzwerkverkehr von Layer 2 bis Layer 7 des OSI-Modells.\n\n## Warum Netzwerkprotokoll-Forensik?\n\nIn komplexen Cyberangriffen hinterlassen Angreifer Spuren in der Netzwerkkommunikation, die oft die einzigen verfügbaren Beweise darstellen. Command & Control (C2) Kommunikation, Datenexfiltration und laterale Bewegungen manifestieren sich als charakteristische Netzwerkmuster, die durch systematische Protokoll-Analyse erkennbar werden.\n\n## Voraussetzungen\n\n### Technische Kenntnisse\n- Grundverständnis des OSI-7-Schichten-Modells\n- TCP/IP-Stack-Funktionsweise\n- HTTP/HTTPS-Request/Response-Struktur\n- DNS-Query-Mechanismen\n- Grundlagen der Kryptographie (TLS/SSL)\n\n### Systemanforderungen\n- Wireshark 4.0+ oder vergleichbare Packet-Analyzer\n- Leistungsfähiges System für große PCAP-Analysen (16GB+ RAM)\n- NetworkMiner oder ähnliche Session-Rekonstruktions-Tools\n- Python 3.8+ für Automatisierungsskripte\n\n### Rechtliche Überlegungen\n- Erforderliche Genehmigungen für Netzwerk-Monitoring\n- Datenschutzbestimmungen bei der Payload-Analyse\n- Chain-of-Custody-Anforderungen für Netzwerk-Evidence\n\n## Fundamentale Protokoll-Analyse-Methodik\n\n### Layer 2 - Data Link Layer Forensik\n\n**Ethernet-Frame-Analyse für Asset-Discovery:**\n\n```bash\n# MAC-Adressen-Inventarisierung aus PCAP\ntshark -r capture.pcap -T fields -e eth.src -e eth.dst | sort -u\n```\n\n**Switch-Infrastruktur-Mapping:**\n- Spanning Tree Protocol (STP) Topologie-Rekonstruktion\n- VLAN-Segmentierung-Analyse\n- ARP-Spoofing-Detection durch MAC-IP-Binding-Inkonsistenzen\n\n**Kritische Anomalien:**\n- Unerwartete MAC-Präfixe (OUI-Analysis)\n- ARP-Reply ohne vorhergehende ARP-Request\n- Broadcast-Storm-Patterns bei DDoS-Aktivitäten\n\n### Layer 3 - Network Layer Investigation\n\n**IP-Header-Forensik für Geolocation und Routing:**\n\n```python\n# IP-Geolocation-Mapping mit Python\nimport ipaddress\nfrom geolite2 import geolite2\n\ndef analyze_ip_origins(pcap_ips):\n reader = geolite2.reader()\n for ip in pcap_ips:\n if not ipaddress.ip_address(ip).is_private:\n location = reader.get(ip)\n print(f\"{ip}: {location['country']['names']['en']}\")\n```\n\n**TTL-Fingerprinting für OS-Detection:**\n- Windows: TTL 128 (typisch 128, 64, 32)\n- Linux/Unix: TTL 64\n- Cisco/Network-Equipment: TTL 255\n\n**Fragmentierungs-Analyse:**\n- Evil Fragmentation für IDS-Evasion\n- Teardrop-Attack-Patterns\n- Fragment-Overlap-Anomalien\n\n### Layer 4 - Transport Layer Forensik\n\n**TCP-Session-Rekonstruktion:**\n\n```bash\n# TCP-Streams extrahieren und analysieren\ntshark -r capture.pcap -q -z follow,tcp,ascii,0\n```\n\n**TCP-Fingerprinting-Techniken:**\n- Initial Window Size (IWS) Analysis\n- TCP-Options-Sequenz-Patterns\n- Maximum Segment Size (MSS) Charakteristika\n\n**UDP-Traffic-Anomalien:**\n- DNS-Tunneling über ungewöhnliche Record-Types\n- VoIP-Protokoll-Missbrauch für Datenexfiltration\n- TFTP-basierte Malware-Distribution\n\n## HTTP/HTTPS-Forensik für Web-basierte Angriffe\n\n### HTTP-Header-Deep-Dive\n\n**User-Agent-String-Forensik:**\n```python\n# Verdächtige User-Agent-Patterns\nsuspicious_agents = [\n \"curl/\", # Command-line tools\n \"python-requests\", # Scripted access\n \"Nikto\", # Vulnerability scanners\n \"sqlmap\" # SQL injection tools\n]\n```\n\n**HTTP-Method-Anomalien:**\n- PUT/DELETE-Requests auf produktiven Servern\n- TRACE-Method für XSS-Exploitation\n- Nicht-standard Methods (PATCH, OPTIONS) Analysis\n\n**Content-Type-Diskrepanzen:**\n- Executable-Content mit image/jpeg MIME-Type\n- JavaScript-Code in PDF-Dateien\n- Suspicious Content-Length vs. Actual-Payload-Size\n\n### HTTPS-Traffic-Analysis ohne Decryption\n\n**TLS-Handshake-Fingerprinting:**\n```bash\n# TLS-Version und Cipher-Suite-Analyse\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" \\\n -T fields -e tls.handshake.version -e tls.handshake.ciphersuites\n```\n\n**Certificate-Chain-Investigation:**\n- Self-signed Certificate-Anomalien\n- Certificate-Transparency-Log-Validation\n- Subject Alternative Name (SAN) Missbrauch\n\n**Encrypted-Traffic-Patterns:**\n- Packet-Size-Distribution-Analysis\n- Inter-arrival-Time-Patterns\n- Burst-Communication vs. Steady-State-Traffic\n\n## DNS-Forensik und Tunneling-Detection\n\n### DNS-Query-Pattern-Analysis\n\n**DNS-Tunneling-Indicators:**\n```python\n# DNS-Query-Length-Distribution-Analysis\ndef analyze_dns_queries(pcap_file):\n queries = extract_dns_queries(pcap_file)\n avg_length = sum(len(q) for q in queries) / len(queries)\n \n # Normal DNS: 15-30 chars, Tunneling: 50+ chars\n if avg_length > 50:\n return \"POTENTIAL_TUNNELING\"\n```\n\n**Subdomain-Enumeration-Detection:**\n- Excessive NXDOMAIN-Responses\n- Sequential-Subdomain-Queries\n- High-Entropy-Subdomain-Names\n\n**DNS-over-HTTPS (DoH) Investigation:**\n- DoH-Provider-Identification (Cloudflare, Google, Quad9)\n- Encrypted-DNS-vs-Clear-DNS-Ratio-Analysis\n- Bootstrap-DNS-Query-Patterns\n\n## Command & Control (C2) Communication-Patterns\n\n### C2-Channel-Identification\n\n**HTTP-basierte C2-Kommunikation:**\n```bash\n# Beaconing-Pattern-Detection\ntshark -r capture.pcap -T fields -e frame.time_epoch -e ip.dst \\\n -Y \"http\" | awk 'script für regelmäßige Intervalle'\n```\n\n**Timing-Analysis für Beaconing:**\n- Jitter-Analyse bei Sleep-Intervallen\n- Callback-Frequency-Patterns\n- Network-Outage-Response-Behavior\n\n**Payload-Obfuscation-Techniques:**\n- Base64-encoded Commands in HTTP-Bodies\n- Steganographie in Bilddateien\n- JSON/XML-Structure-Abuse für Command-Transport\n\n### Advanced Persistent Threat (APT) Network-Signatures\n\n**Long-Duration-Connection-Analysis:**\n```python\n# Langzeit-Verbindungs-Identifikation\ndef find_persistent_connections(pcap_data):\n for session in tcp_sessions:\n duration = session.end_time - session.start_time\n if duration > timedelta(hours=24):\n analyze_session_behavior(session)\n```\n\n**Multi-Stage-Payload-Delivery:**\n- Initial-Compromise-Vector-Analysis\n- Secondary-Payload-Download-Patterns\n- Lateral-Movement-Network-Signatures\n\n## Protokoll-Anomalie-Detection-Algorithmen\n\n### Statistical-Baseline-Establishment\n\n**Traffic-Volume-Baselines:**\n```python\n# Netzwerk-Baseline-Erstellung\ndef establish_baseline(historical_data):\n baseline = {\n 'avg_bandwidth': calculate_average_bps(historical_data),\n 'peak_hours': identify_peak_traffic_windows(historical_data),\n 'protocol_distribution': analyze_protocol_ratios(historical_data)\n }\n return baseline\n```\n\n**Port-Usage-Pattern-Analysis:**\n- Unexpected-Port-Combinations\n- High-Port-Range-Communication (> 32768)\n- Service-Port-Mismatches (HTTP on Port 443 without TLS)\n\n### Machine-Learning-Enhanced-Detection\n\n**Traffic-Classification-Models:**\n- Protocol-Identification via Payload-Analysis\n- Encrypted-Traffic-Classification\n- Anomaly-Score-Calculation für Unknown-Traffic\n\n## Session-Rekonstruktion und Payload-Extraktion\n\n### TCP-Stream-Reassembly\n\n**Bidirectional-Communication-Timeline:**\n```bash\n# Vollständige Session-Rekonstruktion\nmkdir session_analysis\ncd session_analysis\n\n# TCP-Streams einzeln extrahieren\nfor stream in $(tshark -r ../capture.pcap -T fields -e tcp.stream | sort -u); do\n tshark -r ../capture.pcap -q -z follow,tcp,raw,$stream > stream_$stream.raw\ndone\n```\n\n**File-Carving aus Network-Streams:**\n- HTTP-File-Download-Reconstruction\n- Email-Attachment-Extraction via SMTP/POP3\n- FTP-Data-Channel-File-Recovery\n\n### Application-Layer-Protocol-Parsing\n\n**Custom-Protocol-Analysis:**\n```python\n# Proprietary-Protocol-Reverse-Engineering\ndef analyze_custom_protocol(payload):\n # Header-Structure-Identification\n if len(payload) > 8:\n magic_bytes = payload[:4]\n length_field = struct.unpack('>I', payload[4:8])[0]\n \n if validate_structure(magic_bytes, length_field, payload):\n return parse_protocol_fields(payload)\n```\n\n## Verschlüsselte Protokoll-Forensik\n\n### TLS/SSL-Traffic-Analysis\n\n**Certificate-Chain-Validation:**\n```bash\n# Certificate-Extraktion aus PCAP\ntshark -r capture.pcap -Y \"tls.handshake.certificate\" \\\n -T fields -e tls.handshake.certificate > certificates.hex\n\n# Certificate-Parsing\nxxd -r -p certificates.hex | openssl x509 -inform DER -text\n```\n\n**TLS-Version-Downgrade-Attacks:**\n- Forced-SSLv3-Negotiation-Detection\n- Weak-Cipher-Suite-Selection-Patterns\n- Certificate-Pinning-Bypass-Indicators\n\n### VPN-Traffic-Characterization\n\n**VPN-Protocol-Identification:**\n- OpenVPN: UDP Port 1194, specific packet-patterns\n- IPSec: ESP (Protocol 50), IKE (UDP 500)\n- WireGuard: UDP mit characteristic handshake-patterns\n\n**VPN-Tunnel-Analysis:**\n```python\n# VPN-Endpoint-Discovery\ndef identify_vpn_endpoints(pcap_data):\n potential_endpoints = []\n for packet in pcap_data:\n if detect_vpn_signature(packet):\n potential_endpoints.append(packet.src_ip)\n return analyze_endpoint_patterns(potential_endpoints)\n```\n\n## Häufige Herausforderungen und Troubleshooting\n\n### Performance-Optimierung bei großen PCAP-Dateien\n\n**Memory-Management:**\n```bash\n# Große PCAP-Dateien in kleinere Segmente aufteilen\neditcap -c 100000 large_capture.pcap segment.pcap\n\n# Zeitbasierte Segmentierung\neditcap -A \"2024-01-01 00:00:00\" -B \"2024-01-01 01:00:00\" \\\n large_capture.pcap hour_segment.pcap\n```\n\n**Selective-Filtering:**\n```bash\n# Nur relevanten Traffic extrahieren\ntshark -r large_capture.pcap -w filtered.pcap \\\n -Y \"ip.addr == 192.168.1.100 or dns or http\"\n```\n\n### False-Positive-Reduction\n\n**Legitimate-Traffic-Whitelisting:**\n- Corporate-Application-Signatures\n- Known-Good-Certificate-Authorities\n- Approved-Remote-Access-Solutions\n\n**Context-Aware-Analysis:**\n```python\n# Business-Context-Integration\ndef validate_alert(network_event, business_context):\n if is_maintenance_window(network_event.timestamp):\n return False\n if is_authorized_admin(network_event.source_ip):\n return validate_admin_action(network_event)\n return True\n```\n\n## Praktische Anwendungsszenarien\n\n### Szenario 1: Data Exfiltration Detection\n\n**Ausgangslage:** Verdacht auf Datendiebstahl aus dem Unternehmensnetzwerk\n\n**Analyse-Workflow:**\n1. **Baseline-Establishment:** Normale ausgehende Datenvolumen ermitteln\n2. **Spike-Detection:** Ungewöhnlich hohe Upload-Aktivitäten identifizieren\n3. **Destination-Analysis:** Externe Ziele der Datenübertragungen\n4. **Content-Classification:** Art der übertragenen Daten (soweit möglich)\n\n```bash\n# Ausgehende Datenvolumen-Analyse\ntshark -r capture.pcap -q -z io,stat,300 \\\n -Y \"ip.src == 192.168.0.0/16 and ip.dst != 192.168.0.0/16\"\n```\n\n### Szenario 2: APT-Lateral-Movement-Investigation\n\n**Ausgangslage:** Kompromittierter Host, Verdacht auf laterale Bewegung\n\n**Detection-Methoden:**\n- SMB-Authentication-Patterns (Pass-the-Hash-Attacks)\n- RDP-Session-Establishment-Chains\n- WMI/PowerShell-Remote-Execution-Signatures\n\n```python\n# Lateral-Movement-Timeline-Construction\ndef construct_movement_timeline(network_data):\n timeline = []\n for connection in extract_internal_connections(network_data):\n if detect_admin_protocols(connection):\n timeline.append({\n 'timestamp': connection.start_time,\n 'source': connection.src_ip,\n 'target': connection.dst_ip,\n 'protocol': connection.protocol,\n 'confidence': calculate_suspicion_score(connection)\n })\n return sort_by_timestamp(timeline)\n```\n\n### Szenario 3: Malware C2 Communication Analysis\n\n**Ausgangslage:** Identifizierte Malware-Infection, C2-Channel-Mapping erforderlich\n\n**Systematic C2-Analysis:**\n1. **Beaconing-Pattern-Identification**\n2. **C2-Server-Geolocation**\n3. **Command-Structure-Reverse-Engineering**\n4. **Kill-Chain-Reconstruction**\n\n```bash\n# C2-Communication-Timeline\ntshark -r malware_capture.pcap -T fields \\\n -e frame.time -e ip.src -e ip.dst -e tcp.dstport \\\n -Y \"ip.src == \u003Cinfected_host>\" | \\\n awk '{print $1, $4}' | sort | uniq -c\n```\n\n## Erweiterte Analyse-Techniken\n\n### Protocol-State-Machine-Analysis\n\n**TCP-State-Tracking:**\n```python\nclass TCPStateAnalyzer:\n def __init__(self):\n self.connections = {}\n \n def process_packet(self, packet):\n key = (packet.src_ip, packet.src_port, packet.dst_ip, packet.dst_port)\n \n if key not in self.connections:\n self.connections[key] = TCPConnection()\n \n conn = self.connections[key]\n conn.update_state(packet.tcp_flags)\n \n if conn.is_anomalous():\n self.flag_suspicious_connection(key, conn)\n```\n\n**Application-Protocol-State-Validation:**\n- HTTP-Request/Response-Pairing-Validation\n- DNS-Query/Response-Correlation\n- SMTP-Session-Command-Sequence-Analysis\n\n### Geospatial-Network-Analysis\n\n**IP-Geolocation-Correlation:**\n```python\n# Geographische Anomalie-Detection\ndef detect_geographic_anomalies(connections):\n for conn in connections:\n src_country = geolocate_ip(conn.src_ip)\n dst_country = geolocate_ip(conn.dst_ip)\n \n if calculate_distance(src_country, dst_country) > 10000: # km\n if not is_known_global_service(conn.dst_ip):\n flag_suspicious_connection(conn)\n```\n\n## Automatisierung und Tool-Integration\n\n### SIEM-Integration\n\n**Log-Format-Standardization:**\n```python\n# Network-Events zu SIEM-Format\ndef convert_to_siem_format(network_event):\n return {\n 'timestamp': network_event.time_iso,\n 'event_type': 'network_connection',\n 'source_ip': network_event.src_ip,\n 'destination_ip': network_event.dst_ip,\n 'protocol': network_event.protocol,\n 'risk_score': calculate_risk_score(network_event),\n 'indicators': extract_iocs(network_event)\n }\n```\n\n### Threat-Intelligence-Integration\n\n**IOC-Matching:**\n```bash\n# Threat-Feed-Integration\ncurl -s \"https://threatfeed.example.com/api/ips\" | \\\ntee threat_ips.txt\n\ntshark -r capture.pcap -T fields -e ip.dst | \\\nsort -u | \\\ngrep -f threat_ips.txt\n```\n\n## Nächste Schritte und Vertiefung\n\n### Weiterführende Analyse-Techniken\n- **Behavioral-Analysis:** Machine-Learning-basierte Anomalie-Detection\n- **Graph-Analysis:** Netzwerk-Relationship-Mapping\n- **Temporal-Analysis:** Time-Series-basierte Pattern-Recognition\n\n### Spezialisierung-Richtungen\n- **Cloud-Network-Forensics:** AWS VPC Flow Logs, Azure NSG Analysis\n- **IoT-Network-Analysis:** Constrained-Device-Communication-Patterns\n- **Industrial-Network-Security:** SCADA/Modbus-Protocol-Forensics\n\n### Tool-Ecosystem-Erweiterung\n- **Zeek (Bro):** Scriptable Network Security Monitor\n- **Suricata:** IDS/IPS mit Network-Forensik-Capabilities\n- **Moloch:** Full-Packet-Capture und Search-Platform\n\nDie systematische Netzwerkprotokoll-Analyse bildet das Fundament moderner Cyber-Forensik. Durch die Kombination von Deep-Protocol-Knowledge, statistischer Analyse und Threat-Intelligence entsteht ein mächtiges Arsenal für die Aufdeckung und Untersuchung von Cyberangriffen.\n\n**Empfohlene Übungen:**\n1. Analysieren Sie einen selbst erzeugten Netzwerk-Capture mit bekanntem \"böswilligem\" Traffic\n2. Implementieren Sie ein automatisiertes C2-Detection-Script\n3. Führen Sie eine komplette APT-Simulation durch und dokumentieren Sie die Netzwerk-Artefakte\n\nDie kontinuierliche Weiterentwicklung von Angriffstechniken erfordert permanente Aktualisierung der Analyse-Methoden. Bleiben Sie über aktuelle Threat-Research und neue Protocol-Exploitation-Techniques informiert.","src/content/knowledgebase/concept-network-protocols.md","249ee3ccf131daee",{"html":703,"metadata":704},"\u003Ch1 id=\"netzwerkprotokoll-analyse-für-forensische-untersuchungen\">Netzwerkprotokoll-Analyse für forensische Untersuchungen\u003C/h1>\n\u003Cp>Die forensische Analyse von Netzwerkprotokollen ist ein fundamentaler Baustein moderner Incident Response und APT-Hunting-Aktivitäten. Dieser Leitfaden vermittelt systematische Methoden zur Untersuchung von Netzwerkverkehr von Layer 2 bis Layer 7 des OSI-Modells.\u003C/p>\n\u003Ch2 id=\"warum-netzwerkprotokoll-forensik\">Warum Netzwerkprotokoll-Forensik?\u003C/h2>\n\u003Cp>In komplexen Cyberangriffen hinterlassen Angreifer Spuren in der Netzwerkkommunikation, die oft die einzigen verfügbaren Beweise darstellen. Command & Control (C2) Kommunikation, Datenexfiltration und laterale Bewegungen manifestieren sich als charakteristische Netzwerkmuster, die durch systematische Protokoll-Analyse erkennbar werden.\u003C/p>\n\u003Ch2 id=\"voraussetzungen\">Voraussetzungen\u003C/h2>\n\u003Ch3 id=\"technische-kenntnisse\">Technische Kenntnisse\u003C/h3>\n\u003Cul>\n\u003Cli>Grundverständnis des OSI-7-Schichten-Modells\u003C/li>\n\u003Cli>TCP/IP-Stack-Funktionsweise\u003C/li>\n\u003Cli>HTTP/HTTPS-Request/Response-Struktur\u003C/li>\n\u003Cli>DNS-Query-Mechanismen\u003C/li>\n\u003Cli>Grundlagen der Kryptographie (TLS/SSL)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"systemanforderungen\">Systemanforderungen\u003C/h3>\n\u003Cul>\n\u003Cli>Wireshark 4.0+ oder vergleichbare Packet-Analyzer\u003C/li>\n\u003Cli>Leistungsfähiges System für große PCAP-Analysen (16GB+ RAM)\u003C/li>\n\u003Cli>NetworkMiner oder ähnliche Session-Rekonstruktions-Tools\u003C/li>\n\u003Cli>Python 3.8+ für Automatisierungsskripte\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"rechtliche-überlegungen\">Rechtliche Überlegungen\u003C/h3>\n\u003Cul>\n\u003Cli>Erforderliche Genehmigungen für Netzwerk-Monitoring\u003C/li>\n\u003Cli>Datenschutzbestimmungen bei der Payload-Analyse\u003C/li>\n\u003Cli>Chain-of-Custody-Anforderungen für Netzwerk-Evidence\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"fundamentale-protokoll-analyse-methodik\">Fundamentale Protokoll-Analyse-Methodik\u003C/h2>\n\u003Ch3 id=\"layer-2---data-link-layer-forensik\">Layer 2 - Data Link Layer Forensik\u003C/h3>\n\u003Cp>\u003Cstrong>Ethernet-Frame-Analyse für Asset-Discovery:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MAC-Adressen-Inventarisierung aus PCAP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> eth.src\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> eth.dst\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Switch-Infrastruktur-Mapping:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Spanning Tree Protocol (STP) Topologie-Rekonstruktion\u003C/li>\n\u003Cli>VLAN-Segmentierung-Analyse\u003C/li>\n\u003Cli>ARP-Spoofing-Detection durch MAC-IP-Binding-Inkonsistenzen\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Kritische Anomalien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Unerwartete MAC-Präfixe (OUI-Analysis)\u003C/li>\n\u003Cli>ARP-Reply ohne vorhergehende ARP-Request\u003C/li>\n\u003Cli>Broadcast-Storm-Patterns bei DDoS-Aktivitäten\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"layer-3---network-layer-investigation\">Layer 3 - Network Layer Investigation\u003C/h3>\n\u003Cp>\u003Cstrong>IP-Header-Forensik für Geolocation und Routing:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># IP-Geolocation-Mapping mit Python\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ipaddress\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> geolite2 \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> geolite2\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_ip_origins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pcap_ips):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> reader \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> geolite2.reader()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ip \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pcap_ips:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#F97583\"> not\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ipaddress.ip_address(ip).is_private:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> location \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> reader.get(ip)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> print\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">ip\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">: \u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">location[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'country'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">][\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'names'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">][\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'en'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>TTL-Fingerprinting für OS-Detection:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Windows: TTL 128 (typisch 128, 64, 32)\u003C/li>\n\u003Cli>Linux/Unix: TTL 64\u003C/li>\n\u003Cli>Cisco/Network-Equipment: TTL 255\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Fragmentierungs-Analyse:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Evil Fragmentation für IDS-Evasion\u003C/li>\n\u003Cli>Teardrop-Attack-Patterns\u003C/li>\n\u003Cli>Fragment-Overlap-Anomalien\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"layer-4---transport-layer-forensik\">Layer 4 - Transport Layer Forensik\u003C/h3>\n\u003Cp>\u003Cstrong>TCP-Session-Rekonstruktion:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># TCP-Streams extrahieren und analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -q\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -z\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> follow,tcp,ascii,0\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>TCP-Fingerprinting-Techniken:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Initial Window Size (IWS) Analysis\u003C/li>\n\u003Cli>TCP-Options-Sequenz-Patterns\u003C/li>\n\u003Cli>Maximum Segment Size (MSS) Charakteristika\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>UDP-Traffic-Anomalien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>DNS-Tunneling über ungewöhnliche Record-Types\u003C/li>\n\u003Cli>VoIP-Protokoll-Missbrauch für Datenexfiltration\u003C/li>\n\u003Cli>TFTP-basierte Malware-Distribution\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"httphttps-forensik-für-web-basierte-angriffe\">HTTP/HTTPS-Forensik für Web-basierte Angriffe\u003C/h2>\n\u003Ch3 id=\"http-header-deep-dive\">HTTP-Header-Deep-Dive\u003C/h3>\n\u003Cp>\u003Cstrong>User-Agent-String-Forensik:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verdächtige User-Agent-Patterns\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">suspicious_agents \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"curl/\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#6A737D\"># Command-line tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"python-requests\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#6A737D\"># Scripted access\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"Nikto\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#6A737D\"># Vulnerability scanners\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"sqlmap\"\u003C/span>\u003Cspan style=\"color:#6A737D\"> # SQL injection tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>HTTP-Method-Anomalien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>PUT/DELETE-Requests auf produktiven Servern\u003C/li>\n\u003Cli>TRACE-Method für XSS-Exploitation\u003C/li>\n\u003Cli>Nicht-standard Methods (PATCH, OPTIONS) Analysis\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Content-Type-Diskrepanzen:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Executable-Content mit image/jpeg MIME-Type\u003C/li>\n\u003Cli>JavaScript-Code in PDF-Dateien\u003C/li>\n\u003Cli>Suspicious Content-Length vs. Actual-Payload-Size\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"https-traffic-analysis-ohne-decryption\">HTTPS-Traffic-Analysis ohne Decryption\u003C/h3>\n\u003Cp>\u003Cstrong>TLS-Handshake-Fingerprinting:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># TLS-Version und Cipher-Suite-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"tls.handshake.type == 1\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tls.handshake.version\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tls.handshake.ciphersuites\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Certificate-Chain-Investigation:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Self-signed Certificate-Anomalien\u003C/li>\n\u003Cli>Certificate-Transparency-Log-Validation\u003C/li>\n\u003Cli>Subject Alternative Name (SAN) Missbrauch\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Encrypted-Traffic-Patterns:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Packet-Size-Distribution-Analysis\u003C/li>\n\u003Cli>Inter-arrival-Time-Patterns\u003C/li>\n\u003Cli>Burst-Communication vs. Steady-State-Traffic\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"dns-forensik-und-tunneling-detection\">DNS-Forensik und Tunneling-Detection\u003C/h2>\n\u003Ch3 id=\"dns-query-pattern-analysis\">DNS-Query-Pattern-Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>DNS-Tunneling-Indicators:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># DNS-Query-Length-Distribution-Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_dns_queries\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pcap_file):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> queries \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> extract_dns_queries(pcap_file)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> avg_length \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> sum\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(q) \u003C/span>\u003Cspan style=\"color:#F97583\">for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> q \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> queries) \u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\"> len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(queries)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Normal DNS: 15-30 chars, Tunneling: 50+ chars\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> avg_length \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 50\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"POTENTIAL_TUNNELING\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Subdomain-Enumeration-Detection:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Excessive NXDOMAIN-Responses\u003C/li>\n\u003Cli>Sequential-Subdomain-Queries\u003C/li>\n\u003Cli>High-Entropy-Subdomain-Names\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>DNS-over-HTTPS (DoH) Investigation:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>DoH-Provider-Identification (Cloudflare, Google, Quad9)\u003C/li>\n\u003Cli>Encrypted-DNS-vs-Clear-DNS-Ratio-Analysis\u003C/li>\n\u003Cli>Bootstrap-DNS-Query-Patterns\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"command--control-c2-communication-patterns\">Command & Control (C2) Communication-Patterns\u003C/h2>\n\u003Ch3 id=\"c2-channel-identification\">C2-Channel-Identification\u003C/h3>\n\u003Cp>\u003Cstrong>HTTP-basierte C2-Kommunikation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Beaconing-Pattern-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frame.time_epoch\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ip.dst\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"http\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> awk\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'script für regelmäßige Intervalle'\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Timing-Analysis für Beaconing:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Jitter-Analyse bei Sleep-Intervallen\u003C/li>\n\u003Cli>Callback-Frequency-Patterns\u003C/li>\n\u003Cli>Network-Outage-Response-Behavior\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Payload-Obfuscation-Techniques:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Base64-encoded Commands in HTTP-Bodies\u003C/li>\n\u003Cli>Steganographie in Bilddateien\u003C/li>\n\u003Cli>JSON/XML-Structure-Abuse für Command-Transport\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"advanced-persistent-threat-apt-network-signatures\">Advanced Persistent Threat (APT) Network-Signatures\u003C/h3>\n\u003Cp>\u003Cstrong>Long-Duration-Connection-Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Langzeit-Verbindungs-Identifikation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> find_persistent_connections\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pcap_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> session \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> tcp_sessions:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> duration \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> session.end_time \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> session.start_time\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> duration \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timedelta(\u003C/span>\u003Cspan style=\"color:#FFAB70\">hours\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">24\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> analyze_session_behavior(session)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Multi-Stage-Payload-Delivery:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Initial-Compromise-Vector-Analysis\u003C/li>\n\u003Cli>Secondary-Payload-Download-Patterns\u003C/li>\n\u003Cli>Lateral-Movement-Network-Signatures\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"protokoll-anomalie-detection-algorithmen\">Protokoll-Anomalie-Detection-Algorithmen\u003C/h2>\n\u003Ch3 id=\"statistical-baseline-establishment\">Statistical-Baseline-Establishment\u003C/h3>\n\u003Cp>\u003Cstrong>Traffic-Volume-Baselines:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Netzwerk-Baseline-Erstellung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> establish_baseline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(historical_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> baseline \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'avg_bandwidth'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: calculate_average_bps(historical_data),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'peak_hours'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: identify_peak_traffic_windows(historical_data),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'protocol_distribution'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: analyze_protocol_ratios(historical_data)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> baseline\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Port-Usage-Pattern-Analysis:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Unexpected-Port-Combinations\u003C/li>\n\u003Cli>High-Port-Range-Communication (> 32768)\u003C/li>\n\u003Cli>Service-Port-Mismatches (HTTP on Port 443 without TLS)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"machine-learning-enhanced-detection\">Machine-Learning-Enhanced-Detection\u003C/h3>\n\u003Cp>\u003Cstrong>Traffic-Classification-Models:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Protocol-Identification via Payload-Analysis\u003C/li>\n\u003Cli>Encrypted-Traffic-Classification\u003C/li>\n\u003Cli>Anomaly-Score-Calculation für Unknown-Traffic\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"session-rekonstruktion-und-payload-extraktion\">Session-Rekonstruktion und Payload-Extraktion\u003C/h2>\n\u003Ch3 id=\"tcp-stream-reassembly\">TCP-Stream-Reassembly\u003C/h3>\n\u003Cp>\u003Cstrong>Bidirectional-Communication-Timeline:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständige Session-Rekonstruktion\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mkdir\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> session_analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> session_analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># TCP-Streams einzeln extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stream \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $(\u003C/span>\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ../capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tcp.stream\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003Cspan style=\"color:#E1E4E8\">); \u003C/span>\u003Cspan style=\"color:#F97583\">do\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ../capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -q\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -z\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> follow,tcp,raw,\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$stream \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> stream_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$stream\u003C/span>\u003Cspan style=\"color:#9ECBFF\">.raw\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">done\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>File-Carving aus Network-Streams:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>HTTP-File-Download-Reconstruction\u003C/li>\n\u003Cli>Email-Attachment-Extraction via SMTP/POP3\u003C/li>\n\u003Cli>FTP-Data-Channel-File-Recovery\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"application-layer-protocol-parsing\">Application-Layer-Protocol-Parsing\u003C/h3>\n\u003Cp>\u003Cstrong>Custom-Protocol-Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Proprietary-Protocol-Reverse-Engineering\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_custom_protocol\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(payload):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Header-Structure-Identification\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#79B8FF\"> len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(payload) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 8\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> magic_bytes \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> payload[:\u003C/span>\u003Cspan style=\"color:#79B8FF\">4\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> length_field \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> struct.unpack(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'>I'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, payload[\u003C/span>\u003Cspan style=\"color:#79B8FF\">4\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">8\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])[\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> validate_structure(magic_bytes, length_field, payload):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> parse_protocol_fields(payload)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"verschlüsselte-protokoll-forensik\">Verschlüsselte Protokoll-Forensik\u003C/h2>\n\u003Ch3 id=\"tlsssl-traffic-analysis\">TLS/SSL-Traffic-Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>Certificate-Chain-Validation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Certificate-Extraktion aus PCAP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"tls.handshake.certificate\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tls.handshake.certificate\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> certificates.hex\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Certificate-Parsing\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">xxd\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -p\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> certificates.hex\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> openssl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> x509\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -inform\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> DER\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -text\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>TLS-Version-Downgrade-Attacks:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Forced-SSLv3-Negotiation-Detection\u003C/li>\n\u003Cli>Weak-Cipher-Suite-Selection-Patterns\u003C/li>\n\u003Cli>Certificate-Pinning-Bypass-Indicators\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"vpn-traffic-characterization\">VPN-Traffic-Characterization\u003C/h3>\n\u003Cp>\u003Cstrong>VPN-Protocol-Identification:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>OpenVPN: UDP Port 1194, specific packet-patterns\u003C/li>\n\u003Cli>IPSec: ESP (Protocol 50), IKE (UDP 500)\u003C/li>\n\u003Cli>WireGuard: UDP mit characteristic handshake-patterns\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>VPN-Tunnel-Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># VPN-Endpoint-Discovery\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> identify_vpn_endpoints\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pcap_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> potential_endpoints \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> packet \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pcap_data:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> detect_vpn_signature(packet):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> potential_endpoints.append(packet.src_ip)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> analyze_endpoint_patterns(potential_endpoints)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-herausforderungen-und-troubleshooting\">Häufige Herausforderungen und Troubleshooting\u003C/h2>\n\u003Ch3 id=\"performance-optimierung-bei-großen-pcap-dateien\">Performance-Optimierung bei großen PCAP-Dateien\u003C/h3>\n\u003Cp>\u003Cstrong>Memory-Management:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Große PCAP-Dateien in kleinere Segmente aufteilen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">editcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100000\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> large_capture.pcap\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> segment.pcap\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zeitbasierte Segmentierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">editcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -A\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"2024-01-01 00:00:00\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -B\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"2024-01-01 01:00:00\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> large_capture.pcap\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hour_segment.pcap\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Selective-Filtering:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Nur relevanten Traffic extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> large_capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> filtered.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ip.addr == 192.168.1.100 or dns or http\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"false-positive-reduction\">False-Positive-Reduction\u003C/h3>\n\u003Cp>\u003Cstrong>Legitimate-Traffic-Whitelisting:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Corporate-Application-Signatures\u003C/li>\n\u003Cli>Known-Good-Certificate-Authorities\u003C/li>\n\u003Cli>Approved-Remote-Access-Solutions\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Cstrong>Context-Aware-Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Business-Context-Integration\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> validate_alert\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(network_event, business_context):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> is_maintenance_window(network_event.timestamp):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> False\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> is_authorized_admin(network_event.source_ip):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> validate_admin_action(network_event)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> True\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"praktische-anwendungsszenarien\">Praktische Anwendungsszenarien\u003C/h2>\n\u003Ch3 id=\"szenario-1-data-exfiltration-detection\">Szenario 1: Data Exfiltration Detection\u003C/h3>\n\u003Cp>\u003Cstrong>Ausgangslage:\u003C/strong> Verdacht auf Datendiebstahl aus dem Unternehmensnetzwerk\u003C/p>\n\u003Cp>\u003Cstrong>Analyse-Workflow:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Baseline-Establishment:\u003C/strong> Normale ausgehende Datenvolumen ermitteln\u003C/li>\n\u003Cli>\u003Cstrong>Spike-Detection:\u003C/strong> Ungewöhnlich hohe Upload-Aktivitäten identifizieren\u003C/li>\n\u003Cli>\u003Cstrong>Destination-Analysis:\u003C/strong> Externe Ziele der Datenübertragungen\u003C/li>\n\u003Cli>\u003Cstrong>Content-Classification:\u003C/strong> Art der übertragenen Daten (soweit möglich)\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ausgehende Datenvolumen-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -q\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -z\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> io,stat,300\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ip.src == 192.168.0.0/16 and ip.dst != 192.168.0.0/16\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"szenario-2-apt-lateral-movement-investigation\">Szenario 2: APT-Lateral-Movement-Investigation\u003C/h3>\n\u003Cp>\u003Cstrong>Ausgangslage:\u003C/strong> Kompromittierter Host, Verdacht auf laterale Bewegung\u003C/p>\n\u003Cp>\u003Cstrong>Detection-Methoden:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>SMB-Authentication-Patterns (Pass-the-Hash-Attacks)\u003C/li>\n\u003Cli>RDP-Session-Establishment-Chains\u003C/li>\n\u003Cli>WMI/PowerShell-Remote-Execution-Signatures\u003C/li>\n\u003C/ul>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Lateral-Movement-Timeline-Construction\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> construct_movement_timeline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(network_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> connection \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> extract_internal_connections(network_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> detect_admin_protocols(connection):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline.append({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: connection.start_time,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'source'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: connection.src_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'target'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: connection.dst_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'protocol'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: connection.protocol,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'confidence'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: calculate_suspicion_score(connection)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> })\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sort_by_timestamp(timeline)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"szenario-3-malware-c2-communication-analysis\">Szenario 3: Malware C2 Communication Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>Ausgangslage:\u003C/strong> Identifizierte Malware-Infection, C2-Channel-Mapping erforderlich\u003C/p>\n\u003Cp>\u003Cstrong>Systematic C2-Analysis:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Beaconing-Pattern-Identification\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>C2-Server-Geolocation\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>Command-Structure-Reverse-Engineering\u003C/strong>\u003C/li>\n\u003Cli>\u003Cstrong>Kill-Chain-Reconstruction\u003C/strong>\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># C2-Communication-Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> malware_capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frame.time\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ip.src\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ip.dst\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tcp.dstport\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> -Y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ip.src == <infected_host>\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> awk\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '{print $1, $4}'\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> uniq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"erweiterte-analyse-techniken\">Erweiterte Analyse-Techniken\u003C/h2>\n\u003Ch3 id=\"protocol-state-machine-analysis\">Protocol-State-Machine-Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>TCP-State-Tracking:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> TCPStateAnalyzer\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#79B8FF\"> __init__\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.connections \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> process_packet\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, packet):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> key \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (packet.src_ip, packet.src_port, packet.dst_ip, packet.dst_port)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> key \u003C/span>\u003Cspan style=\"color:#F97583\">not\u003C/span>\u003Cspan style=\"color:#F97583\"> in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.connections:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.connections[key] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> TCPConnection()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.connections[key]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn.update_state(packet.tcp_flags)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn.is_anomalous():\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.flag_suspicious_connection(key, conn)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Application-Protocol-State-Validation:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>HTTP-Request/Response-Pairing-Validation\u003C/li>\n\u003Cli>DNS-Query/Response-Correlation\u003C/li>\n\u003Cli>SMTP-Session-Command-Sequence-Analysis\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"geospatial-network-analysis\">Geospatial-Network-Analysis\u003C/h3>\n\u003Cp>\u003Cstrong>IP-Geolocation-Correlation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Geographische Anomalie-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_geographic_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(connections):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> connections:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> src_country \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> geolocate_ip(conn.src_ip)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> dst_country \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> geolocate_ip(conn.dst_ip)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> calculate_distance(src_country, dst_country) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 10000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#6A737D\"># km\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#F97583\"> not\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> is_known_global_service(conn.dst_ip):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> flag_suspicious_connection(conn)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"automatisierung-und-tool-integration\">Automatisierung und Tool-Integration\u003C/h2>\n\u003Ch3 id=\"siem-integration\">SIEM-Integration\u003C/h3>\n\u003Cp>\u003Cstrong>Log-Format-Standardization:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Network-Events zu SIEM-Format\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> convert_to_siem_format\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(network_event):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: network_event.time_iso,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'event_type'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'network_connection'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'source_ip'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: network_event.src_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'destination_ip'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: network_event.dst_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'protocol'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: network_event.protocol,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'risk_score'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: calculate_risk_score(network_event),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'indicators'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: extract_iocs(network_event)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"threat-intelligence-integration\">Threat-Intelligence-Integration\u003C/h3>\n\u003Cp>\u003Cstrong>IOC-Matching:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Threat-Feed-Integration\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">curl\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -s\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"https://threatfeed.example.com/api/ips\"\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tee\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> threat_ips.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tshark\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> capture.pcap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> fields\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ip.dst\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> threat_ips.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"nächste-schritte-und-vertiefung\">Nächste Schritte und Vertiefung\u003C/h2>\n\u003Ch3 id=\"weiterführende-analyse-techniken\">Weiterführende Analyse-Techniken\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Behavioral-Analysis:\u003C/strong> Machine-Learning-basierte Anomalie-Detection\u003C/li>\n\u003Cli>\u003Cstrong>Graph-Analysis:\u003C/strong> Netzwerk-Relationship-Mapping\u003C/li>\n\u003Cli>\u003Cstrong>Temporal-Analysis:\u003C/strong> Time-Series-basierte Pattern-Recognition\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"spezialisierung-richtungen\">Spezialisierung-Richtungen\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Cloud-Network-Forensics:\u003C/strong> AWS VPC Flow Logs, Azure NSG Analysis\u003C/li>\n\u003Cli>\u003Cstrong>IoT-Network-Analysis:\u003C/strong> Constrained-Device-Communication-Patterns\u003C/li>\n\u003Cli>\u003Cstrong>Industrial-Network-Security:\u003C/strong> SCADA/Modbus-Protocol-Forensics\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"tool-ecosystem-erweiterung\">Tool-Ecosystem-Erweiterung\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Zeek (Bro):\u003C/strong> Scriptable Network Security Monitor\u003C/li>\n\u003Cli>\u003Cstrong>Suricata:\u003C/strong> IDS/IPS mit Network-Forensik-Capabilities\u003C/li>\n\u003Cli>\u003Cstrong>Moloch:\u003C/strong> Full-Packet-Capture und Search-Platform\u003C/li>\n\u003C/ul>\n\u003Cp>Die systematische Netzwerkprotokoll-Analyse bildet das Fundament moderner Cyber-Forensik. Durch die Kombination von Deep-Protocol-Knowledge, statistischer Analyse und Threat-Intelligence entsteht ein mächtiges Arsenal für die Aufdeckung und Untersuchung von Cyberangriffen.\u003C/p>\n\u003Cp>\u003Cstrong>Empfohlene Übungen:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>Analysieren Sie einen selbst erzeugten Netzwerk-Capture mit bekanntem “böswilligem” Traffic\u003C/li>\n\u003Cli>Implementieren Sie ein automatisiertes C2-Detection-Script\u003C/li>\n\u003Cli>Führen Sie eine komplette APT-Simulation durch und dokumentieren Sie die Netzwerk-Artefakte\u003C/li>\n\u003C/ol>\n\u003Cp>Die kontinuierliche Weiterentwicklung von Angriffstechniken erfordert permanente Aktualisierung der Analyse-Methoden. Bleiben Sie über aktuelle Threat-Research und neue Protocol-Exploitation-Techniques informiert.\u003C/p>",{"headings":705,"localImagePaths":837,"remoteImagePaths":838,"frontmatter":839,"imagePaths":844},[706,708,711,714,717,720,723,726,729,732,735,738,741,744,747,750,753,756,759,762,765,768,771,774,777,780,783,786,789,792,795,798,801,804,807,810,813,816,819,822,825,828,831,834],{"depth":44,"slug":707,"text":679},"netzwerkprotokoll-analyse-für-forensische-untersuchungen",{"depth":47,"slug":709,"text":710},"warum-netzwerkprotokoll-forensik","Warum Netzwerkprotokoll-Forensik?",{"depth":47,"slug":712,"text":713},"voraussetzungen","Voraussetzungen",{"depth":54,"slug":715,"text":716},"technische-kenntnisse","Technische Kenntnisse",{"depth":54,"slug":718,"text":719},"systemanforderungen","Systemanforderungen",{"depth":54,"slug":721,"text":722},"rechtliche-überlegungen","Rechtliche Überlegungen",{"depth":47,"slug":724,"text":725},"fundamentale-protokoll-analyse-methodik","Fundamentale Protokoll-Analyse-Methodik",{"depth":54,"slug":727,"text":728},"layer-2---data-link-layer-forensik","Layer 2 - Data Link Layer Forensik",{"depth":54,"slug":730,"text":731},"layer-3---network-layer-investigation","Layer 3 - Network Layer Investigation",{"depth":54,"slug":733,"text":734},"layer-4---transport-layer-forensik","Layer 4 - Transport Layer Forensik",{"depth":47,"slug":736,"text":737},"httphttps-forensik-für-web-basierte-angriffe","HTTP/HTTPS-Forensik für Web-basierte Angriffe",{"depth":54,"slug":739,"text":740},"http-header-deep-dive","HTTP-Header-Deep-Dive",{"depth":54,"slug":742,"text":743},"https-traffic-analysis-ohne-decryption","HTTPS-Traffic-Analysis ohne Decryption",{"depth":47,"slug":745,"text":746},"dns-forensik-und-tunneling-detection","DNS-Forensik und Tunneling-Detection",{"depth":54,"slug":748,"text":749},"dns-query-pattern-analysis","DNS-Query-Pattern-Analysis",{"depth":47,"slug":751,"text":752},"command--control-c2-communication-patterns","Command & Control (C2) Communication-Patterns",{"depth":54,"slug":754,"text":755},"c2-channel-identification","C2-Channel-Identification",{"depth":54,"slug":757,"text":758},"advanced-persistent-threat-apt-network-signatures","Advanced Persistent Threat (APT) Network-Signatures",{"depth":47,"slug":760,"text":761},"protokoll-anomalie-detection-algorithmen","Protokoll-Anomalie-Detection-Algorithmen",{"depth":54,"slug":763,"text":764},"statistical-baseline-establishment","Statistical-Baseline-Establishment",{"depth":54,"slug":766,"text":767},"machine-learning-enhanced-detection","Machine-Learning-Enhanced-Detection",{"depth":47,"slug":769,"text":770},"session-rekonstruktion-und-payload-extraktion","Session-Rekonstruktion und Payload-Extraktion",{"depth":54,"slug":772,"text":773},"tcp-stream-reassembly","TCP-Stream-Reassembly",{"depth":54,"slug":775,"text":776},"application-layer-protocol-parsing","Application-Layer-Protocol-Parsing",{"depth":47,"slug":778,"text":779},"verschlüsselte-protokoll-forensik","Verschlüsselte Protokoll-Forensik",{"depth":54,"slug":781,"text":782},"tlsssl-traffic-analysis","TLS/SSL-Traffic-Analysis",{"depth":54,"slug":784,"text":785},"vpn-traffic-characterization","VPN-Traffic-Characterization",{"depth":47,"slug":787,"text":788},"häufige-herausforderungen-und-troubleshooting","Häufige Herausforderungen und Troubleshooting",{"depth":54,"slug":790,"text":791},"performance-optimierung-bei-großen-pcap-dateien","Performance-Optimierung bei großen PCAP-Dateien",{"depth":54,"slug":793,"text":794},"false-positive-reduction","False-Positive-Reduction",{"depth":47,"slug":796,"text":797},"praktische-anwendungsszenarien","Praktische Anwendungsszenarien",{"depth":54,"slug":799,"text":800},"szenario-1-data-exfiltration-detection","Szenario 1: Data Exfiltration Detection",{"depth":54,"slug":802,"text":803},"szenario-2-apt-lateral-movement-investigation","Szenario 2: APT-Lateral-Movement-Investigation",{"depth":54,"slug":805,"text":806},"szenario-3-malware-c2-communication-analysis","Szenario 3: Malware C2 Communication Analysis",{"depth":47,"slug":808,"text":809},"erweiterte-analyse-techniken","Erweiterte Analyse-Techniken",{"depth":54,"slug":811,"text":812},"protocol-state-machine-analysis","Protocol-State-Machine-Analysis",{"depth":54,"slug":814,"text":815},"geospatial-network-analysis","Geospatial-Network-Analysis",{"depth":47,"slug":817,"text":818},"automatisierung-und-tool-integration","Automatisierung und Tool-Integration",{"depth":54,"slug":820,"text":821},"siem-integration","SIEM-Integration",{"depth":54,"slug":823,"text":824},"threat-intelligence-integration","Threat-Intelligence-Integration",{"depth":47,"slug":826,"text":827},"nächste-schritte-und-vertiefung","Nächste Schritte und Vertiefung",{"depth":54,"slug":829,"text":830},"weiterführende-analyse-techniken","Weiterführende Analyse-Techniken",{"depth":54,"slug":832,"text":833},"spezialisierung-richtungen","Spezialisierung-Richtungen",{"depth":54,"slug":835,"text":836},"tool-ecosystem-erweiterung","Tool-Ecosystem-Erweiterung",[],[],{"title":679,"description":680,"author":18,"last_updated":840,"difficulty":189,"categories":841,"tags":842,"tool_name":682,"related_tools":843,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,193,352],[689,690,691,692,693,694,695,696,697,698],[684,685,686],[],"concept-network-protocols.md","concept-regular-expressions-regex",{"id":846,"data":848,"body":870,"filePath":871,"digest":872,"rendered":873,"legacyId":1005},{"title":849,"description":850,"last_updated":851,"tool_name":852,"related_tools":853,"author":18,"difficulty":189,"categories":858,"tags":861,"published":34,"gated_content":35},"Regular Expressions in der Digitalen Forensik: Vom Grundmuster zur Beweisextraktion","Umfassender Leitfaden für Regex-Anwendungen in der forensischen Analyse: IP-Adressen, E-Mails, Hashes und komplexe Logparser-Patterns für effiziente Beweissammlung",["Date","2025-08-10T00:00:00.000Z"],"Regular Expressions (Regex)",[854,855,856,857],"YARA","Grep","PowerShell","Python",[191,859,860],"automation","log-analysis",[862,863,860,864,865,859,866,867,868,869],"regex","pattern-matching","data-extraction","text-processing","yara-rules","grep","powershell","python","# Regular Expressions in der Digitalen Forensik: Vom Grundmuster zur Beweisextraktion\n\nRegular Expressions (Regex) sind das Schweizer Taschenmesser der digitalen Forensik. Diese universelle Mustererkennungssprache ermöglicht es Forensikern, komplexe Textsuchen durchzuführen, relevante Daten aus Terabytes von Logs zu extrahieren und Beweise systematisch zu identifizieren. Von der einfachen IP-Adressen-Suche bis zur komplexen Malware-Signaturerstellung - Regex-Kenntnisse unterscheiden oft einen guten von einem großartigen Forensiker.\n\n## Warum Regex in der Forensik unverzichtbar ist\n\nIn modernen Untersuchungen konfrontieren uns massive Datenmengen: Gigabytes von Logfiles, Speicherabbilder, Netzwerkverkehr und Dateisysteme mit Millionen von Einträgen. Manuelle Durchsuchung ist unmöglich - hier kommt Regex ins Spiel:\n\n- **Präzise Mustersuche**: Findet spezifische Datenformate (IP-Adressen, E-Mails, Hashes) in unstrukturierten Texten\n- **Automatisierung**: Ermöglicht Skripterstellung für wiederkehrende Analysemuster\n- **Tool-Integration**: Kernfunktionalität in allen Major-Forensik-Tools\n- **Effizienzsteigerung**: Reduziert Analysezeit von Stunden auf Minuten\n\n## Forensik-relevante Regex-Grundlagen\n\n### Grundlegende Metacharakter\n\n```regex\n. # Beliebiges Zeichen (außer Newline)\n* # 0 oder mehr Wiederholungen des vorherigen Elements\n+ # 1 oder mehr Wiederholungen\n? # 0 oder 1 Wiederholung (optional)\n^ # Zeilenanfang\n$ # Zeilenende\n[] # Zeichenklasse\n() # Gruppierung\n| # ODER-Verknüpfung\n\\ # Escape-Zeichen\n```\n\n### Quantifizierer für präzise Treffer\n\n```regex\n{n} # Exakt n Wiederholungen\n{n,} # Mindestens n Wiederholungen\n{n,m} # Zwischen n und m Wiederholungen\n{,m} # Maximal m Wiederholungen\n```\n\n### Zeichenklassen für strukturierte Daten\n\n```regex\n\\d # Ziffer (0-9)\n\\w # Wort-Zeichen (a-z, A-Z, 0-9, _)\n\\s # Whitespace (Leerzeichen, Tab, Newline)\n\\D # Nicht-Ziffer\n\\W # Nicht-Wort-Zeichen\n\\S # Nicht-Whitespace\n[a-z] # Kleinbuchstaben\n[A-Z] # Großbuchstaben\n[0-9] # Ziffern\n[^abc] # Alles außer a, b, c\n```\n\n## Forensische Standardmuster\n\n### IP-Adressen (IPv4)\n\n```regex\n# Basis-Pattern (weniger präzise)\n\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\n\n# Präzise IPv4-Validierung\n^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$\n\n# Praktisches Pattern für Log-Analyse\n(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\n```\n\n**Anwendungsbeispiel**: Extraktion aller IP-Adressen aus IIS-Logs:\n```bash\ngrep -oE '(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)' access.log | sort | uniq -c | sort -nr\n```\n\n### E-Mail-Adressen\n\n```regex\n# Einfaches Pattern für schnelle Suche\n[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\n\n# RFC-konforme E-Mail (vereinfacht)\n^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$\n\n# Für Forensik optimiert (weniger strikt)\n\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b\n```\n\n### Hash-Werte\n\n```regex\n# MD5 (32 Hexadezimalzeichen)\n\\b[a-fA-F0-9]{32}\\b\n\n# SHA-1 (40 Hexadezimalzeichen)\n\\b[a-fA-F0-9]{40}\\b\n\n# SHA-256 (64 Hexadezimalzeichen)\n\\b[a-fA-F0-9]{64}\\b\n\n# Universelles Hash-Pattern\n\\b[a-fA-F0-9]{32,64}\\b\n```\n\n### Bitcoin-Adressen\n\n```regex\n# Legacy Bitcoin-Adressen (P2PKH und P2SH)\n\\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\\b\n\n# Bech32 (SegWit) Adressen\n\\bbc1[a-z0-9]{39,59}\\b\n\n# Kombiniert\n\\b(?:[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-z0-9]{39,59})\\b\n```\n\n### Windows-Dateipfade\n\n```regex\n# Vollständiger Windows-Pfad\n^[a-zA-Z]:\\\\(?:[^\\\\/:*?\"\u003C>|\\r\\n]+\\\\)*[^\\\\/:*?\"\u003C>|\\r\\n]*$\n\n# UNC-Pfade\n^\\\\\\\\[^\\\\]+\\\\[^\\\\]+(?:\\\\[^\\\\]*)*$\n\n# Für Log-Parsing (flexibler)\n[a-zA-Z]:\\\\[^\"\\s\u003C>|]*\n```\n\n### Kreditkartennummern\n\n```regex\n# Visa (13-19 Ziffern, beginnt mit 4)\n4[0-9]{12,18}\n\n# MasterCard (16 Ziffern, beginnt mit 5)\n5[1-5][0-9]{14}\n\n# American Express (15 Ziffern, beginnt mit 34 oder 37)\n3[47][0-9]{13}\n\n# Universell (mit optionalen Trennzeichen)\n(?:\\d{4}[-\\s]?){3,4}\\d{4}\n```\n\n## Tool-spezifische Regex-Implementierungen\n\n### PowerShell-Integration\n\n```powershell\n# Suche nach IP-Adressen in Eventlogs\nGet-WinEvent -LogName Security | Where-Object {\n $_.Message -match '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\n} | Select-Object TimeCreated, Id, Message\n\n# E-Mail-Extraktion aus Speicherabbild\nSelect-String -Path \"memdump.raw\" -Pattern '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}' -AllMatches\n\n# Hash-Werte aus Malware-Samples\nGet-ChildItem -Recurse | Get-FileHash | Where-Object {\n $_.Hash -match '^[a-fA-F0-9]{64}$'\n}\n```\n\n### Grep-Anwendungen\n\n```bash\n# Verdächtige ausführbare Dateien\ngrep -r -E '\\.(exe|dll|scr|bat|cmd)$' /mnt/evidence/\n\n# Zeitstempel-Extraktion (ISO 8601)\ngrep -oE '\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}' application.log\n\n# Base64-kodierte Daten\ngrep -oE '[A-Za-z0-9+/]{20,}={0,2}' suspicious.txt\n\n# Windows-Ereignis-IDs\ngrep -E 'Event ID: (4624|4625|4648|4656)' security.log\n```\n\n### Python-Implementierung\n\n```python\nimport re\nimport hashlib\n\n# IP-Adressen mit Kontext extrahieren\ndef extract_ips_with_context(text, context_chars=50):\n ip_pattern = r'\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\n matches = []\n \n for match in re.finditer(ip_pattern, text):\n start = max(0, match.start() - context_chars)\n end = min(len(text), match.end() + context_chars)\n context = text[start:end]\n matches.append({\n 'ip': match.group(),\n 'position': match.start(),\n 'context': context\n })\n \n return matches\n\n# Malware-Signaturen generieren\ndef generate_yara_strings(binary_data, min_length=10):\n # Suche nach druckbaren ASCII-Strings\n ascii_pattern = rb'[ -~]{' + str(min_length).encode() + rb',}'\n strings = re.findall(ascii_pattern, binary_data)\n \n yara_strings = []\n for i, string in enumerate(strings[:20]): # Erste 20 Strings\n # Escape problematische Zeichen\n escaped = string.decode('ascii').replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"')\n yara_strings.append(f'$s{i} = \"{escaped}\"')\n \n return yara_strings\n```\n\n## YARA-Rules mit Regex\n\n```yara\nrule SuspiciousEmailPattern {\n strings:\n $email = /[a-zA-Z0-9._%+-]+@(tempmail|guerrillamail|10minutemail)\\.(com|net|org)/ nocase\n $bitcoin = /\\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\\b/\n $ransom_msg = /your files have been encrypted/i\n \n condition:\n $email and ($bitcoin or $ransom_msg)\n}\n\nrule LogAnalysisPattern {\n strings:\n $failed_login = /Failed login.*from\\s+(\\d{1,3}\\.){3}\\d{1,3}/\n $brute_force = /authentication failure.*rhost=(\\d{1,3}\\.){3}\\d{1,3}/\n $suspicious_ua = /User-Agent:.*(?:sqlmap|nikto|nmap|masscan)/i\n \n condition:\n any of them\n}\n```\n\n## Performance-Optimierung und Fallstricke\n\n### Catastrophic Backtracking vermeiden\n\n**Problematisch**:\n```regex\n(a+)+b # Exponentieller Zeitverbrauch bei \"aaaa...c\"\n(.*)* # Verschachtelte Quantifizierer\n```\n\n**Optimiert**:\n```regex\na+b # Atomare Gruppierung\n[^b]*b # Negierte Zeichenklasse statt .*\n```\n\n### Anker für Effizienz nutzen\n\n```regex\n# Langsam\n\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\n\n# Schneller mit Wortgrenzen\n\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b\n\n# Am schnellsten für Zeilensuche\n^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$\n```\n\n### Compiled Patterns verwenden\n\n```python\nimport re\n\n# Einmal kompilieren, oft verwenden\nip_pattern = re.compile(r'\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b')\nemail_pattern = re.compile(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}')\n\ndef analyze_log_file(filepath):\n with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:\n content = f.read()\n \n ips = ip_pattern.findall(content)\n emails = email_pattern.findall(content)\n \n return ips, emails\n```\n\n## Praktische Forensik-Szenarien\n\n### Incident Response: Lateral Movement Detection\n\n```bash\n# Suche nach PsExec-Aktivitäten\ngrep -E 'PSEXESVC.*started|PsExec.*\\\\\\\\[^\\\\]+\\\\' security.log\n\n# Pass-the-Hash Angriffe\ngrep -E 'Logon Type:\\s+9.*NTLM.*[0-9a-fA-F]{32}' security.log\n\n# WMI-basierte Ausführung\ngrep -E 'WmiPrvSE.*ExecuteShellCommand|wmic.*process.*call.*create' system.log\n```\n\n### Malware-Analyse: C2-Kommunikation\n\n```python\n# Domain Generation Algorithm (DGA) Detection\ndga_pattern = re.compile(r'\\b[a-z]{8,20}\\.(com|net|org|info)\\b')\n\ndef detect_suspicious_domains(pcap_text):\n # Extrahiere DNS-Queries\n dns_pattern = r'DNS.*query.*?([a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})'\n domains = re.findall(dns_pattern, pcap_text)\n \n suspicious = []\n for domain in domains:\n # Prüfe auf DGA-Charakteristika\n if dga_pattern.match(domain.lower()):\n # Zusätzliche Heuristiken\n vowel_ratio = len(re.findall(r'[aeiou]', domain.lower())) / len(domain)\n if vowel_ratio \u003C 0.2: # Wenige Vokale = verdächtig\n suspicious.append(domain)\n \n return suspicious\n```\n\n### Data Exfiltration: Ungewöhnliche Datenübertragungen\n\n```regex\n# Base64-kodierte Daten in URLs\n[?&]data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?\n\n# DNS-Tunneling (ungewöhnlich lange Subdomains)\n\\b[a-z0-9]{20,}\\.[a-z0-9.-]+\\.[a-z]{2,}\\b\n\n# Hex-kodierte Dateninhalte\n[?&]payload=[0-9a-fA-F]{40,}\n```\n\n## Debugging und Testing\n\n### Online-Tools für Regex-Entwicklung\n\n1. **regex101.com**: Interaktive Regex-Entwicklung mit Erklärungen\n2. **regexr.com**: Visuelle Regex-Darstellung\n3. **regexpal.com**: Schnelle Tests ohne Anmeldung\n\n### Regex-Validierung in der Praxis\n\n```python\nimport re\n\ndef validate_regex_pattern(pattern, test_cases):\n \"\"\"\n Validiert Regex-Pattern gegen bekannte Test-Cases\n \"\"\"\n try:\n compiled = re.compile(pattern)\n except re.error as e:\n return False, f\"Regex-Syntax-Fehler: {e}\"\n \n results = []\n for test_input, expected in test_cases:\n match = compiled.search(test_input)\n found = match.group() if match else None\n results.append({\n 'input': test_input,\n 'expected': expected,\n 'found': found,\n 'correct': found == expected\n })\n \n return True, results\n\n# Test-Cases für IP-Pattern\nip_tests = [\n ('192.168.1.1', '192.168.1.1'),\n ('999.999.999.999', None), # Ungültige IP\n ('text 10.0.0.1 more text', '10.0.0.1'),\n ('no.ip.here', None)\n]\n\npattern = r'\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\b'\nvalid, results = validate_regex_pattern(pattern, ip_tests)\n```\n\n## Häufige Fehler und Lösungen\n\n### Problem: Gierige vs. nicht-gierige Quantifizierer\n\n```regex\n# Problematisch: Gierig\n\u003C.*> # Matched \"\u003Ctag>content\u003C/tag>\" komplett\n\n# Lösung: Nicht-gierig\n\u003C.*?> # Matched nur \"\u003Ctag>\"\n\n# Alternative: Spezifisch\n\u003C[^>]*> # Matched keine \">\" innerhalb\n```\n\n### Problem: Unbeabsichtigte Metacharakter\n\n```regex\n# Falsch: . als Literalzeichen gemeint\n192.168.1.1 # Matched auch \"192x168x1x1\"\n\n# Richtig: Escape von Metacharaktern\n192\\.168\\.1\\.1 # Matched nur echte IP\n```\n\n### Problem: Fehlende Wortgrenzen\n\n```regex\n# Problematisch: Matcht Teilstrings\n\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3} # Matched \"1192.168.1.10\"\n\n# Lösung: Wortgrenzen verwenden\n\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b # Nur vollständige IPs\n```\n\n## Integration in Forensik-Workflows\n\n### Automatisierte Triage-Scripts\n\n```bash\n#!/bin/bash\n# forensic_triage.sh - Automatisierte erste Analyse\n\nLOG_DIR=\"/evidence/logs\"\nOUTPUT_DIR=\"/analysis/regex_results\"\n\n# IP-Adressen extrahieren und häufigste finden\necho \"=== IP-Analyse ===\" > $OUTPUT_DIR/summary.txt\nfind $LOG_DIR -name \"*.log\" -exec grep -h -oE '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b' {} \\; | \\\n sort | uniq -c | sort -nr | head -20 >> $OUTPUT_DIR/summary.txt\n\n# E-Mail-Adressen sammeln\necho -e \"\\n=== E-Mail-Adressen ===\" >> $OUTPUT_DIR/summary.txt\nfind $LOG_DIR -name \"*.log\" -exec grep -h -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}' {} \\; | \\\n sort | uniq >> $OUTPUT_DIR/summary.txt\n\n# Verdächtige Prozessnamen\necho -e \"\\n=== Verdächtige Prozesse ===\" >> $OUTPUT_DIR/summary.txt\nfind $LOG_DIR -name \"*.log\" -exec grep -h -iE '(powershell|cmd|wmic|psexec|mimikatz)' {} \\; | \\\n head -50 >> $OUTPUT_DIR/summary.txt\n```\n\n### PowerShell-Module für wiederkehrende Aufgaben\n\n```powershell\nfunction Get-ForensicPatterns {\n param(\n [string]$Path,\n [string[]]$Patterns = @(\n '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b', # IP-Adressen\n '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}', # E-Mails\n '\\b[a-fA-F0-9]{32,64}\\b' # Hash-Werte\n )\n )\n \n $results = @{}\n \n foreach ($pattern in $Patterns) {\n $matches = Select-String -Path $Path -Pattern $pattern -AllMatches\n $results[$pattern] = $matches | ForEach-Object {\n [PSCustomObject]@{\n File = $_.Filename\n Line = $_.LineNumber\n Match = $_.Matches.Value\n Context = $_.Line\n }\n }\n }\n \n return $results\n}\n```\n\n## Weiterführende Techniken\n\n### Lookahead und Lookbehind\n\n```regex\n# Positive Lookahead: Password gefolgt von Ziffer\npassword(?=.*\\d)\n\n# Negative Lookahead: IP nicht in private ranges\n(?!(?:10\\.|192\\.168\\.|172\\.(?:1[6-9]|2[0-9]|3[01])\\.))(?:\\d{1,3}\\.){3}\\d{1,3}\n\n# Positive Lookbehind: Zahl nach \"Port:\"\n(?\u003C=Port:)\\d+\n\n# Negative Lookbehind: Nicht nach \"Comment:\"\n(?\u003C!Comment:).+@.+\\..+\n```\n\n### Named Capture Groups\n\n```python\nimport re\n\n# Strukturierte Log-Parsing\nlog_pattern = re.compile(\n r'(?P\u003Ctimestamp>\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}) '\n r'\\[(?P\u003Clevel>\\w+)\\] '\n r'(?P\u003Csource>\\w+): '\n r'(?P\u003Cmessage>.*)'\n)\n\ndef parse_log_entry(line):\n match = log_pattern.match(line)\n if match:\n return match.groupdict()\n return None\n\n# Verwendung\nlog_line = \"2024-01-15 14:30:25 [ERROR] auth: Failed login from 192.168.1.100\"\nparsed = parse_log_entry(log_line)\n# Result: {'timestamp': '2024-01-15 14:30:25', 'level': 'ERROR', \n# 'source': 'auth', 'message': 'Failed login from 192.168.1.100'}\n```\n\n## Nächste Schritte\n\nNach diesem umfassenden Überblick können Sie:\n\n1. **Praktische Übung**: Implementieren Sie die vorgestellten Patterns in Ihren aktuellen Untersuchungen\n2. **Tool-Integration**: Integrieren Sie Regex in Ihre bevorzugten Forensik-Tools\n3. **Automatisierung**: Entwickeln Sie Scripts für wiederkehrende Analysemuster\n4. **Spezialisierung**: Vertiefen Sie sich in tool-spezifische Regex-Implementierungen\n5. **Community**: Teilen Sie Ihre Patterns und lernen Sie von anderen Forensikern\n\n### Weiterführende Ressourcen\n\n- **SANS Regex Cheat Sheet**: Kompakte Referenz für Forensiker\n- **RegexBuddy**: Professionelle Regex-Entwicklungsumgebung\n- **Python re-Modul Dokumentation**: Detaillierte Syntax-Referenz\n- **YARA-Rules Repository**: Sammlung forensik-relevanter Regex-Patterns\n\nRegular Expressions sind ein mächtiges Werkzeug, das Zeit spart und die Präzision forensischer Analysen erhöht. Die Investition in solide Regex-Kenntnisse zahlt sich in jeder Untersuchung aus und ermöglicht es, komplexe Muster zu erkennen, die manuell übersehen werden würden.","src/content/knowledgebase/concept-regular-expressions-regex.md","8d09092368305b54",{"html":874,"metadata":875},"\u003Ch1 id=\"regular-expressions-in-der-digitalen-forensik-vom-grundmuster-zur-beweisextraktion\">Regular Expressions in der Digitalen Forensik: Vom Grundmuster zur Beweisextraktion\u003C/h1>\n\u003Cp>Regular Expressions (Regex) sind das Schweizer Taschenmesser der digitalen Forensik. Diese universelle Mustererkennungssprache ermöglicht es Forensikern, komplexe Textsuchen durchzuführen, relevante Daten aus Terabytes von Logs zu extrahieren und Beweise systematisch zu identifizieren. Von der einfachen IP-Adressen-Suche bis zur komplexen Malware-Signaturerstellung - Regex-Kenntnisse unterscheiden oft einen guten von einem großartigen Forensiker.\u003C/p>\n\u003Ch2 id=\"warum-regex-in-der-forensik-unverzichtbar-ist\">Warum Regex in der Forensik unverzichtbar ist\u003C/h2>\n\u003Cp>In modernen Untersuchungen konfrontieren uns massive Datenmengen: Gigabytes von Logfiles, Speicherabbilder, Netzwerkverkehr und Dateisysteme mit Millionen von Einträgen. Manuelle Durchsuchung ist unmöglich - hier kommt Regex ins Spiel:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Präzise Mustersuche\u003C/strong>: Findet spezifische Datenformate (IP-Adressen, E-Mails, Hashes) in unstrukturierten Texten\u003C/li>\n\u003Cli>\u003Cstrong>Automatisierung\u003C/strong>: Ermöglicht Skripterstellung für wiederkehrende Analysemuster\u003C/li>\n\u003Cli>\u003Cstrong>Tool-Integration\u003C/strong>: Kernfunktionalität in allen Major-Forensik-Tools\u003C/li>\n\u003Cli>\u003Cstrong>Effizienzsteigerung\u003C/strong>: Reduziert Analysezeit von Stunden auf Minuten\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"forensik-relevante-regex-grundlagen\">Forensik-relevante Regex-Grundlagen\u003C/h2>\n\u003Ch3 id=\"grundlegende-metacharakter\">Grundlegende Metacharakter\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Beliebiges Zeichen \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">außer Newline\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # 0 oder mehr Wiederholungen des vorherigen Elements\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # 1 oder mehr Wiederholungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # 0 oder 1 Wiederholung \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">optional\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Zeilenanfang\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">$\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Zeilenende\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">[] # Zeichenklasse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">()\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Gruppierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # ODER-Verknüpfung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\ \u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Escape-Zeichen\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"quantifizierer-für-präzise-treffer\">Quantifizierer für präzise Treffer\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">{n} # Exakt n Wiederholungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">{n,} # Mindestens n Wiederholungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">{n,m} # Zwischen n und m Wiederholungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">{,m} # Maximal m Wiederholungen\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"zeichenklassen-für-strukturierte-daten\">Zeichenklassen für strukturierte Daten\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Ziffer \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">0-9\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\w\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Wort-Zeichen \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">a-z, A-Z, 0-9, _\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\s\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Whitespace \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">Leerzeichen, Tab, Newline\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\D\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Nicht-Ziffer\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\W\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Nicht-Wort-Zeichen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\S\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Nicht-Whitespace\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[a-z]\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Kleinbuchstaben\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[A-Z]\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Großbuchstaben\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[0-9]\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Ziffern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">abc]\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Alles außer a, b, c\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"forensische-standardmuster\">Forensische Standardmuster\u003C/h2>\n\u003Ch3 id=\"ip-adressen-ipv4\">IP-Adressen (IPv4)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Basis-Pattern \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">weniger präzise\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Präzise IPv4-Validierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^(?:(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-9][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\\.)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-9][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)$\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Praktisches Pattern für Log-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">(?:(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4]\\d\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\\d\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\\.)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4]\\d\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\\d\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Anwendungsbeispiel\u003C/strong>: Extraktion aller IP-Adressen aus IIS-Logs:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -oE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> access.log\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> uniq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -nr\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"e-mail-adressen\">E-Mail-Adressen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Einfaches Pattern für schnelle Suche\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9._%+-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># RFC-konforme E-Mail \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">vereinfacht\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9](?:[a-zA-Z0-9-]\u003C/span>\u003Cspan style=\"color:#F97583\">{0,61}\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9])\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]\u003C/span>\u003Cspan style=\"color:#F97583\">{0,61}\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9])\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">$\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Für Forensik optimiert \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">weniger strikt\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[A-Za-z0-9._%+-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">[A-Za-z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.[A-Z|a-z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"hash-werte\">Hash-Werte\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># MD5 \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">32 Hexadezimalzeichen\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[a-fA-F0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{32}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># SHA-1 \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">40 Hexadezimalzeichen\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[a-fA-F0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{40}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># SHA-256 \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">64 Hexadezimalzeichen\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[a-fA-F0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{64}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Universelles Hash-Pattern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[a-fA-F0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{32,64}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"bitcoin-adressen\">Bitcoin-Adressen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Legacy Bitcoin-Adressen \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">P2PKH und P2SH\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[13][a-km-zA-HJ-NP-Z1-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{25,34}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Bech32 \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">SegWit\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> Adressen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003Cspan style=\"color:#DBEDFF\">bc1\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-z0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{39,59}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Kombiniert\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b(?:[13][a-km-zA-HJ-NP-Z1-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{25,34}|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">bc1\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-z0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{39,59}\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\\b\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"windows-dateipfade\">Windows-Dateipfade\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Vollständiger Windows-Pfad\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\(?:[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\/:*?\"<>|\\r\\n]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\/:*?\"<>|\\r\\n]\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">$\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># UNC-Pfade\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^\\\\\\\\[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\\\\[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\]\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">$\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Für Log-Parsing \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">flexibler\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">\"\\s<>|]\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"kreditkartennummern\">Kreditkartennummern\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Visa \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">13-19 Ziffern, beginnt mit 4\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">4\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{12,18}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># MasterCard \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">16 Ziffern, beginnt mit 5\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">5\u003C/span>\u003Cspan style=\"color:#79B8FF\">[1-5][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{14}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># American Express \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">15 Ziffern, beginnt mit 34 oder 37\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">3\u003C/span>\u003Cspan style=\"color:#79B8FF\">[47][0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{13}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Universell \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">mit optionalen Trennzeichen\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">(?:\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{4}\u003C/span>\u003Cspan style=\"color:#79B8FF\">[-\\s]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">{3,4}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{4}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"tool-spezifische-regex-implementierungen\">Tool-spezifische Regex-Implementierungen\u003C/h2>\n\u003Ch3 id=\"powershell-integration\">PowerShell-Integration\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"powershell\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suche nach IP-Adressen in Eventlogs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">Get-WinEvent\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">LogName Security \u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Where-Object\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.Message \u003C/span>\u003Cspan style=\"color:#F97583\">-match\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">} \u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Select-Object\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> TimeCreated\u003C/span>\u003Cspan style=\"color:#F97583\">,\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Id\u003C/span>\u003Cspan style=\"color:#F97583\">,\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Message\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># E-Mail-Extraktion aus Speicherabbild\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">Select-String\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Path \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"memdump.raw\"\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Pattern \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}'\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">AllMatches\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash-Werte aus Malware-Samples\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">Get-ChildItem\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Recurse \u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Get-FileHash\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Where-Object\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.Hash \u003C/span>\u003Cspan style=\"color:#F97583\">-match\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '^[a-fA-F0-9]{64}$'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"grep-anwendungen\">Grep-Anwendungen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verdächtige ausführbare Dateien\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\\.(exe|dll|scr|bat|cmd)$'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /mnt/evidence/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zeitstempel-Extraktion (ISO 8601)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -oE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> application.log\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Base64-kodierte Daten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -oE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '[A-Za-z0-9+/]{20,}={0,2}'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> suspicious.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Windows-Ereignis-IDs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Event ID: (4624|4625|4648|4656)'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> security.log\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"python-implementierung\">Python-Implementierung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># IP-Adressen mit Kontext extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> extract_ips_with_context\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(text, context_chars\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">50\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ip_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b(?:\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> matches \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> match \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.finditer(ip_pattern, text):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> start \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> max\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, match.start() \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> context_chars)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> end \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> min\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(text), match.end() \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> context_chars)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> context \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> text[start:end]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> matches.append({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'ip'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: match.group(),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'position'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: match.start(),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'context'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: context\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> })\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> matches\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Malware-Signaturen generieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> generate_yara_strings\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(binary_data, min_length\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">10\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Suche nach druckbaren ASCII-Strings\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ascii_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> rb\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">[ -~]\u003C/span>\u003Cspan style=\"color:#DBEDFF\">{\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#F97583\"> +\u003C/span>\u003Cspan style=\"color:#79B8FF\"> str\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(min_length).encode() \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#F97583\"> rb\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#DBEDFF\">,}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strings \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.findall(ascii_pattern, binary_data)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> yara_strings \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> i, string \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> enumerate\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(strings[:\u003C/span>\u003Cspan style=\"color:#79B8FF\">20\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]): \u003C/span>\u003Cspan style=\"color:#6A737D\"># Erste 20 Strings\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Escape problematische Zeichen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> escaped \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> string.decode(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'ascii'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).replace(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\\\\\\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).replace(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\"'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\\\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> yara_strings.append(\u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'$s\u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">i\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> = \"\u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">escaped\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> yara_strings\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"yara-rules-mit-regex\">YARA-Rules mit Regex\u003C/h2>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>rule SuspiciousEmailPattern {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> strings:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $email = /[a-zA-Z0-9._%+-]+@(tempmail|guerrillamail|10minutemail)\\.(com|net|org)/ nocase\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $bitcoin = /\\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\\b/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $ransom_msg = /your files have been encrypted/i\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> condition:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $email and ($bitcoin or $ransom_msg)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>rule LogAnalysisPattern {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> strings:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $failed_login = /Failed login.*from\\s+(\\d{1,3}\\.){3}\\d{1,3}/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $brute_force = /authentication failure.*rhost=(\\d{1,3}\\.){3}\\d{1,3}/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> $suspicious_ua = /User-Agent:.*(?:sqlmap|nikto|nmap|masscan)/i\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> condition:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan> any of them\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"performance-optimierung-und-fallstricke\">Performance-Optimierung und Fallstricke\u003C/h2>\n\u003Ch3 id=\"catastrophic-backtracking-vermeiden\">Catastrophic Backtracking vermeiden\u003C/h3>\n\u003Cp>\u003Cstrong>Problematisch\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">a\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">b # Exponentieller Zeitverbrauch bei \"aaaa\u003C/span>\u003Cspan style=\"color:#79B8FF\">...\u003C/span>\u003Cspan style=\"color:#DBEDFF\">c\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">(.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Verschachtelte Quantifizierer\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Optimiert\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">a\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">b # Atomare Gruppierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">b]\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\">b # Negierte Zeichenklasse statt \u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"anker-für-effizienz-nutzen\">Anker für Effizienz nutzen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Langsam\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Schneller mit Wortgrenzen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Am schnellsten für Zeilensuche\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">^\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">$\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"compiled-patterns-verwenden\">Compiled Patterns verwenden\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Einmal kompilieren, oft verwenden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">ip_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.compile(\u003C/span>\u003Cspan style=\"color:#F97583\">r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b(?:\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">email_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.compile(\u003C/span>\u003Cspan style=\"color:#F97583\">r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9._%+-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_log_file\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(filepath):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(filepath, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'r'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">encoding\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'utf-8'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">errors\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'ignore'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> content \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f.read()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ips \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ip_pattern.findall(content)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> emails \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> email_pattern.findall(content)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ips, emails\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"praktische-forensik-szenarien\">Praktische Forensik-Szenarien\u003C/h2>\n\u003Ch3 id=\"incident-response-lateral-movement-detection\">Incident Response: Lateral Movement Detection\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suche nach PsExec-Aktivitäten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'PSEXESVC.*started|PsExec.*\\\\\\\\[^\\\\]+\\\\'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> security.log\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Pass-the-Hash Angriffe\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Logon Type:\\s+9.*NTLM.*[0-9a-fA-F]{32}'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> security.log\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WMI-basierte Ausführung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'WmiPrvSE.*ExecuteShellCommand|wmic.*process.*call.*create'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> system.log\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"malware-analyse-c2-kommunikation\">Malware-Analyse: C2-Kommunikation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Domain Generation Algorithm (DGA) Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">dga_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.compile(\u003C/span>\u003Cspan style=\"color:#F97583\">r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b[a-z]\u003C/span>\u003Cspan style=\"color:#F97583\">{8,20}\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">com\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">net\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">org\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">info\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\\b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_suspicious_domains\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pcap_text):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Extrahiere DNS-Queries\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> dns_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#DBEDFF\">DNS\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\">query\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*?\u003C/span>\u003Cspan style=\"color:#79B8FF\">([a-zA-Z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">[a-zA-Z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> domains \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.findall(dns_pattern, pcap_text)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> suspicious \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> domain \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> domains:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Prüfe auf DGA-Charakteristika\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> dga_pattern.match(domain.lower()):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Zusätzliche Heuristiken\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> vowel_ratio \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(re.findall(\u003C/span>\u003Cspan style=\"color:#F97583\">r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">[aeiou]\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, domain.lower())) \u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\"> len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(domain)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> vowel_ratio \u003C/span>\u003Cspan style=\"color:#F97583\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0.2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#6A737D\"># Wenige Vokale = verdächtig\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> suspicious.append(domain)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suspicious\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"data-exfiltration-ungewöhnliche-datenübertragungen\">Data Exfiltration: Ungewöhnliche Datenübertragungen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Base64-kodierte Daten in URLs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[?&]\u003C/span>\u003Cspan style=\"color:#DBEDFF\">data=\u003C/span>\u003Cspan style=\"color:#79B8FF\">([A-Za-z0-9+/]\u003C/span>\u003Cspan style=\"color:#F97583\">{4}\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">([A-Za-z0-9+/]\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">==\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[A-Za-z0-9+/]\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># DNS-Tunneling \u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#DBEDFF\">ungewöhnlich lange Subdomains\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b[a-z0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">{20,}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.[a-z0-9.-]\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.[a-z]\u003C/span>\u003Cspan style=\"color:#F97583\">{2,}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Hex-kodierte Dateninhalte\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">[?&]\u003C/span>\u003Cspan style=\"color:#DBEDFF\">payload=\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-9a-fA-F]\u003C/span>\u003Cspan style=\"color:#F97583\">{40,}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"debugging-und-testing\">Debugging und Testing\u003C/h2>\n\u003Ch3 id=\"online-tools-für-regex-entwicklung\">Online-Tools für Regex-Entwicklung\u003C/h3>\n\u003Col>\n\u003Cli>\u003Cstrong>regex101.com\u003C/strong>: Interaktive Regex-Entwicklung mit Erklärungen\u003C/li>\n\u003Cli>\u003Cstrong>regexr.com\u003C/strong>: Visuelle Regex-Darstellung\u003C/li>\n\u003Cli>\u003Cstrong>regexpal.com\u003C/strong>: Schnelle Tests ohne Anmeldung\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"regex-validierung-in-der-praxis\">Regex-Validierung in der Praxis\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> validate_regex_pattern\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(pattern, test_cases):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Validiert Regex-Pattern gegen bekannte Test-Cases\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> try\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> compiled \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.compile(pattern)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> except\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.error \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> e:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"Regex-Syntax-Fehler: \u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> results \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> test_input, expected \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> test_cases:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> match \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> compiled.search(test_input)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> found \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> match.group() \u003C/span>\u003Cspan style=\"color:#F97583\">if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> match \u003C/span>\u003Cspan style=\"color:#F97583\">else\u003C/span>\u003Cspan style=\"color:#79B8FF\"> None\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> results.append({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'input'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: test_input,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'expected'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: expected,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'found'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: found,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'correct'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: found \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> expected\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> })\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> True\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, results\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Test-Cases für IP-Pattern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">ip_tests \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'192.168.1.1'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'192.168.1.1'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'999.999.999.999'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#6A737D\"># Ungültige IP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'text 10.0.0.1 more text'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'10.0.0.1'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'no.ip.here'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b(?:(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4]\\d\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\\d\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\.\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">25\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-5]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-4]\\d\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01]\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\\d\u003C/span>\u003Cspan style=\"color:#F97583\">?\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\\b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">valid, results \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> validate_regex_pattern(pattern, ip_tests)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-fehler-und-lösungen\">Häufige Fehler und Lösungen\u003C/h2>\n\u003Ch3 id=\"problem-gierige-vs-nicht-gierige-quantifizierer\">Problem: Gierige vs. nicht-gierige Quantifizierer\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Problematisch: Gierig\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\">> # Matched \"<tag>content</tag>\" komplett\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Lösung: Nicht-gierig\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*?\u003C/span>\u003Cspan style=\"color:#DBEDFF\">> # Matched nur \"<tag>\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Alternative: Spezifisch\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\">[\u003C/span>\u003Cspan style=\"color:#F97583\">^\u003C/span>\u003Cspan style=\"color:#79B8FF\">>]\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#DBEDFF\">> # Matched keine \">\" innerhalb\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-unbeabsichtigte-metacharakter\">Problem: Unbeabsichtigte Metacharakter\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Falsch: \u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> als Literalzeichen gemeint\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">192\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">168\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1 # Matched auch \"192x168x1x1\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Richtig: Escape von Metacharaktern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">192\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">168\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1 # Matched nur echte IP\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-fehlende-wortgrenzen\">Problem: Fehlende Wortgrenzen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Problematisch: Matcht Teilstrings\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Matched \"1192\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">168\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">10\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Lösung: Wortgrenzen verwenden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">\\b\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\b\u003C/span>\u003Cspan style=\"color:#DBEDFF\"> # Nur vollständige IPs\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"integration-in-forensik-workflows\">Integration in Forensik-Workflows\u003C/h2>\n\u003Ch3 id=\"automatisierte-triage-scripts\">Automatisierte Triage-Scripts\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/bin/bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># forensic_triage.sh - Automatisierte erste Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">LOG_DIR\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/evidence/logs\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/analysis/regex_results\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># IP-Adressen extrahieren und häufigste finden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"=== IP-Analyse ===\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">find\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_DIR \u003C/span>\u003Cspan style=\"color:#79B8FF\">-name\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"*.log\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -exec\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -h\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -oE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> {}\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\;\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> uniq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -nr\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> head\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -20\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># E-Mail-Adressen sammeln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\\n=== E-Mail-Adressen ===\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">find\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_DIR \u003C/span>\u003Cspan style=\"color:#79B8FF\">-name\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"*.log\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -exec\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -h\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -oE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> {}\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\;\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> uniq\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verdächtige Prozessnamen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -e\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\\n=== Verdächtige Prozesse ===\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">find\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $LOG_DIR \u003C/span>\u003Cspan style=\"color:#79B8FF\">-name\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"*.log\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -exec\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -h\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -iE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '(powershell|cmd|wmic|psexec|mimikatz)'\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> {}\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\;\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> head\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -50\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $OUTPUT_DIR\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/summary.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"powershell-module-für-wiederkehrende-aufgaben\">PowerShell-Module für wiederkehrende Aufgaben\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"powershell\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">function\u003C/span>\u003Cspan style=\"color:#B392F0\"> Get-ForensicPatterns\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> param\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003Cspan style=\"color:#F97583\">string\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]$Path\u003C/span>\u003Cspan style=\"color:#F97583\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003Cspan style=\"color:#F97583\">string\u003C/span>\u003Cspan style=\"color:#E1E4E8\">[]]$Patterns \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> @\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\u003C/span>\u003Cspan style=\"color:#F97583\">,\u003C/span>\u003Cspan style=\"color:#6A737D\"> # IP-Adressen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}'\u003C/span>\u003Cspan style=\"color:#F97583\">,\u003C/span>\u003Cspan style=\"color:#6A737D\"> # E-Mails\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> '\\b[a-fA-F0-9]{32,64}\\b'\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Hash-Werte\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> $results \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#F97583\"> @\u003C/span>\u003Cspan style=\"color:#E1E4E8\">{}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> foreach\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ($pattern \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $Patterns) {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> $matches\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Select-String\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Path $Path \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\">Pattern $pattern \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\">AllMatches\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> $results[$pattern] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> $matches\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> ForEach-Object\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003Cspan style=\"color:#F97583\">PSCustomObject\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003Cspan style=\"color:#F97583\">@\u003C/span>\u003Cspan style=\"color:#E1E4E8\">{\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> File \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.Filename\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> Line \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.LineNumber\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> Match \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.Matches.Value\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> Context \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> $_\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.Line\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $results\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"weiterführende-techniken\">Weiterführende Techniken\u003C/h2>\n\u003Ch3 id=\"lookahead-und-lookbehind\">Lookahead und Lookbehind\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"regex\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Positive Lookahead: Password gefolgt von Ziffer\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\">password\u003C/span>\u003Cspan style=\"color:#F97583\">(?=\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Negative Lookahead: IP nicht in private ranges\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">(?!\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">10\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">192\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#DBEDFF\">168\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">172\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.(?:\u003C/span>\u003Cspan style=\"color:#DBEDFF\">1\u003C/span>\u003Cspan style=\"color:#79B8FF\">[6-9]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">2\u003C/span>\u003Cspan style=\"color:#79B8FF\">[0-9]\u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#DBEDFF\">3\u003C/span>\u003Cspan style=\"color:#79B8FF\">[01])\\.)\u003C/span>\u003Cspan style=\"color:#F97583\">)\u003C/span>\u003Cspan style=\"color:#79B8FF\">(?:\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\.)\u003C/span>\u003Cspan style=\"color:#F97583\">{3}\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{1,3}\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Positive Lookbehind: Zahl nach \"Port:\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">(?<=\u003C/span>\u003Cspan style=\"color:#DBEDFF\">Port:\u003C/span>\u003Cspan style=\"color:#F97583\">)\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#DBEDFF\"># Negative Lookbehind: Nicht nach \"Comment:\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">(?<!\u003C/span>\u003Cspan style=\"color:#DBEDFF\">Comment:\u003C/span>\u003Cspan style=\"color:#F97583\">)\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#DBEDFF\">@\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\..\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"named-capture-groups\">Named Capture Groups\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Strukturierte Log-Parsing\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">log_pattern \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> re.compile(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#85E89D\">?P<timestamp>\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{4}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#DBEDFF\">:\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\d\u003C/span>\u003Cspan style=\"color:#F97583\">{2}\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\[\u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#85E89D\">?P<level>\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\w\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#85E89D;font-weight:bold\">\\]\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#85E89D\">?P<source>\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\w\u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#DBEDFF\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> r\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">(\u003C/span>\u003Cspan style=\"color:#85E89D\">?P<message>\u003C/span>\u003Cspan style=\"color:#79B8FF\">.\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">)\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> parse_log_entry\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(line):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> match \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> log_pattern.match(line)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> match:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> match.groupdict()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#79B8FF\"> None\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verwendung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">log_line \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"2024-01-15 14:30:25 [ERROR] auth: Failed login from 192.168.1.100\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">parsed \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> parse_log_entry(log_line)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Result: {'timestamp': '2024-01-15 14:30:25', 'level': 'ERROR', \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 'source': 'auth', 'message': 'Failed login from 192.168.1.100'}\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"nächste-schritte\">Nächste Schritte\u003C/h2>\n\u003Cp>Nach diesem umfassenden Überblick können Sie:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Praktische Übung\u003C/strong>: Implementieren Sie die vorgestellten Patterns in Ihren aktuellen Untersuchungen\u003C/li>\n\u003Cli>\u003Cstrong>Tool-Integration\u003C/strong>: Integrieren Sie Regex in Ihre bevorzugten Forensik-Tools\u003C/li>\n\u003Cli>\u003Cstrong>Automatisierung\u003C/strong>: Entwickeln Sie Scripts für wiederkehrende Analysemuster\u003C/li>\n\u003Cli>\u003Cstrong>Spezialisierung\u003C/strong>: Vertiefen Sie sich in tool-spezifische Regex-Implementierungen\u003C/li>\n\u003Cli>\u003Cstrong>Community\u003C/strong>: Teilen Sie Ihre Patterns und lernen Sie von anderen Forensikern\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>SANS Regex Cheat Sheet\u003C/strong>: Kompakte Referenz für Forensiker\u003C/li>\n\u003Cli>\u003Cstrong>RegexBuddy\u003C/strong>: Professionelle Regex-Entwicklungsumgebung\u003C/li>\n\u003Cli>\u003Cstrong>Python re-Modul Dokumentation\u003C/strong>: Detaillierte Syntax-Referenz\u003C/li>\n\u003Cli>\u003Cstrong>YARA-Rules Repository\u003C/strong>: Sammlung forensik-relevanter Regex-Patterns\u003C/li>\n\u003C/ul>\n\u003Cp>Regular Expressions sind ein mächtiges Werkzeug, das Zeit spart und die Präzision forensischer Analysen erhöht. Die Investition in solide Regex-Kenntnisse zahlt sich in jeder Untersuchung aus und ermöglicht es, komplexe Muster zu erkennen, die manuell übersehen werden würden.\u003C/p>",{"headings":876,"localImagePaths":997,"remoteImagePaths":998,"frontmatter":999,"imagePaths":1004},[877,879,882,885,888,891,894,897,900,903,906,909,912,915,918,921,924,927,930,933,936,939,942,945,948,951,954,957,960,963,966,969,972,975,978,981,984,987,990,993,996],{"depth":44,"slug":878,"text":849},"regular-expressions-in-der-digitalen-forensik-vom-grundmuster-zur-beweisextraktion",{"depth":47,"slug":880,"text":881},"warum-regex-in-der-forensik-unverzichtbar-ist","Warum Regex in der Forensik unverzichtbar ist",{"depth":47,"slug":883,"text":884},"forensik-relevante-regex-grundlagen","Forensik-relevante Regex-Grundlagen",{"depth":54,"slug":886,"text":887},"grundlegende-metacharakter","Grundlegende Metacharakter",{"depth":54,"slug":889,"text":890},"quantifizierer-für-präzise-treffer","Quantifizierer für präzise Treffer",{"depth":54,"slug":892,"text":893},"zeichenklassen-für-strukturierte-daten","Zeichenklassen für strukturierte Daten",{"depth":47,"slug":895,"text":896},"forensische-standardmuster","Forensische Standardmuster",{"depth":54,"slug":898,"text":899},"ip-adressen-ipv4","IP-Adressen (IPv4)",{"depth":54,"slug":901,"text":902},"e-mail-adressen","E-Mail-Adressen",{"depth":54,"slug":904,"text":905},"hash-werte","Hash-Werte",{"depth":54,"slug":907,"text":908},"bitcoin-adressen","Bitcoin-Adressen",{"depth":54,"slug":910,"text":911},"windows-dateipfade","Windows-Dateipfade",{"depth":54,"slug":913,"text":914},"kreditkartennummern","Kreditkartennummern",{"depth":47,"slug":916,"text":917},"tool-spezifische-regex-implementierungen","Tool-spezifische Regex-Implementierungen",{"depth":54,"slug":919,"text":920},"powershell-integration","PowerShell-Integration",{"depth":54,"slug":922,"text":923},"grep-anwendungen","Grep-Anwendungen",{"depth":54,"slug":925,"text":926},"python-implementierung","Python-Implementierung",{"depth":47,"slug":928,"text":929},"yara-rules-mit-regex","YARA-Rules mit Regex",{"depth":47,"slug":931,"text":932},"performance-optimierung-und-fallstricke","Performance-Optimierung und Fallstricke",{"depth":54,"slug":934,"text":935},"catastrophic-backtracking-vermeiden","Catastrophic Backtracking vermeiden",{"depth":54,"slug":937,"text":938},"anker-für-effizienz-nutzen","Anker für Effizienz nutzen",{"depth":54,"slug":940,"text":941},"compiled-patterns-verwenden","Compiled Patterns verwenden",{"depth":47,"slug":943,"text":944},"praktische-forensik-szenarien","Praktische Forensik-Szenarien",{"depth":54,"slug":946,"text":947},"incident-response-lateral-movement-detection","Incident Response: Lateral Movement Detection",{"depth":54,"slug":949,"text":950},"malware-analyse-c2-kommunikation","Malware-Analyse: C2-Kommunikation",{"depth":54,"slug":952,"text":953},"data-exfiltration-ungewöhnliche-datenübertragungen","Data Exfiltration: Ungewöhnliche Datenübertragungen",{"depth":47,"slug":955,"text":956},"debugging-und-testing","Debugging und Testing",{"depth":54,"slug":958,"text":959},"online-tools-für-regex-entwicklung","Online-Tools für Regex-Entwicklung",{"depth":54,"slug":961,"text":962},"regex-validierung-in-der-praxis","Regex-Validierung in der Praxis",{"depth":47,"slug":964,"text":965},"häufige-fehler-und-lösungen","Häufige Fehler und Lösungen",{"depth":54,"slug":967,"text":968},"problem-gierige-vs-nicht-gierige-quantifizierer","Problem: Gierige vs. nicht-gierige Quantifizierer",{"depth":54,"slug":970,"text":971},"problem-unbeabsichtigte-metacharakter","Problem: Unbeabsichtigte Metacharakter",{"depth":54,"slug":973,"text":974},"problem-fehlende-wortgrenzen","Problem: Fehlende Wortgrenzen",{"depth":47,"slug":976,"text":977},"integration-in-forensik-workflows","Integration in Forensik-Workflows",{"depth":54,"slug":979,"text":980},"automatisierte-triage-scripts","Automatisierte Triage-Scripts",{"depth":54,"slug":982,"text":983},"powershell-module-für-wiederkehrende-aufgaben","PowerShell-Module für wiederkehrende Aufgaben",{"depth":47,"slug":985,"text":986},"weiterführende-techniken","Weiterführende Techniken",{"depth":54,"slug":988,"text":989},"lookahead-und-lookbehind","Lookahead und Lookbehind",{"depth":54,"slug":991,"text":992},"named-capture-groups","Named Capture Groups",{"depth":47,"slug":994,"text":995},"nächste-schritte","Nächste Schritte",{"depth":54,"slug":166,"text":167},[],[],{"title":849,"description":850,"author":18,"last_updated":1000,"difficulty":189,"categories":1001,"tags":1002,"tool_name":852,"related_tools":1003,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,859,860],[862,863,860,864,865,859,866,867,868,869],[854,855,856,857],[],"concept-regular-expressions-regex.md","concept-sql",{"id":1006,"data":1008,"body":1027,"filePath":1028,"digest":1029,"rendered":1030,"legacyId":1158},{"title":1009,"description":1010,"last_updated":1011,"tool_name":1012,"related_tools":1013,"author":18,"difficulty":189,"categories":1016,"tags":1017,"published":34,"gated_content":35},"SQL in der digitalen Forensik: Von SQLite-Datenbanken zur Timeline-Analyse","Umfassender Leitfaden für SQL-basierte Forensik-Analysen: SQLite-Datenbanken untersuchen, Timeline-Rekonstruktion durchführen, mobile App-Daten analysieren und komplexe Korrelationen aufdecken.",["Date","2025-08-10T00:00:00.000Z"],"SQL",[1014,184,1015],"DB Browser for SQLite","Cellebrite UFED",[191,192,352],[1018,1019,1020,1021,864,1022,1023,1024,1025,1026],"sqlite-viewer","correlation-engine","mobile-app-data","browser-history","timeline-queries","join-operations","aggregate-analysis","wal-analysis","python-integration","# SQL in der digitalen Forensik: Von SQLite-Datenbanken zur Timeline-Analyse\n\nSQL (Structured Query Language) ist eine der mächtigsten und unterschätztesten Fähigkeiten in der modernen digitalen Forensik. Während viele Ermittler auf GUI-basierte Tools setzen, ermöglicht SQL direkten Zugriff auf Rohdaten und komplexe Analysen, die mit herkömmlichen Tools unmöglich wären.\n\n## Warum SQL in der Forensik unverzichtbar ist\n\n### SQLite dominiert die mobile Forensik\n- **WhatsApp-Chats**: Nachrichten, Metadaten, gelöschte Inhalte\n- **Browser-History**: Zeitstempel, Besuchshäufigkeit, Suchverläufe \n- **App-Daten**: Standortdaten, Nutzerverhalten, Cache-Inhalte\n- **System-Logs**: Verbindungsprotokoll, Fehleraufzeichnungen\n\n### Vorteile gegenüber GUI-Tools\n- **Flexibilität**: Komplexe Abfragen jenseits vordefinierter Filter\n- **Performance**: Direkte Datenbankzugriffe ohne Interface-Overhead\n- **Automatisierung**: Skript-basierte Analysen für wiederkehrende Aufgaben\n- **Tiefe**: Zugriff auf Metadaten und versteckte Tabellenstrukturen\n\n## Grundlagen: SQLite-Struktur verstehen\n\n### Datenbank-Anatomie in der Forensik\n\n```sql\n-- Tabellen einer WhatsApp-Datenbank analysieren\n.tables\n\n-- Tabellenstruktur untersuchen\n.schema messages\n\n-- Beispiel-Output:\nCREATE TABLE messages (\n _id INTEGER PRIMARY KEY AUTOINCREMENT,\n key_remote_jid TEXT,\n key_from_me INTEGER,\n key_id TEXT,\n status INTEGER,\n needs_push INTEGER,\n data TEXT,\n timestamp INTEGER,\n media_url TEXT,\n media_mime_type TEXT,\n media_wa_type INTEGER,\n media_size INTEGER,\n latitude REAL,\n longitude REAL\n);\n```\n\n### SQLite-spezifische Forensik-Herausforderungen\n\n**WAL-Mode (Write-Ahead Logging)**:\n```sql\n-- WAL-Datei auf nicht-committete Transaktionen prüfen\nPRAGMA journal_mode;\n\n-- Temporäre Daten in WAL-Datei finden\n-- (Erfordert spezielle Tools wie sqlitewalreader)\n```\n\n**Gelöschte Records**:\n```sql\n-- Freespace-Analyse für gelöschte Daten\n-- Hinweis: Erfordert spezialisierte Recovery-Tools\n```\n\n## Timeline-Rekonstruktion: Der Forensik-Klassiker\n\n### Grundlegende Timeline-Abfrage\n\n```sql\n-- Chronologische Ereignisübersicht erstellen\nSELECT \n datetime(timestamp/1000, 'unixepoch', 'localtime') as ereignis_zeit,\n CASE \n WHEN key_from_me = 1 THEN 'Ausgehend'\n ELSE 'Eingehend'\n END as richtung,\n key_remote_jid as kontakt,\n substr(data, 1, 50) || '...' as nachricht_preview\nFROM messages \nWHERE timestamp > 0\nORDER BY timestamp DESC\nLIMIT 100;\n```\n\n### Erweiterte Timeline mit Kontextinformationen\n\n```sql\n-- Timeline mit Geolocation und Media-Daten\nSELECT \n datetime(m.timestamp/1000, 'unixepoch', 'localtime') as zeitstempel,\n c.display_name as kontakt_name,\n CASE \n WHEN m.key_from_me = 1 THEN '→ Gesendet'\n ELSE '← Empfangen'\n END as richtung,\n CASE \n WHEN m.media_wa_type IS NOT NULL THEN 'Media: ' || m.media_mime_type\n ELSE 'Text'\n END as nachricht_typ,\n CASE \n WHEN m.latitude IS NOT NULL THEN \n 'Standort: ' || ROUND(m.latitude, 6) || ', ' || ROUND(m.longitude, 6)\n ELSE substr(m.data, 1, 100)\n END as inhalt\nFROM messages m\nLEFT JOIN wa_contacts c ON m.key_remote_jid = c.jid\nWHERE m.timestamp BETWEEN \n strftime('%s', '2024-01-01') * 1000 AND \n strftime('%s', '2024-01-31') * 1000\nORDER BY m.timestamp;\n```\n\n## Kommunikations-Analyse: Soziale Netzwerke aufdecken\n\n### Häufigste Kontakte identifizieren\n\n```sql\n-- Top-Kommunikationspartner nach Nachrichtenvolumen\nSELECT \n c.display_name,\n m.key_remote_jid,\n COUNT(*) as nachrichten_gesamt,\n SUM(CASE WHEN m.key_from_me = 1 THEN 1 ELSE 0 END) as gesendet,\n SUM(CASE WHEN m.key_from_me = 0 THEN 1 ELSE 0 END) as empfangen,\n MIN(datetime(m.timestamp/1000, 'unixepoch', 'localtime')) as erster_kontakt,\n MAX(datetime(m.timestamp/1000, 'unixepoch', 'localtime')) as letzter_kontakt\nFROM messages m\nLEFT JOIN wa_contacts c ON m.key_remote_jid = c.jid\nGROUP BY m.key_remote_jid\nHAVING nachrichten_gesamt > 10\nORDER BY nachrichten_gesamt DESC;\n```\n\n### Kommunikationsmuster-Analyse\n\n```sql\n-- Tägliche Aktivitätsmuster\nSELECT \n strftime('%H', timestamp/1000, 'unixepoch', 'localtime') as stunde,\n COUNT(*) as nachrichten_anzahl,\n AVG(length(data)) as durchschnittliche_laenge\nFROM messages \nWHERE timestamp > 0 AND data IS NOT NULL\nGROUP BY stunde\nORDER BY stunde;\n```\n\n```sql\n-- Verdächtige Aktivitätsspitzen identifizieren\nWITH hourly_stats AS (\n SELECT \n date(timestamp/1000, 'unixepoch', 'localtime') as tag,\n strftime('%H', timestamp/1000, 'unixepoch', 'localtime') as stunde,\n COUNT(*) as nachrichten_pro_stunde\n FROM messages \n WHERE timestamp > 0\n GROUP BY tag, stunde\n),\navg_per_hour AS (\n SELECT stunde, AVG(nachrichten_pro_stunde) as durchschnitt\n FROM hourly_stats\n GROUP BY stunde\n)\nSELECT \n h.tag,\n h.stunde,\n h.nachrichten_pro_stunde,\n a.durchschnitt,\n ROUND((h.nachrichten_pro_stunde - a.durchschnitt) / a.durchschnitt * 100, 2) as abweichung_prozent\nFROM hourly_stats h\nJOIN avg_per_hour a ON h.stunde = a.stunde\nWHERE h.nachrichten_pro_stunde > a.durchschnitt * 2\nORDER BY abweichung_prozent DESC;\n```\n\n## Browser-Forensik: Digitale Spuren verfolgen\n\n### Chrome/Chromium History-Analyse\n\n```sql\n-- Browser-History mit Besuchshäufigkeit\nSELECT \n url,\n title,\n visit_count,\n datetime(last_visit_time/1000000-11644473600, 'unixepoch', 'localtime') as letzter_besuch,\n CASE \n WHEN typed_count > 0 THEN 'Direkt eingegeben'\n ELSE 'Über Link/Verlauf'\n END as zugriff_art\nFROM urls \nWHERE last_visit_time > 0\nORDER BY last_visit_time DESC\nLIMIT 100;\n```\n\n### Such-Verlauf analysieren\n\n```sql\n-- Google-Suchen aus Browser-History extrahieren\nSELECT \n datetime(last_visit_time/1000000-11644473600, 'unixepoch', 'localtime') as suchzeit,\n CASE \n WHEN url LIKE '%google.com/search%' THEN \n replace(substr(url, instr(url, 'q=') + 2, \n case when instr(substr(url, instr(url, 'q=') + 2), '&') > 0 \n then instr(substr(url, instr(url, 'q=') + 2), '&') - 1 \n else length(url) end), '+', ' ')\n ELSE 'Andere Suchmaschine'\n END as suchbegriff,\n url\nFROM urls \nWHERE url LIKE '%search%' OR url LIKE '%q=%'\nORDER BY last_visit_time DESC;\n```\n\n## Anomalie-Erkennung mit SQL\n\n### Ungewöhnliche Datei-Zugriffe identifizieren\n\n```sql\n-- Dateizugriffe außerhalb der Arbeitszeiten\nWITH file_access AS (\n SELECT \n datetime(timestamp, 'unixepoch', 'localtime') as zugriffszeit,\n strftime('%H', timestamp, 'unixepoch', 'localtime') as stunde,\n strftime('%w', timestamp, 'unixepoch', 'localtime') as wochentag,\n file_path,\n action_type\n FROM file_access_logs\n)\nSELECT *\nFROM file_access\nWHERE (\n stunde \u003C '08' OR stunde > '18' OR -- Außerhalb 8-18 Uhr\n wochentag IN ('0', '6') -- Wochenende\n) AND action_type IN ('read', 'write', 'delete')\nORDER BY zugriffszeit DESC;\n```\n\n### Datenexfiltration-Indikatoren\n\n```sql\n-- Große Dateiübertragungen in kurzen Zeiträumen\nSELECT \n datetime(transfer_start, 'unixepoch', 'localtime') as start_zeit,\n SUM(file_size) as gesamt_bytes,\n COUNT(*) as anzahl_dateien,\n destination_ip,\n GROUP_CONCAT(DISTINCT file_extension) as dateitypen\nFROM network_transfers \nWHERE transfer_start BETWEEN \n strftime('%s', 'now', '-7 days') AND strftime('%s', 'now')\nGROUP BY \n date(transfer_start, 'unixepoch', 'localtime'),\n strftime('%H', transfer_start, 'unixepoch', 'localtime'),\n destination_ip\nHAVING gesamt_bytes > 100000000 -- > 100MB\nORDER BY gesamt_bytes DESC;\n```\n\n## Erweiterte Techniken: Window Functions und CTEs\n\n### Sliding Window-Analyse für Ereigniskorrelation\n\n```sql\n-- Ereignisse in 5-Minuten-Fenstern korrelieren\nWITH event_windows AS (\n SELECT \n datetime(timestamp, 'unixepoch', 'localtime') as ereigniszeit,\n event_type,\n user_id,\n LAG(timestamp, 1) OVER (PARTITION BY user_id ORDER BY timestamp) as prev_timestamp,\n LEAD(timestamp, 1) OVER (PARTITION BY user_id ORDER BY timestamp) as next_timestamp\n FROM security_events\n ORDER BY timestamp\n)\nSELECT \n ereigniszeit,\n event_type,\n user_id,\n CASE \n WHEN (timestamp - prev_timestamp) \u003C 300 THEN 'Schnelle Aufeinanderfolge'\n WHEN (next_timestamp - timestamp) \u003C 300 THEN 'Vor schnellem Event'\n ELSE 'Isoliert'\n END as ereignis_kontext\nFROM event_windows;\n```\n\n### Temporäre Anomalie-Scores\n\n```sql\n-- Anomalie-Score basierend auf Abweichung vom Normalverhalten\nWITH user_baseline AS (\n SELECT \n user_id,\n AVG(daily_logins) as avg_logins,\n STDEV(daily_logins) as stddev_logins\n FROM (\n SELECT \n user_id,\n date(login_time, 'unixepoch', 'localtime') as login_date,\n COUNT(*) as daily_logins\n FROM user_logins\n WHERE login_time > strftime('%s', 'now', '-30 days')\n GROUP BY user_id, login_date\n )\n GROUP BY user_id\n HAVING COUNT(*) > 7 -- Mindestens 7 Tage Daten\n),\ncurrent_behavior AS (\n SELECT \n user_id,\n date(login_time, 'unixepoch', 'localtime') as login_date,\n COUNT(*) as daily_logins\n FROM user_logins\n WHERE login_time > strftime('%s', 'now', '-7 days')\n GROUP BY user_id, login_date\n)\nSELECT \n c.user_id,\n c.login_date,\n c.daily_logins,\n b.avg_logins,\n ROUND(ABS(c.daily_logins - b.avg_logins) / b.stddev_logins, 2) as anomalie_score\nFROM current_behavior c\nJOIN user_baseline b ON c.user_id = b.user_id\nWHERE anomalie_score > 2.0 -- Mehr als 2 Standardabweichungen\nORDER BY anomalie_score DESC;\n```\n\n## Python-Integration für Automatisierung\n\n### SQLite-Forensik mit Python\n\n```python\nimport sqlite3\nimport pandas as pd\nfrom datetime import datetime\nimport matplotlib.pyplot as plt\n\nclass ForensicSQLAnalyzer:\n def __init__(self, db_path):\n self.conn = sqlite3.connect(db_path)\n self.conn.row_factory = sqlite3.Row\n \n def extract_timeline(self, start_date=None, end_date=None):\n \"\"\"Timeline-Extraktion mit Datumsfilterung\"\"\"\n query = \"\"\"\n SELECT \n datetime(timestamp/1000, 'unixepoch', 'localtime') as timestamp,\n event_type,\n details,\n user_context\n FROM events \n WHERE 1=1\n \"\"\"\n \n params = []\n if start_date:\n query += \" AND timestamp >= ?\"\n params.append(int(start_date.timestamp() * 1000))\n if end_date:\n query += \" AND timestamp \u003C= ?\"\n params.append(int(end_date.timestamp() * 1000))\n \n query += \" ORDER BY timestamp\"\n \n return pd.read_sql_query(query, self.conn, params=params)\n \n def communication_analysis(self):\n \"\"\"Kommunikationsmuster analysieren\"\"\"\n query = \"\"\"\n SELECT \n contact_id,\n COUNT(*) as message_count,\n AVG(message_length) as avg_length,\n MIN(timestamp) as first_contact,\n MAX(timestamp) as last_contact\n FROM messages \n GROUP BY contact_id\n HAVING message_count > 5\n ORDER BY message_count DESC\n \"\"\"\n \n return pd.read_sql_query(query, self.conn)\n \n def detect_anomalies(self, threshold=2.0):\n \"\"\"Statistische Anomalie-Erkennung\"\"\"\n query = \"\"\"\n WITH daily_stats AS (\n SELECT \n date(timestamp, 'unixepoch', 'localtime') as day,\n COUNT(*) as daily_events\n FROM events\n GROUP BY day\n ),\n stats AS (\n SELECT \n AVG(daily_events) as mean_events,\n STDEV(daily_events) as stddev_events\n FROM daily_stats\n )\n SELECT \n d.day,\n d.daily_events,\n s.mean_events,\n ABS(d.daily_events - s.mean_events) / s.stddev_events as z_score\n FROM daily_stats d, stats s\n WHERE z_score > ?\n ORDER BY z_score DESC\n \"\"\"\n \n return pd.read_sql_query(query, self.conn, params=[threshold])\n \n def export_findings(self, filename):\n \"\"\"Ermittlungsergebnisse exportieren\"\"\"\n timeline = self.extract_timeline()\n comms = self.communication_analysis()\n anomalies = self.detect_anomalies()\n \n with pd.ExcelWriter(filename) as writer:\n timeline.to_excel(writer, sheet_name='Timeline', index=False)\n comms.to_excel(writer, sheet_name='Communications', index=False)\n anomalies.to_excel(writer, sheet_name='Anomalies', index=False)\n\n# Verwendung\nanalyzer = ForensicSQLAnalyzer('/path/to/evidence.db')\nfindings = analyzer.export_findings('investigation_findings.xlsx')\n```\n\n## Häufige Fallstricke und Best Practices\n\n### Datenintegrität sicherstellen\n\n```sql\n-- Konsistenz-Checks vor Analyse\nSELECT \n 'Null Timestamps' as issue_type,\n COUNT(*) as count\nFROM messages \nWHERE timestamp IS NULL OR timestamp = 0\n\nUNION ALL\n\nSELECT \n 'Missing Contact Info' as issue_type,\n COUNT(*) as count\nFROM messages m\nLEFT JOIN wa_contacts c ON m.key_remote_jid = c.jid\nWHERE c.jid IS NULL;\n```\n\n### Performance-Optimierung\n\n```sql\n-- Index für häufige Abfragen erstellen\nCREATE INDEX IF NOT EXISTS idx_messages_timestamp \nON messages(timestamp);\n\nCREATE INDEX IF NOT EXISTS idx_messages_contact_timestamp \nON messages(key_remote_jid, timestamp);\n\n-- Query-Performance analysieren\nEXPLAIN QUERY PLAN \nSELECT * FROM messages \nWHERE timestamp BETWEEN ? AND ?\nORDER BY timestamp;\n```\n\n### Forensische Dokumentation\n\n```sql\n-- Metadaten für Gerichtsverwertbarkeit dokumentieren\nSELECT \n 'Database Schema Version' as info_type,\n user_version as value\nFROM pragma_user_version\n\nUNION ALL\n\nSELECT \n 'Last Modified',\n datetime(mtime, 'unixepoch', 'localtime')\nFROM pragma_file_control;\n```\n\n## Spezialisierte Forensik-Szenarien\n\n### Mobile App-Forensik: Instagram-Datenbank\n\n```sql\n-- Instagram-Nachrichten mit Medien-Metadaten\nSELECT \n datetime(m.timestamp/1000, 'unixepoch', 'localtime') as nachricht_zeit,\n u.username as absender,\n CASE \n WHEN m.item_type = 1 THEN 'Text: ' || m.text\n WHEN m.item_type = 2 THEN 'Bild: ' || mi.media_url\n WHEN m.item_type = 3 THEN 'Video: ' || mi.media_url\n ELSE 'Anderer Typ: ' || m.item_type\n END as inhalt,\n m.thread_key as chat_id\nFROM direct_messages m\nLEFT JOIN users u ON m.user_id = u.pk\nLEFT JOIN media_items mi ON m.media_id = mi.id\nWHERE m.timestamp > 0\nORDER BY m.timestamp DESC;\n```\n\n### Incident Response: Systemprotokoll-Korrelation\n\n```sql\n-- Korrelation zwischen Login-Events und Netzwerk-Aktivität\nWITH suspicious_logins AS (\n SELECT \n login_time,\n user_id,\n source_ip,\n login_time + 3600 as investigation_window -- 1 Stunde nach Login\n FROM login_events \n WHERE source_ip NOT LIKE '192.168.%' -- Externe IPs\n AND login_time > strftime('%s', 'now', '-7 days')\n),\nnetwork_activity AS (\n SELECT \n connection_time,\n source_ip,\n destination_ip,\n bytes_transferred,\n protocol\n FROM network_connections\n)\nSELECT \n datetime(sl.login_time, 'unixepoch', 'localtime') as verdaechtiger_login,\n sl.user_id,\n sl.source_ip as login_ip,\n COUNT(na.connection_time) as netzwerk_aktivitaeten,\n SUM(na.bytes_transferred) as gesamt_daten_bytes,\n GROUP_CONCAT(DISTINCT na.destination_ip) as ziel_ips\nFROM suspicious_logins sl\nLEFT JOIN network_activity na ON \n na.connection_time BETWEEN sl.login_time AND sl.investigation_window\n AND na.source_ip = sl.source_ip\nGROUP BY sl.login_time, sl.user_id, sl.source_ip\nHAVING netzwerk_aktivitaeten > 0\nORDER BY gesamt_daten_bytes DESC;\n```\n\n## Erweiterte WAL-Analyse und Recovery\n\n### WAL-Datei Untersuchung\n\n```sql\n-- WAL-Mode Status prüfen\nPRAGMA journal_mode;\nPRAGMA wal_checkpoint;\n\n-- Uncommitted transactions in WAL identifizieren\n-- Hinweis: Erfordert spezielle Tools oder Hex-Editor\n-- Zeigt Konzept für manuelle Analyse\n\nSELECT \n name,\n rootpage,\n sql\nFROM sqlite_master \nWHERE type = 'table'\nORDER BY name;\n```\n\n### Gelöschte Daten-Recovery\n\n```python\n# Python-Script für erweiterte SQLite-Recovery\nimport sqlite3\nimport struct\nimport os\n\nclass SQLiteForensics:\n def __init__(self, db_path):\n self.db_path = db_path\n self.page_size = self.get_page_size()\n \n def get_page_size(self):\n \"\"\"SQLite Page-Size ermitteln\"\"\"\n with open(self.db_path, 'rb') as f:\n f.seek(16) # Page size offset\n return struct.unpack('>H', f.read(2))[0]\n \n def analyze_freespace(self):\n \"\"\"Freespace auf gelöschte Records analysieren\"\"\"\n conn = sqlite3.connect(self.db_path)\n cursor = conn.cursor()\n \n # Freespace-Informationen sammeln\n cursor.execute(\"PRAGMA freelist_count;\")\n free_pages = cursor.fetchone()[0]\n \n cursor.execute(\"PRAGMA page_count;\")\n total_pages = cursor.fetchone()[0]\n \n recovery_potential = {\n 'total_pages': total_pages,\n 'free_pages': free_pages,\n 'recovery_potential': f\"{(free_pages/total_pages)*100:.2f}%\"\n }\n \n conn.close()\n return recovery_potential\n \n def extract_unallocated(self):\n \"\"\"Unallocated Space für Recovery extrahieren\"\"\"\n # Vereinfachtes Beispiel - echte Implementation erfordert\n # detaillierte SQLite-Interna-Kenntnisse\n unallocated_data = []\n \n with open(self.db_path, 'rb') as f:\n file_size = os.path.getsize(self.db_path)\n pages = file_size // self.page_size\n \n for page_num in range(1, pages + 1):\n f.seek((page_num - 1) * self.page_size)\n page_data = f.read(self.page_size)\n \n # Suche nach Text-Patterns in Freespace\n # (Vereinfacht - echte Recovery ist komplexer)\n if b'WhatsApp' in page_data or b'@' in page_data:\n unallocated_data.append({\n 'page': page_num,\n 'potential_data': page_data[:100] # Erste 100 Bytes\n })\n \n return unallocated_data\n\n# Verwendung für Recovery-Assessment\nforensics = SQLiteForensics('/path/to/damaged.db')\nrecovery_info = forensics.analyze_freespace()\nprint(f\"Recovery-Potenzial: {recovery_info['recovery_potential']}\")\n```\n\n## Compliance und Rechtssicherheit\n\n### Audit-Trail erstellen\n\n```sql\n-- Forensische Dokumentation aller durchgeführten Abfragen\nCREATE TABLE IF NOT EXISTS forensic_audit_log (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,\n investigator TEXT,\n query_type TEXT,\n sql_query TEXT,\n affected_rows INTEGER,\n case_number TEXT,\n notes TEXT\n);\n\n-- Beispiel-Eintrag\nINSERT INTO forensic_audit_log \n(investigator, query_type, sql_query, affected_rows, case_number, notes)\nVALUES \n('Max Mustermann', 'TIMELINE_EXTRACTION', \n 'SELECT * FROM messages WHERE timestamp BETWEEN ? AND ?', \n 1247, 'CASE-2024-001', \n 'Timeline-Extraktion für Zeitraum 01.01.2024 - 31.01.2024');\n```\n\n### Hash-Verifikation implementieren\n\n```python\nimport hashlib\nimport sqlite3\n\ndef verify_database_integrity(db_path, expected_hash=None):\n \"\"\"Datenbank-Integrität durch Hash-Verifikation prüfen\"\"\"\n \n # SHA-256 Hash der Datenbankdatei\n sha256_hash = hashlib.sha256()\n with open(db_path, \"rb\") as f:\n for chunk in iter(lambda: f.read(4096), b\"\"):\n sha256_hash.update(chunk)\n \n current_hash = sha256_hash.hexdigest()\n \n # Zusätzlich: Struktureller Integritäts-Check\n conn = sqlite3.connect(db_path)\n cursor = conn.cursor()\n \n try:\n cursor.execute(\"PRAGMA integrity_check;\")\n integrity_result = cursor.fetchall()\n is_structurally_intact = integrity_result == [('ok',)]\n except Exception as e:\n is_structurally_intact = False\n integrity_result = [f\"Error: {str(e)}\"]\n finally:\n conn.close()\n \n return {\n 'file_hash': current_hash,\n 'hash_matches': current_hash == expected_hash if expected_hash else None,\n 'structurally_intact': is_structurally_intact,\n 'integrity_details': integrity_result,\n 'verified_at': datetime.now().isoformat()\n }\n\n# Chain of Custody dokumentieren\ndef log_database_access(db_path, investigator, purpose):\n \"\"\"Datenbankzugriff für Chain of Custody protokollieren\"\"\"\n verification = verify_database_integrity(db_path)\n \n log_entry = {\n 'timestamp': datetime.now().isoformat(),\n 'investigator': investigator,\n 'database_path': db_path,\n 'access_purpose': purpose,\n 'pre_access_hash': verification['file_hash'],\n 'database_integrity': verification['structurally_intact']\n }\n \n # Log in separater Audit-Datei speichern\n with open('forensic_access_log.json', 'a') as log_file:\n json.dump(log_entry, log_file)\n log_file.write('\\n')\n \n return log_entry\n```\n\n## Fazit und Weiterführende Ressourcen\n\nSQL in der digitalen Forensik ist mehr als nur Datenbankabfragen - es ist ein mächtiges Werkzeug für:\n\n- **Timeline-Rekonstruktion** mit präziser zeitlicher Korrelation\n- **Kommunikationsanalyse** für soziale Netzwerk-Aufklärung \n- **Anomalie-Erkennung** durch statistische Analyse\n- **Automatisierung** wiederkehrender Untersuchungsschritte\n- **Tiefe Datenextraktion** jenseits GUI-Limitationen\n\n### Nächste Schritte\n\n1. **Praktische Übung**: Beginnen Sie mit einfachen WhatsApp-Datenbank-Analysen\n2. **Tool-Integration**: Kombinieren Sie SQL mit Python für erweiterte Analysen\n3. **Spezialisierung**: Vertiefen Sie mobile-spezifische oder Browser-Forensik\n4. **Automation**: Entwickeln Sie wiederverwendbare SQL-Scripts für häufige Szenarien\n5. **Rechtssicherheit**: Implementieren Sie Audit-Trails und Hash-Verifikation\n\n### Empfohlene Tools\n\n- **DB Browser for SQLite**: GUI für interaktive Exploration\n- **SQLiteStudio**: Erweiterte SQLite-Verwaltung\n- **Python sqlite3**: Programmbasierte Automatisierung\n- **Autopsy**: Integration in forensische Workflows\n- **Cellebrite UFED**: Mobile Forensik mit SQL-Export\n\nDie Kombination aus SQL-Kenntnissen und forensischem Verständnis macht moderne Ermittler zu hocheffizienten Datenanalytikern. In einer Welt zunehmender Datenmengen wird diese Fähigkeit zum entscheidenden Wettbewerbsvorteil.","src/content/knowledgebase/concept-sql.md","75bc059c5f8b746e",{"html":1031,"metadata":1032},"\u003Ch1 id=\"sql-in-der-digitalen-forensik-von-sqlite-datenbanken-zur-timeline-analyse\">SQL in der digitalen Forensik: Von SQLite-Datenbanken zur Timeline-Analyse\u003C/h1>\n\u003Cp>SQL (Structured Query Language) ist eine der mächtigsten und unterschätztesten Fähigkeiten in der modernen digitalen Forensik. Während viele Ermittler auf GUI-basierte Tools setzen, ermöglicht SQL direkten Zugriff auf Rohdaten und komplexe Analysen, die mit herkömmlichen Tools unmöglich wären.\u003C/p>\n\u003Ch2 id=\"warum-sql-in-der-forensik-unverzichtbar-ist\">Warum SQL in der Forensik unverzichtbar ist\u003C/h2>\n\u003Ch3 id=\"sqlite-dominiert-die-mobile-forensik\">SQLite dominiert die mobile Forensik\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>WhatsApp-Chats\u003C/strong>: Nachrichten, Metadaten, gelöschte Inhalte\u003C/li>\n\u003Cli>\u003Cstrong>Browser-History\u003C/strong>: Zeitstempel, Besuchshäufigkeit, Suchverläufe\u003C/li>\n\u003Cli>\u003Cstrong>App-Daten\u003C/strong>: Standortdaten, Nutzerverhalten, Cache-Inhalte\u003C/li>\n\u003Cli>\u003Cstrong>System-Logs\u003C/strong>: Verbindungsprotokoll, Fehleraufzeichnungen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"vorteile-gegenüber-gui-tools\">Vorteile gegenüber GUI-Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Flexibilität\u003C/strong>: Komplexe Abfragen jenseits vordefinierter Filter\u003C/li>\n\u003Cli>\u003Cstrong>Performance\u003C/strong>: Direkte Datenbankzugriffe ohne Interface-Overhead\u003C/li>\n\u003Cli>\u003Cstrong>Automatisierung\u003C/strong>: Skript-basierte Analysen für wiederkehrende Aufgaben\u003C/li>\n\u003Cli>\u003Cstrong>Tiefe\u003C/strong>: Zugriff auf Metadaten und versteckte Tabellenstrukturen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"grundlagen-sqlite-struktur-verstehen\">Grundlagen: SQLite-Struktur verstehen\u003C/h2>\n\u003Ch3 id=\"datenbank-anatomie-in-der-forensik\">Datenbank-Anatomie in der Forensik\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Tabellen einer WhatsApp-Datenbank analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">.tables\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Tabellenstruktur untersuchen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#F97583\">schema\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Beispiel-Output:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">CREATE\u003C/span>\u003Cspan style=\"color:#F97583\"> TABLE\u003C/span>\u003Cspan style=\"color:#B392F0\"> messages\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> _id \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#F97583\"> PRIMARY KEY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> AUTOINCREMENT,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> key_remote_jid \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> key_from_me \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> key_id \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> status\u003C/span>\u003Cspan style=\"color:#F97583\"> INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> needs_push \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> data\u003C/span>\u003Cspan style=\"color:#F97583\"> TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> media_url \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> media_mime_type \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> media_wa_type \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> media_size \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> latitude \u003C/span>\u003Cspan style=\"color:#F97583\">REAL\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> longitude \u003C/span>\u003Cspan style=\"color:#F97583\">REAL\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"sqlite-spezifische-forensik-herausforderungen\">SQLite-spezifische Forensik-Herausforderungen\u003C/h3>\n\u003Cp>\u003Cstrong>WAL-Mode (Write-Ahead Logging)\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- WAL-Datei auf nicht-committete Transaktionen prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">PRAGMA journal_mode;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Temporäre Daten in WAL-Datei finden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- (Erfordert spezielle Tools wie sqlitewalreader)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Gelöschte Records\u003C/strong>:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Freespace-Analyse für gelöschte Daten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Hinweis: Erfordert spezialisierte Recovery-Tools\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"timeline-rekonstruktion-der-forensik-klassiker\">Timeline-Rekonstruktion: Der Forensik-Klassiker\u003C/h2>\n\u003Ch3 id=\"grundlegende-timeline-abfrage\">Grundlegende Timeline-Abfrage\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Chronologische Ereignisübersicht erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ereignis_zeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> key_from_me \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Ausgehend'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Eingehend'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> richtung,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> key_remote_jid \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> kontakt,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> substr(\u003C/span>\u003Cspan style=\"color:#F97583\">data\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">50\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">||\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '...'\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachricht_preview\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> DESC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LIMIT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"erweiterte-timeline-mit-kontextinformationen\">Erweiterte Timeline mit Kontextinformationen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Timeline mit Geolocation und Media-Daten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> zeitstempel,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">display_name\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> kontakt_name,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_from_me\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '→ Gesendet'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '← Empfangen'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> richtung,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">media_wa_type\u003C/span>\u003Cspan style=\"color:#F97583\"> IS NOT NULL\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Media: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">media_mime_type\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Text'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachricht_typ,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">latitude\u003C/span>\u003Cspan style=\"color:#F97583\"> IS NOT NULL\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Standort: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> ROUND\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">latitude\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">6\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">||\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ', '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> ROUND\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">longitude\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">6\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> substr(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">data\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> inhalt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages m\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> wa_contacts c \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_remote_jid\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">jid\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> BETWEEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'2024-01-01'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1000\u003C/span>\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'2024-01-31'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1000\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"kommunikations-analyse-soziale-netzwerke-aufdecken\">Kommunikations-Analyse: Soziale Netzwerke aufdecken\u003C/h2>\n\u003Ch3 id=\"häufigste-kontakte-identifizieren\">Häufigste Kontakte identifizieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Top-Kommunikationspartner nach Nachrichtenvolumen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">display_name\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_remote_jid\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachrichten_gesamt,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> SUM\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">CASE\u003C/span>\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_from_me\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesendet,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> SUM\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">CASE\u003C/span>\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_from_me\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> empfangen,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> MIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> erster_kontakt,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> MAX\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> letzter_kontakt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages m\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> wa_contacts c \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_remote_jid\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">jid\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">GROUP BY\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_remote_jid\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">HAVING\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachrichten_gesamt \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 10\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachrichten_gesamt \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"kommunikationsmuster-analyse\">Kommunikationsmuster-Analyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Tägliche Aktivitätsmuster\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#F97583\">timestamp/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachrichten_anzahl,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> AVG\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">length\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">data\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> durchschnittliche_laenge\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#F97583\"> data\u003C/span>\u003Cspan style=\"color:#F97583\"> IS NOT NULL\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Verdächtige Aktivitätsspitzen identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WITH\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hourly_stats \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> date\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> tag,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#F97583\">timestamp/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachrichten_pro_stunde\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> tag, stunde\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">avg_per_hour \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde, \u003C/span>\u003Cspan style=\"color:#79B8FF\">AVG\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(nachrichten_pro_stunde) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> durchschnitt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hourly_stats\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">tag\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">stunde\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">nachrichten_pro_stunde\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> a\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">durchschnitt\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> ROUND\u003C/span>\u003Cspan style=\"color:#E1E4E8\">((\u003C/span>\u003Cspan style=\"color:#79B8FF\">h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">nachrichten_pro_stunde\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#79B8FF\"> a\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">durchschnitt\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\"> a\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">durchschnitt\u003C/span>\u003Cspan style=\"color:#F97583\"> *\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> abweichung_prozent\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hourly_stats h\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> avg_per_hour a \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">stunde\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> a\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">stunde\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> h\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">nachrichten_pro_stunde\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#79B8FF\"> a\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">durchschnitt\u003C/span>\u003Cspan style=\"color:#F97583\"> *\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> abweichung_prozent \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"browser-forensik-digitale-spuren-verfolgen\">Browser-Forensik: Digitale Spuren verfolgen\u003C/h2>\n\u003Ch3 id=\"chromechromium-history-analyse\">Chrome/Chromium History-Analyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Browser-History mit Besuchshäufigkeit\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> title,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> visit_count,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(last_visit_time\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000000\u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">11644473600\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> letzter_besuch,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> typed_count \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Direkt eingegeben'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Über Link/Verlauf'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> zugriff_art\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> urls \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> last_visit_time \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> last_visit_time \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LIMIT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"such-verlauf-analysieren\">Such-Verlauf analysieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Google-Suchen aus Browser-History extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(last_visit_time\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000000\u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\">11644473600\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suchzeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#F97583\"> url\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%google.com/search%'\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> replace\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(substr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, instr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'q='\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> case\u003C/span>\u003Cspan style=\"color:#F97583\"> when\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> instr(substr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, instr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'q='\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'&'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> then\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> instr(substr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, instr(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'q='\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'&'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> else\u003C/span>\u003Cspan style=\"color:#F97583\"> length\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">url\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">end\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'+'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Andere Suchmaschine'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suchbegriff,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> url\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> urls \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> url\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%search%'\u003C/span>\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#F97583\"> url\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%q=%'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> last_visit_time \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"anomalie-erkennung-mit-sql\">Anomalie-Erkennung mit SQL\u003C/h2>\n\u003Ch3 id=\"ungewöhnliche-datei-zugriffe-identifizieren\">Ungewöhnliche Datei-Zugriffe identifizieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Dateizugriffe außerhalb der Arbeitszeiten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WITH\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_access \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> zugriffszeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%w'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> wochentag,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> file_path,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> action_type\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_access_logs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#F97583\"> *\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_access\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> stunde \u003C/span>\u003Cspan style=\"color:#F97583\"><\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '08'\u003C/span>\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stunde \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '18'\u003C/span>\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#6A737D\"> -- Außerhalb 8-18 Uhr\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> wochentag \u003C/span>\u003Cspan style=\"color:#F97583\">IN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'0'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'6'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#6A737D\">-- Wochenende\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">AND\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> action_type \u003C/span>\u003Cspan style=\"color:#F97583\">IN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'read'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'write'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'delete'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> zugriffszeit \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"datenexfiltration-indikatoren\">Datenexfiltration-Indikatoren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Große Dateiübertragungen in kurzen Zeiträumen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(transfer_start, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> start_zeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> SUM\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(file_size) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesamt_bytes,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anzahl_dateien,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> destination_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> GROUP_CONCAT(\u003C/span>\u003Cspan style=\"color:#F97583\">DISTINCT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_extension) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> dateitypen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> network_transfers \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> transfer_start \u003C/span>\u003Cspan style=\"color:#F97583\">BETWEEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'now'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'-7 days'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">AND\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'now'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> date\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(transfer_start, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, transfer_start, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> destination_ip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">HAVING\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesamt_bytes \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100000000\u003C/span>\u003Cspan style=\"color:#6A737D\"> -- > 100MB\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesamt_bytes \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"erweiterte-techniken-window-functions-und-ctes\">Erweiterte Techniken: Window Functions und CTEs\u003C/h2>\n\u003Ch3 id=\"sliding-window-analyse-für-ereigniskorrelation\">Sliding Window-Analyse für Ereigniskorrelation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Ereignisse in 5-Minuten-Fenstern korrelieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WITH\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> event_windows \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ereigniszeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> LAG\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">OVER\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#F97583\">PARTITION\u003C/span>\u003Cspan style=\"color:#F97583\"> BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_id \u003C/span>\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> prev_timestamp,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> LEAD\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">OVER\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#F97583\">PARTITION\u003C/span>\u003Cspan style=\"color:#F97583\"> BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_id \u003C/span>\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> next_timestamp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> security_events\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ereigniszeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> prev_timestamp) \u003C/span>\u003Cspan style=\"color:#F97583\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 300\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Schnelle Aufeinanderfolge'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (next_timestamp \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 300\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Vor schnellem Event'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Isoliert'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ereignis_kontext\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> event_windows;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"temporäre-anomalie-scores\">Temporäre Anomalie-Scores\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Anomalie-Score basierend auf Abweichung vom Normalverhalten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WITH\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_baseline \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> AVG\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(daily_logins) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> avg_logins,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> STDEV\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(daily_logins) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stddev_logins\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> date\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(login_time, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_date,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> daily_logins\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_logins\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_time \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'now'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'-30 days'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_id, login_date\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_id\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> HAVING\u003C/span>\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 7\u003C/span>\u003Cspan style=\"color:#6A737D\"> -- Mindestens 7 Tage Daten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">current_behavior \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> date\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(login_time, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_date,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> daily_logins\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_logins\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_time \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'now'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'-7 days'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> GROUP BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_id, login_date\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">login_date\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">daily_logins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> b\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">avg_logins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> ROUND\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">ABS\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">daily_logins\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#79B8FF\"> b\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">avg_logins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\"> b\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">stddev_logins\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalie_score\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> current_behavior c\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_baseline b \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> b\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalie_score \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#6A737D\"> -- Mehr als 2 Standardabweichungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalie_score \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"python-integration-für-automatisierung\">Python-Integration für Automatisierung\u003C/h2>\n\u003Ch3 id=\"sqlite-forensik-mit-python\">SQLite-Forensik mit Python\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pandas \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> datetime \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> datetime\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> matplotlib.pyplot \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> plt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> ForensicSQLAnalyzer\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#79B8FF\"> __init__\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, db_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.conn \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3.connect(db_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.conn.row_factory \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3.Row\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> extract_timeline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, start_date\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, end_date\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Timeline-Extraktion mit Datumsfilterung\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> SELECT \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> datetime(timestamp/1000, 'unixepoch', 'localtime') as timestamp,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> event_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> details,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> user_context\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> FROM events \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> WHERE 1=1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> params \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> start_date:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">+=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \" AND timestamp >= ?\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> params.append(\u003C/span>\u003Cspan style=\"color:#79B8FF\">int\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(start_date.timestamp() \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">))\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> end_date:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">+=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \" AND timestamp <= ?\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> params.append(\u003C/span>\u003Cspan style=\"color:#79B8FF\">int\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(end_date.timestamp() \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">))\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">+=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \" ORDER BY timestamp\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.read_sql_query(query, \u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.conn, \u003C/span>\u003Cspan style=\"color:#FFAB70\">params\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">params)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> communication_analysis\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Kommunikationsmuster analysieren\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> SELECT \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> contact_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> COUNT(*) as message_count,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> AVG(message_length) as avg_length,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> MIN(timestamp) as first_contact,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> MAX(timestamp) as last_contact\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> FROM messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> GROUP BY contact_id\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> HAVING message_count > 5\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> ORDER BY message_count DESC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.read_sql_query(query, \u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.conn)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, threshold\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">2.0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Statistische Anomalie-Erkennung\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> WITH daily_stats AS (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> SELECT \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> date(timestamp, 'unixepoch', 'localtime') as day,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> COUNT(*) as daily_events\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> FROM events\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> GROUP BY day\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> ),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> stats AS (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> SELECT \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> AVG(daily_events) as mean_events,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> STDEV(daily_events) as stddev_events\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> FROM daily_stats\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> SELECT \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> d.day,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> d.daily_events,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> s.mean_events,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> ABS(d.daily_events - s.mean_events) / s.stddev_events as z_score\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> FROM daily_stats d, stats s\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> WHERE z_score > ?\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> ORDER BY z_score DESC\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.read_sql_query(query, \u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.conn, \u003C/span>\u003Cspan style=\"color:#FFAB70\">params\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">[threshold])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> export_findings\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, filename):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Ermittlungsergebnisse exportieren\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.extract_timeline()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> comms \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.communication_analysis()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalies \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.detect_anomalies()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.ExcelWriter(filename) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> writer:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline.to_excel(writer, \u003C/span>\u003Cspan style=\"color:#FFAB70\">sheet_name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'Timeline'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> comms.to_excel(writer, \u003C/span>\u003Cspan style=\"color:#FFAB70\">sheet_name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'Communications'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalies.to_excel(writer, \u003C/span>\u003Cspan style=\"color:#FFAB70\">sheet_name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'Anomalies'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verwendung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">analyzer \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ForensicSQLAnalyzer(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'/path/to/evidence.db'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">findings \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> analyzer.export_findings(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'investigation_findings.xlsx'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"häufige-fallstricke-und-best-practices\">Häufige Fallstricke und Best Practices\u003C/h2>\n\u003Ch3 id=\"datenintegrität-sicherstellen\">Datenintegrität sicherstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Konsistenz-Checks vor Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Null Timestamps'\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> issue_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> count\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> IS\u003C/span>\u003Cspan style=\"color:#F97583\"> NULL\u003C/span>\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">UNION ALL\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Missing Contact Info'\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> issue_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> count\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages m\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> wa_contacts c \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">key_remote_jid\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">jid\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> c\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">jid\u003C/span>\u003Cspan style=\"color:#F97583\"> IS\u003C/span>\u003Cspan style=\"color:#F97583\"> NULL\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"performance-optimierung\">Performance-Optimierung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Index für häufige Abfragen erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">CREATE\u003C/span>\u003Cspan style=\"color:#F97583\"> INDEX\u003C/span>\u003Cspan style=\"color:#B392F0\"> IF\u003C/span>\u003Cspan style=\"color:#F97583\"> NOT\u003C/span>\u003Cspan style=\"color:#F97583\"> EXISTS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> idx_messages_timestamp \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages(\u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">CREATE\u003C/span>\u003Cspan style=\"color:#F97583\"> INDEX\u003C/span>\u003Cspan style=\"color:#B392F0\"> IF\u003C/span>\u003Cspan style=\"color:#F97583\"> NOT\u003C/span>\u003Cspan style=\"color:#F97583\"> EXISTS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> idx_messages_contact_timestamp \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages(key_remote_jid, \u003C/span>\u003Cspan style=\"color:#F97583\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Query-Performance analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">EXPLAIN QUERY PLAN \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#F97583\"> *\u003C/span>\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> messages \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> BETWEEN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ? \u003C/span>\u003Cspan style=\"color:#F97583\">AND\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ?\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"forensische-dokumentation\">Forensische Dokumentation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Metadaten für Gerichtsverwertbarkeit dokumentieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Database Schema Version'\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> info_type,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_version \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#F97583\"> value\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pragma_user_version\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">UNION ALL\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Last Modified'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(mtime, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pragma_file_control;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"spezialisierte-forensik-szenarien\">Spezialisierte Forensik-Szenarien\u003C/h2>\n\u003Ch3 id=\"mobile-app-forensik-instagram-datenbank\">Mobile App-Forensik: Instagram-Datenbank\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Instagram-Nachrichten mit Medien-Metadaten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> nachricht_zeit,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> u\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">username\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> absender,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> CASE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">item_type\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Text: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">text\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">item_type\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Bild: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> mi\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">media_url\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">item_type\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 3\u003C/span>\u003Cspan style=\"color:#F97583\"> THEN\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Video: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> mi\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">media_url\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> ELSE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'Anderer Typ: '\u003C/span>\u003Cspan style=\"color:#F97583\"> ||\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">item_type\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> END\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> inhalt,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">thread_key\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> chat_id\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> direct_messages m\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> users u \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> u\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">pk\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> media_items mi \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">media_id\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> mi\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">id\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#79B8FF\"> m\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"incident-response-systemprotokoll-korrelation\">Incident Response: Systemprotokoll-Korrelation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Korrelation zwischen Login-Events und Netzwerk-Aktivität\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WITH\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suspicious_logins \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> login_time,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_id,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> source_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> login_time \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 3600\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> investigation_window \u003C/span>\u003Cspan style=\"color:#6A737D\">-- 1 Stunde nach Login\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_events \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> WHERE\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> source_ip \u003C/span>\u003Cspan style=\"color:#F97583\">NOT\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '192.168.%'\u003C/span>\u003Cspan style=\"color:#6A737D\"> -- Externe IPs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_time \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%s'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'now'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'-7 days'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">network_activity \u003C/span>\u003Cspan style=\"color:#F97583\">AS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> connection_time,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> source_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> destination_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> bytes_transferred,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> protocol\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> network_connections\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> datetime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">login_time\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'unixepoch'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'localtime'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> verdaechtiger_login,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">source_ip\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_ip,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> COUNT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">na\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">connection_time\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> netzwerk_aktivitaeten,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> SUM\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">na\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">bytes_transferred\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesamt_daten_bytes,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> GROUP_CONCAT(\u003C/span>\u003Cspan style=\"color:#F97583\">DISTINCT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> na\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">destination_ip\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ziel_ips\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suspicious_logins sl\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">LEFT JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> network_activity na \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> na\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">connection_time\u003C/span>\u003Cspan style=\"color:#F97583\"> BETWEEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">login_time\u003C/span>\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">investigation_window\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#79B8FF\"> na\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">source_ip\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">source_ip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">GROUP BY\u003C/span>\u003Cspan style=\"color:#79B8FF\"> sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">login_time\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">user_id\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">sl\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">source_ip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">HAVING\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> netzwerk_aktivitaeten \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> gesamt_daten_bytes \u003C/span>\u003Cspan style=\"color:#F97583\">DESC\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"erweiterte-wal-analyse-und-recovery\">Erweiterte WAL-Analyse und Recovery\u003C/h2>\n\u003Ch3 id=\"wal-datei-untersuchung\">WAL-Datei Untersuchung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- WAL-Mode Status prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">PRAGMA journal_mode;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">PRAGMA wal_checkpoint;\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Uncommitted transactions in WAL identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Hinweis: Erfordert spezielle Tools oder Hex-Editor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Zeigt Konzept für manuelle Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> name\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> rootpage,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> sql\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite_master \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> type\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'table'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> name\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"gelöschte-daten-recovery\">Gelöschte Daten-Recovery\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Python-Script für erweiterte SQLite-Recovery\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> struct\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> os\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">class\u003C/span>\u003Cspan style=\"color:#B392F0\"> SQLiteForensics\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#79B8FF\"> __init__\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self, db_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.db_path \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> db_path\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.page_size \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.get_page_size()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> get_page_size\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"SQLite Page-Size ermitteln\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.db_path, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'rb'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> f.seek(\u003C/span>\u003Cspan style=\"color:#79B8FF\">16\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#6A737D\"># Page size offset\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> struct.unpack(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'>H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, f.read(\u003C/span>\u003Cspan style=\"color:#79B8FF\">2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">))[\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_freespace\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Freespace auf gelöschte Records analysieren\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3.connect(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.db_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> cursor \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn.cursor()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Freespace-Informationen sammeln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> cursor.execute(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"PRAGMA freelist_count;\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> free_pages \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> cursor.fetchone()[\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> cursor.execute(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"PRAGMA page_count;\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> total_pages \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> cursor.fetchone()[\u003C/span>\u003Cspan style=\"color:#79B8FF\">0\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> recovery_potential \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'total_pages'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: total_pages,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'free_pages'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: free_pages,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'recovery_potential'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(free_pages\u003C/span>\u003Cspan style=\"color:#F97583\">/\u003C/span>\u003Cspan style=\"color:#E1E4E8\">total_pages)\u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\">100\u003C/span>\u003Cspan style=\"color:#F97583\">:.2f\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">%\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn.close()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> recovery_potential\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> def\u003C/span>\u003Cspan style=\"color:#B392F0\"> extract_unallocated\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(self):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Unallocated Space für Recovery extrahieren\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Vereinfachtes Beispiel - echte Implementation erfordert\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # detaillierte SQLite-Interna-Kenntnisse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> unallocated_data \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.db_path, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'rb'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> file_size \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> os.path.getsize(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.db_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> pages \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_size \u003C/span>\u003Cspan style=\"color:#F97583\">//\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.page_size\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> page_num \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> range\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, pages \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> f.seek((page_num \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">*\u003C/span>\u003Cspan style=\"color:#79B8FF\"> self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.page_size)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> page_data \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f.read(\u003C/span>\u003Cspan style=\"color:#79B8FF\">self\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.page_size)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Suche nach Text-Patterns in Freespace\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # (Vereinfacht - echte Recovery ist komplexer)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#F97583\"> b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'WhatsApp'\u003C/span>\u003Cspan style=\"color:#F97583\"> in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> page_data \u003C/span>\u003Cspan style=\"color:#F97583\">or\u003C/span>\u003Cspan style=\"color:#F97583\"> b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'@'\u003C/span>\u003Cspan style=\"color:#F97583\"> in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> page_data:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> unallocated_data.append({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'page'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: page_num,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'potential_data'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: page_data[:\u003C/span>\u003Cspan style=\"color:#79B8FF\">100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#6A737D\"># Erste 100 Bytes\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> })\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> unallocated_data\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Verwendung für Recovery-Assessment\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">forensics \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> SQLiteForensics(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'/path/to/damaged.db'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">recovery_info \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> forensics.analyze_freespace()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">print\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"Recovery-Potenzial: \u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">recovery_info[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'recovery_potential'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"compliance-und-rechtssicherheit\">Compliance und Rechtssicherheit\u003C/h2>\n\u003Ch3 id=\"audit-trail-erstellen\">Audit-Trail erstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Forensische Dokumentation aller durchgeführten Abfragen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">CREATE\u003C/span>\u003Cspan style=\"color:#F97583\"> TABLE\u003C/span>\u003Cspan style=\"color:#B392F0\"> IF\u003C/span>\u003Cspan style=\"color:#F97583\"> NOT\u003C/span>\u003Cspan style=\"color:#F97583\"> EXISTS\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> forensic_audit_log (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> id \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#F97583\"> PRIMARY KEY\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> AUTOINCREMENT,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> DATETIME\u003C/span>\u003Cspan style=\"color:#F97583\"> DEFAULT\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> CURRENT_TIMESTAMP,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> investigator \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> query_type \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> sql_query \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> affected_rows \u003C/span>\u003Cspan style=\"color:#F97583\">INTEGER\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> case_number \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> notes \u003C/span>\u003Cspan style=\"color:#F97583\">TEXT\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Beispiel-Eintrag\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">INSERT INTO\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> forensic_audit_log \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">(investigator, query_type, sql_query, affected_rows, case_number, notes)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">VALUES\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'Max Mustermann'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'TIMELINE_EXTRACTION'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'SELECT * FROM messages WHERE timestamp BETWEEN ? AND ?'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> 1247\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'CASE-2024-001'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'Timeline-Extraktion für Zeitraum 01.01.2024 - 31.01.2024'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"hash-verifikation-implementieren\">Hash-Verifikation implementieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> verify_database_integrity\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(db_path, expected_hash\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Datenbank-Integrität durch Hash-Verifikation prüfen\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # SHA-256 Hash der Datenbankdatei\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> sha256_hash \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hashlib.sha256()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(db_path, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"rb\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> f:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> chunk \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#79B8FF\"> iter\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">lambda\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: f.read(\u003C/span>\u003Cspan style=\"color:#79B8FF\">4096\u003C/span>\u003Cspan style=\"color:#E1E4E8\">), \u003C/span>\u003Cspan style=\"color:#F97583\">b\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> sha256_hash.update(chunk)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> current_hash \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sha256_hash.hexdigest()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Zusätzlich: Struktureller Integritäts-Check\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sqlite3.connect(db_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> cursor \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn.cursor()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> try\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> cursor.execute(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"PRAGMA integrity_check;\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> integrity_result \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> cursor.fetchall()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> is_structurally_intact \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> integrity_result \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'ok'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,)]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> except\u003C/span>\u003Cspan style=\"color:#79B8FF\"> Exception\u003C/span>\u003Cspan style=\"color:#F97583\"> as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> e:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> is_structurally_intact \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\"> False\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> integrity_result \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [\u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"Error: \u003C/span>\u003Cspan style=\"color:#79B8FF\">{str\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(e)\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> finally\u003C/span>\u003Cspan style=\"color:#E1E4E8\">:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn.close()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'file_hash'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: current_hash,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'hash_matches'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: current_hash \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> expected_hash \u003C/span>\u003Cspan style=\"color:#F97583\">if\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> expected_hash \u003C/span>\u003Cspan style=\"color:#F97583\">else\u003C/span>\u003Cspan style=\"color:#79B8FF\"> None\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'structurally_intact'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: is_structurally_intact,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'integrity_details'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: integrity_result,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'verified_at'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: datetime.now().isoformat()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Chain of Custody dokumentieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> log_database_access\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(db_path, investigator, purpose):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"Datenbankzugriff für Chain of Custody protokollieren\"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> verification \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> verify_database_integrity(db_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> log_entry \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: datetime.now().isoformat(),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'investigator'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: investigator,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'database_path'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: db_path,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'access_purpose'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: purpose,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'pre_access_hash'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: verification[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'file_hash'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">],\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'database_integrity'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: verification[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'structurally_intact'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Log in separater Audit-Datei speichern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> with\u003C/span>\u003Cspan style=\"color:#79B8FF\"> open\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'forensic_access_log.json'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'a'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> log_file:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> json.dump(log_entry, log_file)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> log_file.write(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\n\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> log_entry\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fazit-und-weiterführende-ressourcen\">Fazit und Weiterführende Ressourcen\u003C/h2>\n\u003Cp>SQL in der digitalen Forensik ist mehr als nur Datenbankabfragen - es ist ein mächtiges Werkzeug für:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Timeline-Rekonstruktion\u003C/strong> mit präziser zeitlicher Korrelation\u003C/li>\n\u003Cli>\u003Cstrong>Kommunikationsanalyse\u003C/strong> für soziale Netzwerk-Aufklärung\u003C/li>\n\u003Cli>\u003Cstrong>Anomalie-Erkennung\u003C/strong> durch statistische Analyse\u003C/li>\n\u003Cli>\u003Cstrong>Automatisierung\u003C/strong> wiederkehrender Untersuchungsschritte\u003C/li>\n\u003Cli>\u003Cstrong>Tiefe Datenextraktion\u003C/strong> jenseits GUI-Limitationen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"nächste-schritte\">Nächste Schritte\u003C/h3>\n\u003Col>\n\u003Cli>\u003Cstrong>Praktische Übung\u003C/strong>: Beginnen Sie mit einfachen WhatsApp-Datenbank-Analysen\u003C/li>\n\u003Cli>\u003Cstrong>Tool-Integration\u003C/strong>: Kombinieren Sie SQL mit Python für erweiterte Analysen\u003C/li>\n\u003Cli>\u003Cstrong>Spezialisierung\u003C/strong>: Vertiefen Sie mobile-spezifische oder Browser-Forensik\u003C/li>\n\u003Cli>\u003Cstrong>Automation\u003C/strong>: Entwickeln Sie wiederverwendbare SQL-Scripts für häufige Szenarien\u003C/li>\n\u003Cli>\u003Cstrong>Rechtssicherheit\u003C/strong>: Implementieren Sie Audit-Trails und Hash-Verifikation\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"empfohlene-tools\">Empfohlene Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>DB Browser for SQLite\u003C/strong>: GUI für interaktive Exploration\u003C/li>\n\u003Cli>\u003Cstrong>SQLiteStudio\u003C/strong>: Erweiterte SQLite-Verwaltung\u003C/li>\n\u003Cli>\u003Cstrong>Python sqlite3\u003C/strong>: Programmbasierte Automatisierung\u003C/li>\n\u003Cli>\u003Cstrong>Autopsy\u003C/strong>: Integration in forensische Workflows\u003C/li>\n\u003Cli>\u003Cstrong>Cellebrite UFED\u003C/strong>: Mobile Forensik mit SQL-Export\u003C/li>\n\u003C/ul>\n\u003Cp>Die Kombination aus SQL-Kenntnissen und forensischem Verständnis macht moderne Ermittler zu hocheffizienten Datenanalytikern. In einer Welt zunehmender Datenmengen wird diese Fähigkeit zum entscheidenden Wettbewerbsvorteil.\u003C/p>",{"headings":1033,"localImagePaths":1150,"remoteImagePaths":1151,"frontmatter":1152,"imagePaths":1157},[1034,1036,1039,1042,1045,1048,1051,1054,1057,1060,1063,1066,1069,1072,1075,1078,1081,1084,1087,1090,1093,1096,1099,1102,1105,1108,1111,1113,1116,1119,1122,1125,1128,1131,1134,1137,1140,1143,1146,1147],{"depth":44,"slug":1035,"text":1009},"sql-in-der-digitalen-forensik-von-sqlite-datenbanken-zur-timeline-analyse",{"depth":47,"slug":1037,"text":1038},"warum-sql-in-der-forensik-unverzichtbar-ist","Warum SQL in der Forensik unverzichtbar ist",{"depth":54,"slug":1040,"text":1041},"sqlite-dominiert-die-mobile-forensik","SQLite dominiert die mobile Forensik",{"depth":54,"slug":1043,"text":1044},"vorteile-gegenüber-gui-tools","Vorteile gegenüber GUI-Tools",{"depth":47,"slug":1046,"text":1047},"grundlagen-sqlite-struktur-verstehen","Grundlagen: SQLite-Struktur verstehen",{"depth":54,"slug":1049,"text":1050},"datenbank-anatomie-in-der-forensik","Datenbank-Anatomie in der Forensik",{"depth":54,"slug":1052,"text":1053},"sqlite-spezifische-forensik-herausforderungen","SQLite-spezifische Forensik-Herausforderungen",{"depth":47,"slug":1055,"text":1056},"timeline-rekonstruktion-der-forensik-klassiker","Timeline-Rekonstruktion: Der Forensik-Klassiker",{"depth":54,"slug":1058,"text":1059},"grundlegende-timeline-abfrage","Grundlegende Timeline-Abfrage",{"depth":54,"slug":1061,"text":1062},"erweiterte-timeline-mit-kontextinformationen","Erweiterte Timeline mit Kontextinformationen",{"depth":47,"slug":1064,"text":1065},"kommunikations-analyse-soziale-netzwerke-aufdecken","Kommunikations-Analyse: Soziale Netzwerke aufdecken",{"depth":54,"slug":1067,"text":1068},"häufigste-kontakte-identifizieren","Häufigste Kontakte identifizieren",{"depth":54,"slug":1070,"text":1071},"kommunikationsmuster-analyse","Kommunikationsmuster-Analyse",{"depth":47,"slug":1073,"text":1074},"browser-forensik-digitale-spuren-verfolgen","Browser-Forensik: Digitale Spuren verfolgen",{"depth":54,"slug":1076,"text":1077},"chromechromium-history-analyse","Chrome/Chromium History-Analyse",{"depth":54,"slug":1079,"text":1080},"such-verlauf-analysieren","Such-Verlauf analysieren",{"depth":47,"slug":1082,"text":1083},"anomalie-erkennung-mit-sql","Anomalie-Erkennung mit SQL",{"depth":54,"slug":1085,"text":1086},"ungewöhnliche-datei-zugriffe-identifizieren","Ungewöhnliche Datei-Zugriffe identifizieren",{"depth":54,"slug":1088,"text":1089},"datenexfiltration-indikatoren","Datenexfiltration-Indikatoren",{"depth":47,"slug":1091,"text":1092},"erweiterte-techniken-window-functions-und-ctes","Erweiterte Techniken: Window Functions und CTEs",{"depth":54,"slug":1094,"text":1095},"sliding-window-analyse-für-ereigniskorrelation","Sliding Window-Analyse für Ereigniskorrelation",{"depth":54,"slug":1097,"text":1098},"temporäre-anomalie-scores","Temporäre Anomalie-Scores",{"depth":47,"slug":1100,"text":1101},"python-integration-für-automatisierung","Python-Integration für Automatisierung",{"depth":54,"slug":1103,"text":1104},"sqlite-forensik-mit-python","SQLite-Forensik mit Python",{"depth":47,"slug":1106,"text":1107},"häufige-fallstricke-und-best-practices","Häufige Fallstricke und Best Practices",{"depth":54,"slug":1109,"text":1110},"datenintegrität-sicherstellen","Datenintegrität sicherstellen",{"depth":54,"slug":645,"text":1112},"Performance-Optimierung",{"depth":54,"slug":1114,"text":1115},"forensische-dokumentation","Forensische Dokumentation",{"depth":47,"slug":1117,"text":1118},"spezialisierte-forensik-szenarien","Spezialisierte Forensik-Szenarien",{"depth":54,"slug":1120,"text":1121},"mobile-app-forensik-instagram-datenbank","Mobile App-Forensik: Instagram-Datenbank",{"depth":54,"slug":1123,"text":1124},"incident-response-systemprotokoll-korrelation","Incident Response: Systemprotokoll-Korrelation",{"depth":47,"slug":1126,"text":1127},"erweiterte-wal-analyse-und-recovery","Erweiterte WAL-Analyse und Recovery",{"depth":54,"slug":1129,"text":1130},"wal-datei-untersuchung","WAL-Datei Untersuchung",{"depth":54,"slug":1132,"text":1133},"gelöschte-daten-recovery","Gelöschte Daten-Recovery",{"depth":47,"slug":1135,"text":1136},"compliance-und-rechtssicherheit","Compliance und Rechtssicherheit",{"depth":54,"slug":1138,"text":1139},"audit-trail-erstellen","Audit-Trail erstellen",{"depth":54,"slug":1141,"text":1142},"hash-verifikation-implementieren","Hash-Verifikation implementieren",{"depth":47,"slug":1144,"text":1145},"fazit-und-weiterführende-ressourcen","Fazit und Weiterführende Ressourcen",{"depth":54,"slug":994,"text":995},{"depth":54,"slug":1148,"text":1149},"empfohlene-tools","Empfohlene Tools",[],[],{"title":1009,"description":1010,"author":18,"last_updated":1153,"difficulty":189,"categories":1154,"tags":1155,"tool_name":1012,"related_tools":1156,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,192,352],[1018,1019,1020,1021,864,1022,1023,1024,1025,1026],[1014,184,1015],[],"concept-sql.md","concept-timeline-analysis",{"id":1159,"data":1161,"body":1180,"filePath":1181,"digest":1182,"rendered":1183,"legacyId":1287},{"title":1162,"description":1163,"last_updated":1164,"tool_name":1165,"related_tools":1166,"author":18,"difficulty":19,"categories":1168,"tags":1170,"published":34,"gated_content":35},"Timeline-Analyse & Event-Korrelation: Methodische Rekonstruktion forensischer Ereignisse","Umfassende Anleitung zur systematischen Timeline-Erstellung aus heterogenen Datenquellen, Super-Timeline-Processing und Advanced-Correlation-Techniken für komplexe Incident-Response-Szenarien.",["Date","2025-08-10T00:00:00.000Z"],"Timeline Analysis & Event Correlation",[184,187,684,1167],"SIFT Workstation",[191,1169,697],"methodology",[1171,1172,1173,1174,1175,1176,696,1177,697,1178,1179],"timeline-correlation","event-sequencing","temporal-analysis","super-timeline","pivot-points","behavioral-patterns","anti-forensics-detection","log2timeline","plaso","# Timeline-Analyse & Event-Korrelation: Methodische Rekonstruktion forensischer Ereignisse\n\nTimeline-Analyse bildet das Rückgrat moderner forensischer Untersuchungen und ermöglicht die chronologische Rekonstruktion von Ereignissen aus heterogenen digitalen Artefakten. Diese methodische Herangehensweise korreliert zeitbasierte Evidenz für präzise Incident-Response und belastbare Beweisführung.\n\n## Grundlagen der forensischen Timeline-Analyse\n\n### Was ist Timeline-Analyse?\n\nTimeline-Analyse ist die systematische Korrelation zeitbasierter Artefakte aus verschiedenen digitalen Quellen zur Rekonstruktion von Ereignissequenzen. Sie ermöglicht Forensikern, das \"Was\", \"Wann\", \"Wo\" und \"Wie\" von Sicherheitsvorfällen zu verstehen.\n\n**Kernprinzipien:**\n- **Chronologische Ordnung**: Alle Ereignisse werden in temporaler Reihenfolge arrangiert\n- **Multi-Source-Integration**: Daten aus verschiedenen Systemen werden vereint\n- **Zeitstempel-Normalisierung**: UTC-Konvertierung für einheitliche Referenz\n- **Korrelationsbasierte Analyse**: Zusammenhänge zwischen scheinbar unabhängigen Events\n\n### Typologie forensischer Zeitstempel\n\n**MAC-Times (Modified, Accessed, Created)**\n```\nFilesystem-Timestamps:\n- $STANDARD_INFORMATION (SI) - NTFS-Metadaten\n- $FILE_NAME (FN) - Directory-Entry-Timestamps \n- Born Date - Erste Erstellung im Filesystem\n- $USNJrnl - Change Journal Entries\n```\n\n**Registry-Timestamps**\n```\nWindows Registry:\n- Key Last Write Time - Letzte Modifikation\n- Value Creation Time - Wert-Erstellung\n- Hive Load Time - Registry-Hive-Mounting\n```\n\n**Event-Log-Timestamps**\n```\nWindows Event Logs:\n- TimeCreated - Event-Generierung\n- TimeWritten - Log-Persistierung \n- CorrelationActivityID - Cross-System-Tracking\n```\n\n## Super-Timeline-Erstellung: Methodisches Vorgehen\n\n### Phase 1: Artefakt-Akquisition und Preprocessing\n\n**Datenquellen-Inventar erstellen:**\n\n```bash\n# Filesystem-Timeline mit fls\nfls -r -p -m /mnt/evidence/image.dd > filesystem_timeline.body\n\n# Registry-Timeline mit regtime\nregtime.py -r /mnt/evidence/registry/ > registry_timeline.csv\n\n# Event-Log-Extraktion mit python-evtx\nevtx_dump.py Security.evtx > security_events.xml\n```\n\n**Memory-Artefakte integrieren:**\n```bash\n# Volatility Timeline-Generierung\nvol.py -f memory.vmem --profile=Win10x64 timeliner > memory_timeline.csv\n\n# Process-Timeline mit detailed Metadata\nvol.py -f memory.vmem --profile=Win10x64 pslist -v > process_details.txt\n```\n\n### Phase 2: Zeitstempel-Normalisierung und UTC-Konvertierung\n\n**Timezone-Handling:**\n```python\n# Python-Script für Timezone-Normalisierung\nimport datetime\nimport pytz\n\ndef normalize_timestamp(timestamp_str, source_timezone):\n \"\"\"\n Konvertiert lokale Timestamps zu UTC für einheitliche Timeline\n \"\"\"\n local_tz = pytz.timezone(source_timezone)\n dt = datetime.datetime.strptime(timestamp_str, '%Y-%m-%d %H:%M:%S')\n localized_dt = local_tz.localize(dt)\n utc_dt = localized_dt.astimezone(pytz.utc)\n return utc_dt.strftime('%Y-%m-%d %H:%M:%S UTC')\n```\n\n**Anti-Timestomp-Detection:**\n```bash\n# Timestomp-Anomalien identifizieren\nanalyzeMFT.py -f $MFT -o mft_analysis.csv\n# Suche nach: SI-Time \u003C FN-Time (Timestomp-Indikator)\n```\n\n### Phase 3: Log2timeline/PLASO Super-Timeline-Processing\n\n**PLASO-basierte Timeline-Generierung:**\n```bash\n# Multi-Source-Timeline mit log2timeline\nlog2timeline.py --storage-file evidence.plaso \\\n --parsers \"win7,chrome,firefox,skype\" \\\n --timezone \"Europe/Berlin\" \\\n /mnt/evidence/\n\n# CSV-Export für Analysis\npsort.py -w timeline_super.csv evidence.plaso\n```\n\n**Advanced PLASO-Filtering:**\n```bash\n# Zeitfenster-spezifische Extraktion\npsort.py -w incident_window.csv \\\n --date-filter \"2024-01-10,2024-01-12\" \\\n evidence.plaso\n\n# Ereignis-spezifisches Filtering\npsort.py -w web_activity.csv \\\n --filter \"parser contains 'chrome'\" \\\n evidence.plaso\n```\n\n## Advanced Correlation-Techniken\n\n### Pivot-Point-Identifikation\n\n**Initial Compromise Detection:**\n```sql\n-- SQL-basierte Timeline-Analyse (bei CSV-Import in DB)\nSELECT timestamp, source, event_type, description\nFROM timeline \nWHERE description LIKE '%powershell%' \n OR description LIKE '%cmd.exe%'\n OR description LIKE '%rundll32%'\nORDER BY timestamp;\n```\n\n**Lateral Movement Patterns:**\n```python\n# Python-Script für Lateral-Movement-Detection\ndef detect_lateral_movement(timeline_data):\n \"\"\"\n Identifiziert suspicious Login-Patterns über Zeitfenster\n \"\"\"\n login_events = timeline_data[\n timeline_data['event_type'].str.contains('4624|4625', na=False)\n ]\n \n # Gruppierung nach Source-IP und Zeitfenster-Analyse\n suspicious_logins = login_events.groupby(['source_ip']).apply(\n lambda x: len(x[x['timestamp'].diff().dt.seconds \u003C 300]) > 5\n )\n \n return suspicious_logins[suspicious_logins == True]\n```\n\n### Behavioral Pattern Recognition\n\n**User Activity Profiling:**\n```bash\n# Regelmäßige Aktivitätsmuster extrahieren\ngrep -E \"(explorer\\.exe|chrome\\.exe|outlook\\.exe)\" timeline.csv | \\\nawk -F',' '{print substr($1,1,10), $3}' | \\\nsort | uniq -c | sort -nr\n```\n\n**Anomalie-Detection durch Statistical Analysis:**\n```python\nimport pandas as pd\nfrom scipy import stats\n\ndef detect_activity_anomalies(timeline_df):\n \"\"\"\n Identifiziert ungewöhnliche Aktivitätsmuster via Z-Score\n \"\"\"\n # Aktivität pro Stunde aggregieren\n timeline_df['hour'] = pd.to_datetime(timeline_df['timestamp']).dt.hour\n hourly_activity = timeline_df.groupby('hour').size()\n \n # Z-Score Berechnung für Anomalie-Detection\n z_scores = stats.zscore(hourly_activity)\n anomalous_hours = hourly_activity[abs(z_scores) > 2]\n \n return anomalous_hours\n```\n\n## Network-Event-Korrelation\n\n### Cross-System Timeline Correlation\n\n**SIEM-Integration für Multi-Host-Korrelation:**\n```bash\n# Splunk-Query für korrelierte Events\nindex=windows EventCode=4624 OR EventCode=4625 OR EventCode=4648\n| eval login_time=strftime(_time, \"%Y-%m-%d %H:%M:%S\")\n| stats values(EventCode) as event_codes by src_ip, login_time\n| where mvcount(event_codes) > 1\n```\n\n**Network Flow Timeline Integration:**\n```python\n# Zeek/Bro-Logs mit Filesystem-Timeline korrelieren\ndef correlate_network_filesystem(conn_logs, file_timeline):\n \"\"\"\n Korreliert Netzwerk-Connections mit File-Access-Patterns\n \"\"\"\n # Zeitfenster-basierte Korrelation (±30 Sekunden)\n correlations = []\n \n for _, conn in conn_logs.iterrows():\n conn_time = pd.to_datetime(conn['ts'])\n time_window = pd.Timedelta(seconds=30)\n \n related_files = file_timeline[\n (pd.to_datetime(file_timeline['timestamp']) >= conn_time - time_window) &\n (pd.to_datetime(file_timeline['timestamp']) \u003C= conn_time + time_window)\n ]\n \n if not related_files.empty:\n correlations.append({\n 'connection': conn,\n 'related_files': related_files,\n 'correlation_strength': len(related_files)\n })\n \n return correlations\n```\n\n## Anti-Forensik-Detection durch Timeline-Inkonsistenzen\n\n### Timestamp Manipulation Detection\n\n**Timestomp-Pattern-Analyse:**\n```bash\n# MFT-Analyse für Timestomp-Detection\nanalyzeMFT.py -f \\$MFT -o mft_full.csv\n\n# Suspekte Timestamp-Patterns identifizieren\npython3 \u003C\u003C EOF\nimport pandas as pd\nimport numpy as np\n\nmft_data = pd.read_csv('mft_full.csv')\n\n# Pattern 1: SI-Time vor FN-Time (klassischer Timestomp)\ntimestomp_candidates = mft_data[\n pd.to_datetime(mft_data['SI_Modified']) \u003C pd.to_datetime(mft_data['FN_Modified'])\n]\n\n# Pattern 2: Unrealistische Timestamps (z.B. 1980-01-01)\nepoch_anomalies = mft_data[\n pd.to_datetime(mft_data['SI_Created']).dt.year \u003C 1990\n]\n\nprint(f\"Potential Timestomp: {len(timestomp_candidates)} files\")\nprint(f\"Epoch Anomalies: {len(epoch_anomalies)} files\")\nEOF\n```\n\n### Event Log Manipulation Detection\n\n**Windows Event Log Gap Analysis:**\n```python\ndef detect_log_gaps(event_log_df):\n \"\"\"\n Identifiziert verdächtige Lücken in Event-Log-Sequenzen\n \"\"\"\n # Event-Record-IDs sollten sequenziell sein\n event_log_df['RecordNumber'] = pd.to_numeric(event_log_df['RecordNumber'])\n event_log_df = event_log_df.sort_values('RecordNumber')\n \n # Gaps in Record-Sequenz finden\n record_diffs = event_log_df['RecordNumber'].diff()\n large_gaps = record_diffs[record_diffs > 100] # Threshold anpassbar\n \n return large_gaps\n```\n\n## Automated Timeline Processing & ML-basierte Anomalie-Erkennung\n\n### Machine Learning für Pattern Recognition\n\n**Unsupervised Clustering für Event-Gruppierung:**\n```python\nfrom sklearn.cluster import DBSCAN\nfrom sklearn.feature_extraction.text import TfidfVectorizer\nimport pandas as pd\n\ndef cluster_timeline_events(timeline_df):\n \"\"\"\n Gruppiert ähnliche Events via DBSCAN-Clustering\n \"\"\"\n # TF-IDF für Event-Descriptions\n vectorizer = TfidfVectorizer(max_features=1000, stop_words='english')\n event_vectors = vectorizer.fit_transform(timeline_df['description'])\n \n # DBSCAN-Clustering\n clustering = DBSCAN(eps=0.5, min_samples=5).fit(event_vectors.toarray())\n timeline_df['cluster'] = clustering.labels_\n \n # Anomalie-Events (Cluster -1)\n anomalous_events = timeline_df[timeline_df['cluster'] == -1]\n \n return timeline_df, anomalous_events\n```\n\n**Time-Series-Anomalie-Detection:**\n```python\nfrom sklearn.ensemble import IsolationForest\nimport matplotlib.pyplot as plt\n\ndef detect_temporal_anomalies(timeline_df):\n \"\"\"\n Isolation Forest für zeitbasierte Anomalie-Detection\n \"\"\"\n # Stündliche Aktivität aggregieren\n timeline_df['timestamp'] = pd.to_datetime(timeline_df['timestamp'])\n hourly_activity = timeline_df.groupby(\n timeline_df['timestamp'].dt.floor('H')\n ).size().reset_index(name='event_count')\n \n # Isolation Forest Training\n iso_forest = IsolationForest(contamination=0.1)\n anomaly_labels = iso_forest.fit_predict(\n hourly_activity[['event_count']]\n )\n \n # Anomale Zeitfenster identifizieren\n hourly_activity['anomaly'] = anomaly_labels\n anomalous_periods = hourly_activity[hourly_activity['anomaly'] == -1]\n \n return anomalous_periods\n```\n\n## Enterprise-Scale Timeline Processing\n\n### Distributed Processing für große Datasets\n\n**Apache Spark für Big-Data-Timeline-Analyse:**\n```python\nfrom pyspark.sql import SparkSession\nfrom pyspark.sql.functions import *\n\ndef process_enterprise_timeline(spark_session, timeline_path):\n \"\"\"\n Spark-basierte Verarbeitung für TB-große Timeline-Daten\n \"\"\"\n # Timeline-Daten laden\n timeline_df = spark_session.read.csv(\n timeline_path, \n header=True, \n inferSchema=True\n )\n \n # Zeitfenster-basierte Aggregation\n windowed_activity = timeline_df \\\n .withColumn(\"timestamp\", to_timestamp(\"timestamp\")) \\\n .withColumn(\"hour_window\", window(\"timestamp\", \"1 hour\")) \\\n .groupBy(\"hour_window\", \"source_system\") \\\n .agg(\n count(\"*\").alias(\"event_count\"),\n countDistinct(\"user\").alias(\"unique_users\"),\n collect_set(\"event_type\").alias(\"event_types\")\n )\n \n return windowed_activity\n```\n\n### Cloud-Forensics Timeline Integration\n\n**AWS CloudTrail Timeline Correlation:**\n```bash\n# CloudTrail-Events mit lokaler Timeline korrelieren\naws logs filter-log-events \\\n --log-group-name CloudTrail \\\n --start-time 1642636800000 \\\n --end-time 1642723200000 \\\n --filter-pattern \"{ $.eventName = \\\"AssumeRole\\\" }\" \\\n --output json > cloudtrail_events.json\n\n# JSON zu CSV für Timeline-Integration\njq -r '.events[] | [.eventTime, .sourceIPAddress, .eventName, .userIdentity.type] | @csv' \\\n cloudtrail_events.json > cloudtrail_timeline.csv\n```\n\n## Praktische Anwendungsszenarien\n\n### Szenario 1: Advanced Persistent Threat (APT) Investigation\n\n**Mehrstufige Timeline-Analyse:**\n\n1. **Initial Compromise Detection:**\n```bash\n# Web-Browser-Downloads mit Malware-Signaturen korrelieren\ngrep -E \"(\\.exe|\\.zip|\\.pdf)\" browser_downloads.csv | \\\nwhile read line; do\n timestamp=$(echo $line | cut -d',' -f1)\n filename=$(echo $line | cut -d',' -f3)\n \n # Hash-Verification gegen IOC-Liste\n sha256=$(sha256sum \"/mnt/evidence/$filename\" 2>/dev/null | cut -d' ' -f1)\n grep -q \"$sha256\" ioc_hashes.txt && echo \"IOC Match: $timestamp - $filename\"\ndone\n```\n\n2. **Lateral Movement Tracking:**\n```sql\n-- Cross-System-Bewegung via RDP/SMB\nSELECT t1.timestamp, t1.source_ip, t2.timestamp, t2.dest_ip\nFROM network_timeline t1\nJOIN filesystem_timeline t2 ON \n t2.timestamp BETWEEN t1.timestamp AND t1.timestamp + INTERVAL 5 MINUTE\nWHERE t1.protocol = 'RDP' AND t2.activity_type = 'file_creation'\nORDER BY t1.timestamp;\n```\n\n### Szenario 2: Insider-Threat-Analyse\n\n**Behavioral Baseline vs. Anomalie-Detection:**\n```python\ndef analyze_insider_threat(user_timeline, baseline_days=30):\n \"\"\"\n Vergleicht User-Aktivität mit historischer Baseline\n \"\"\"\n # Baseline-Zeitraum definieren\n baseline_end = pd.to_datetime('2024-01-01')\n baseline_start = baseline_end - pd.Timedelta(days=baseline_days)\n \n baseline_activity = user_timeline[\n (user_timeline['timestamp'] >= baseline_start) &\n (user_timeline['timestamp'] \u003C= baseline_end)\n ]\n \n # Anomale Aktivitätsmuster\n analysis_period = user_timeline[\n user_timeline['timestamp'] > baseline_end\n ]\n \n # Metriken: Off-Hours-Activity, Data-Volume, Access-Patterns\n baseline_metrics = calculate_user_metrics(baseline_activity)\n current_metrics = calculate_user_metrics(analysis_period)\n \n anomaly_score = compare_metrics(baseline_metrics, current_metrics)\n \n return anomaly_score\n```\n\n## Herausforderungen und Lösungsansätze\n\n### Challenge 1: Timezone-Komplexität in Multi-Domain-Umgebungen\n\n**Problem:** Inkonsistente Timezones zwischen Systemen führen zu falschen Korrelationen.\n\n**Lösung:**\n```python\ndef unified_timezone_conversion(timeline_entries):\n \"\"\"\n Intelligente Timezone-Detection und UTC-Normalisierung\n \"\"\"\n timezone_mapping = {\n 'windows_local': 'Europe/Berlin',\n 'unix_utc': 'UTC',\n 'web_browser': 'client_timezone' # Aus Browser-Metadaten\n }\n \n for entry in timeline_entries:\n source_tz = detect_timezone_from_source(entry['source'])\n entry['timestamp_utc'] = convert_to_utc(\n entry['timestamp'], \n timezone_mapping.get(source_tz, 'UTC')\n )\n \n return timeline_entries\n```\n\n### Challenge 2: Volume-Skalierung bei Enterprise-Investigations\n\n**Problem:** TB-große Timeline-Daten überschreiten Memory-Kapazitäten.\n\n**Lösung - Streaming-basierte Verarbeitung:**\n```python\ndef stream_process_timeline(file_path, chunk_size=10000):\n \"\"\"\n Memory-effiziente Timeline-Processing via Chunks\n \"\"\"\n for chunk in pd.read_csv(file_path, chunksize=chunk_size):\n # Chunk-weise Verarbeitung\n processed_chunk = apply_timeline_analysis(chunk)\n \n # Streaming-Output zu aggregated Results\n yield processed_chunk\n```\n\n### Challenge 3: Anti-Forensik und Timeline-Manipulation\n\n**Problem:** Adversaries manipulieren Timestamps zur Evidence-Destruction.\n\n**Lösung - Multi-Source-Validation:**\n```bash\n# Cross-Reference-Validation zwischen verschiedenen Timestamp-Quellen\npython3 \u003C\u003C EOF\n# $MFT vs. $UsnJrnl vs. Event-Logs vs. Registry\ndef validate_timestamp_integrity(file_path):\n sources = {\n 'mft_si': get_mft_si_time(file_path),\n 'mft_fn': get_mft_fn_time(file_path), \n 'usnjrnl': get_usnjrnl_time(file_path),\n 'prefetch': get_prefetch_time(file_path),\n 'eventlog': get_eventlog_time(file_path)\n }\n \n # Timestamp-Inkonsistenzen identifizieren\n inconsistencies = detect_timestamp_discrepancies(sources)\n confidence_score = calculate_integrity_confidence(sources)\n \n return inconsistencies, confidence_score\nEOF\n```\n\n## Tool-Integration und Workflow-Optimierung\n\n### Timeline-Tool-Ecosystem\n\n**Core-Tools-Integration:**\n```bash\n#!/bin/bash\n# Comprehensive Timeline-Workflow-Automation\n\n# 1. Multi-Source-Acquisition\nlog2timeline.py --storage-file case.plaso \\\n --parsers \"win7,chrome,firefox,apache,nginx\" \\\n --hashers \"sha256\" \\\n /mnt/evidence/\n\n# 2. Memory-Timeline-Integration \nvolatility -f memory.vmem --profile=Win10x64 timeliner \\\n --output=csv --output-file=memory_timeline.csv\n\n# 3. Network-Timeline-Addition\nzeek -r network.pcap Log::default_path=/tmp/zeek_logs/\npython3 zeek_to_timeline.py /tmp/zeek_logs/ > network_timeline.csv\n\n# 4. Timeline-Merge und Analysis\npsort.py -w comprehensive_timeline.csv case.plaso\npython3 merge_timelines.py comprehensive_timeline.csv \\\n memory_timeline.csv network_timeline.csv > unified_timeline.csv\n\n# 5. Advanced-Analysis-Pipeline\npython3 timeline_analyzer.py unified_timeline.csv \\\n --detect-anomalies --pivot-analysis --correlation-strength=0.7\n```\n\n### Autopsy Timeline-Viewer Integration\n\n**Autopsy-Import für Visual Timeline Analysis:**\n```python\ndef export_autopsy_timeline(timeline_df, case_name):\n \"\"\"\n Konvertiert Timeline zu Autopsy-kompatiblem Format\n \"\"\"\n autopsy_format = timeline_df[['timestamp', 'source', 'event_type', 'description']].copy()\n autopsy_format['timestamp'] = pd.to_datetime(autopsy_format['timestamp']).astype(int) // 10**9\n \n # Autopsy-CSV-Format\n autopsy_format.to_csv(f\"{case_name}_autopsy_timeline.csv\", \n columns=['timestamp', 'source', 'event_type', 'description'],\n index=False)\n```\n\n## Fazit und Best Practices\n\nTimeline-Analyse repräsentiert eine fundamentale Investigationstechnik, die bei korrekter Anwendung präzise Incident-Rekonstruktion ermöglicht. Die Kombination aus methodischer Multi-Source-Integration, Advanced-Correlation-Techniken und ML-basierter Anomalie-Detection bildet die Basis für moderne forensische Untersuchungen.\n\n**Key Success Factors:**\n\n1. **Systematic Approach**: Strukturierte Herangehensweise von Akquisition bis Analysis\n2. **Multi-Source-Validation**: Cross-Reference zwischen verschiedenen Artefakt-Typen \n3. **Timezone-Awareness**: Konsistente UTC-Normalisierung für akkurate Korrelation\n4. **Anti-Forensik-Resistenz**: Detection von Timestamp-Manipulation und Evidence-Destruction\n5. **Scalability-Design**: Enterprise-fähige Processing-Pipelines für Big-Data-Szenarien\n\nDie kontinuierliche Weiterentwicklung von Adversary-Techniken erfordert adaptive Timeline-Methoden, die sowohl traditionelle Artefakte als auch moderne Cloud- und Container-Umgebungen erfassen. Die Integration von Machine Learning in Timeline-Workflows eröffnet neue Möglichkeiten für automatisierte Anomalie-Detection und Pattern-Recognition bei gleichzeitiger Reduktion des manuellen Aufwands.\n\n**Nächste Schritte:**\n- Vertiefung spezifischer Tool-Implementierungen (Autopsy, SIFT, etc.)\n- Cloud-native Timeline-Techniken für AWS/Azure-Umgebungen\n- Advanced Correlation-Algorithmen für Zero-Day-Detection\n- Integration von Threat-Intelligence in Timeline-Workflows","src/content/knowledgebase/concept-timeline-analysis.md","133a4d7b67e5a868",{"html":1184,"metadata":1185},"\u003Ch1 id=\"timeline-analyse--event-korrelation-methodische-rekonstruktion-forensischer-ereignisse\">Timeline-Analyse & Event-Korrelation: Methodische Rekonstruktion forensischer Ereignisse\u003C/h1>\n\u003Cp>Timeline-Analyse bildet das Rückgrat moderner forensischer Untersuchungen und ermöglicht die chronologische Rekonstruktion von Ereignissen aus heterogenen digitalen Artefakten. Diese methodische Herangehensweise korreliert zeitbasierte Evidenz für präzise Incident-Response und belastbare Beweisführung.\u003C/p>\n\u003Ch2 id=\"grundlagen-der-forensischen-timeline-analyse\">Grundlagen der forensischen Timeline-Analyse\u003C/h2>\n\u003Ch3 id=\"was-ist-timeline-analyse\">Was ist Timeline-Analyse?\u003C/h3>\n\u003Cp>Timeline-Analyse ist die systematische Korrelation zeitbasierter Artefakte aus verschiedenen digitalen Quellen zur Rekonstruktion von Ereignissequenzen. Sie ermöglicht Forensikern, das “Was”, “Wann”, “Wo” und “Wie” von Sicherheitsvorfällen zu verstehen.\u003C/p>\n\u003Cp>\u003Cstrong>Kernprinzipien:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Chronologische Ordnung\u003C/strong>: Alle Ereignisse werden in temporaler Reihenfolge arrangiert\u003C/li>\n\u003Cli>\u003Cstrong>Multi-Source-Integration\u003C/strong>: Daten aus verschiedenen Systemen werden vereint\u003C/li>\n\u003Cli>\u003Cstrong>Zeitstempel-Normalisierung\u003C/strong>: UTC-Konvertierung für einheitliche Referenz\u003C/li>\n\u003Cli>\u003Cstrong>Korrelationsbasierte Analyse\u003C/strong>: Zusammenhänge zwischen scheinbar unabhängigen Events\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"typologie-forensischer-zeitstempel\">Typologie forensischer Zeitstempel\u003C/h3>\n\u003Cp>\u003Cstrong>MAC-Times (Modified, Accessed, Created)\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Filesystem-Timestamps:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- $STANDARD_INFORMATION (SI) - NTFS-Metadaten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- $FILE_NAME (FN) - Directory-Entry-Timestamps \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Born Date - Erste Erstellung im Filesystem\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- $USNJrnl - Change Journal Entries\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Registry-Timestamps\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Windows Registry:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Key Last Write Time - Letzte Modifikation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Value Creation Time - Wert-Erstellung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- Hive Load Time - Registry-Hive-Mounting\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Event-Log-Timestamps\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>Windows Event Logs:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- TimeCreated - Event-Generierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- TimeWritten - Log-Persistierung \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>- CorrelationActivityID - Cross-System-Tracking\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"super-timeline-erstellung-methodisches-vorgehen\">Super-Timeline-Erstellung: Methodisches Vorgehen\u003C/h2>\n\u003Ch3 id=\"phase-1-artefakt-akquisition-und-preprocessing\">Phase 1: Artefakt-Akquisition und Preprocessing\u003C/h3>\n\u003Cp>\u003Cstrong>Datenquellen-Inventar erstellen:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Filesystem-Timeline mit fls\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fls\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -p\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -m\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /mnt/evidence/image.dd\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> filesystem_timeline.body\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Registry-Timeline mit regtime\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">regtime.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /mnt/evidence/registry/\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> registry_timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Event-Log-Extraktion mit python-evtx\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">evtx_dump.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> Security.evtx\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> security_events.xml\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Memory-Artefakte integrieren:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Volatility Timeline-Generierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.vmem\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Win10x64\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeliner\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory_timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Process-Timeline mit detailed Metadata\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.vmem\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Win10x64\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pslist\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -v\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> process_details.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"phase-2-zeitstempel-normalisierung-und-utc-konvertierung\">Phase 2: Zeitstempel-Normalisierung und UTC-Konvertierung\u003C/h3>\n\u003Cp>\u003Cstrong>Timezone-Handling:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Python-Script für Timezone-Normalisierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> datetime\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pytz\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> normalize_timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timestamp_str, source_timezone):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Konvertiert lokale Timestamps zu UTC für einheitliche Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> local_tz \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pytz.timezone(source_timezone)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> dt \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> datetime.datetime.strptime(timestamp_str, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%Y-%m-\u003C/span>\u003Cspan style=\"color:#79B8FF\">%d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> %H:%M:%S'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> localized_dt \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> local_tz.localize(dt)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> utc_dt \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> localized_dt.astimezone(pytz.utc)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> utc_dt.strftime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'%Y-%m-\u003C/span>\u003Cspan style=\"color:#79B8FF\">%d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> %H:%M:%S UTC'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Anti-Timestomp-Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Timestomp-Anomalien identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">analyzeMFT.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $MFT \u003C/span>\u003Cspan style=\"color:#79B8FF\">-o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mft_analysis.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suche nach: SI-Time < FN-Time (Timestomp-Indikator)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"phase-3-log2timelineplaso-super-timeline-processing\">Phase 3: Log2timeline/PLASO Super-Timeline-Processing\u003C/h3>\n\u003Cp>\u003Cstrong>PLASO-basierte Timeline-Generierung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Multi-Source-Timeline mit log2timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">log2timeline.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --storage-file\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.plaso\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --parsers\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"win7,chrome,firefox,skype\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --timezone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"Europe/Berlin\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> /mnt/evidence/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># CSV-Export für Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline_super.csv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> evidence.plaso\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Advanced PLASO-Filtering:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zeitfenster-spezifische Extraktion\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> incident_window.csv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --date-filter\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"2024-01-10,2024-01-12\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> evidence.plaso\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ereignis-spezifisches Filtering\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> web_activity.csv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --filter\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"parser contains 'chrome'\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> evidence.plaso\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"advanced-correlation-techniken\">Advanced Correlation-Techniken\u003C/h2>\n\u003Ch3 id=\"pivot-point-identifikation\">Pivot-Point-Identifikation\u003C/h3>\n\u003Cp>\u003Cstrong>Initial Compromise Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- SQL-basierte Timeline-Analyse (bei CSV-Import in DB)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, source, event_type, \u003C/span>\u003Cspan style=\"color:#F97583\">description\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#F97583\"> description\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%powershell%'\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#F97583\"> description\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%cmd.exe%'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> OR\u003C/span>\u003Cspan style=\"color:#F97583\"> description\u003C/span>\u003Cspan style=\"color:#F97583\"> LIKE\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '%rundll32%'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#F97583\"> timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Lateral Movement Patterns:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Python-Script für Lateral-Movement-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_lateral_movement\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_data):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Identifiziert suspicious Login-Patterns über Zeitfenster\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> login_events \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_data[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_data[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'event_type'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].str.contains(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'4624|4625'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">na\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Gruppierung nach Source-IP und Zeitfenster-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> suspicious_logins \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> login_events.groupby([\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'source_ip'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]).apply(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> lambda\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> x: \u003C/span>\u003Cspan style=\"color:#79B8FF\">len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(x[x[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].diff().dt.seconds \u003C/span>\u003Cspan style=\"color:#F97583\"><\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 300\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 5\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> suspicious_logins[suspicious_logins \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#79B8FF\"> True\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"behavioral-pattern-recognition\">Behavioral Pattern Recognition\u003C/h3>\n\u003Cp>\u003Cstrong>User Activity Profiling:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Regelmäßige Aktivitätsmuster extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"(explorer\\.exe|chrome\\.exe|outlook\\.exe)\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.csv\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">awk\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -F\u003C/span>\u003Cspan style=\"color:#9ECBFF\">','\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '{print substr($1,1,10), $3}'\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sort\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> uniq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sort\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -nr\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Anomalie-Detection durch Statistical Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pandas \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> scipy \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stats\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_activity_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_df):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Identifiziert ungewöhnliche Aktivitätsmuster via Z-Score\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Aktivität pro Stunde aggregieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'hour'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_datetime(timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]).dt.hour\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hourly_activity \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df.groupby(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'hour'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).size()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Z-Score Berechnung für Anomalie-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> z_scores \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> stats.zscore(hourly_activity)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalous_hours \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hourly_activity[\u003C/span>\u003Cspan style=\"color:#79B8FF\">abs\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(z_scores) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalous_hours\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"network-event-korrelation\">Network-Event-Korrelation\u003C/h2>\n\u003Ch3 id=\"cross-system-timeline-correlation\">Cross-System Timeline Correlation\u003C/h3>\n\u003Cp>\u003Cstrong>SIEM-Integration für Multi-Host-Korrelation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Splunk-Query für korrelierte Events\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">windows\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> EventCode\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">4624\u003C/span>\u003Cspan style=\"color:#B392F0\"> OR\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> EventCode=\u003C/span>\u003Cspan style=\"color:#79B8FF\">4625\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> OR\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> EventCode=\u003C/span>\u003Cspan style=\"color:#79B8FF\">4648\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#79B8FF\"> eval\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> login_time=strftime\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#B392F0\">_time,\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"%Y-%m-%d %H:%M:%S\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#B392F0\"> stats\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> values\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#B392F0\">EventCode\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#9ECBFF\">as\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> event_codes\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> by\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> src_ip,\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> login_time\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#B392F0\"> where\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mvcount\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#B392F0\">event_codes\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Network Flow Timeline Integration:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Zeek/Bro-Logs mit Filesystem-Timeline korrelieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> correlate_network_filesystem\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(conn_logs, file_timeline):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Korreliert Netzwerk-Connections mit File-Access-Patterns\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Zeitfenster-basierte Korrelation (±30 Sekunden)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> correlations \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> []\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> _, conn \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn_logs.iterrows():\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> conn_time \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_datetime(conn[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'ts'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> time_window \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.Timedelta(\u003C/span>\u003Cspan style=\"color:#FFAB70\">seconds\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">30\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> related_files \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> file_timeline[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (pd.to_datetime(file_timeline[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]) \u003C/span>\u003Cspan style=\"color:#F97583\">>=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn_time \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> time_window) \u003C/span>\u003Cspan style=\"color:#F97583\">&\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (pd.to_datetime(file_timeline[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]) \u003C/span>\u003Cspan style=\"color:#F97583\"><=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> conn_time \u003C/span>\u003Cspan style=\"color:#F97583\">+\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> time_window)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> if\u003C/span>\u003Cspan style=\"color:#F97583\"> not\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> related_files.empty:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> correlations.append({\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'connection'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: conn,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'related_files'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: related_files,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'correlation_strength'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#79B8FF\">len\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(related_files)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> })\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> correlations\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"anti-forensik-detection-durch-timeline-inkonsistenzen\">Anti-Forensik-Detection durch Timeline-Inkonsistenzen\u003C/h2>\n\u003Ch3 id=\"timestamp-manipulation-detection\">Timestamp Manipulation Detection\u003C/h3>\n\u003Cp>\u003Cstrong>Timestomp-Pattern-Analyse:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MFT-Analyse für Timestomp-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">analyzeMFT.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\$\u003C/span>\u003Cspan style=\"color:#9ECBFF\">MFT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mft_full.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Suspekte Timestamp-Patterns identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#F97583\"> <<\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> EOF\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">import pandas as pd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">import numpy as np\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">mft_data = pd.read_csv('mft_full.csv')\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"># Pattern 1: SI-Time vor FN-Time (klassischer Timestomp)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">timestomp_candidates = mft_data[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> pd.to_datetime(mft_data['SI_Modified']) < pd.to_datetime(mft_data['FN_Modified'])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"># Pattern 2: Unrealistische Timestamps (z.B. 1980-01-01)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">epoch_anomalies = mft_data[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> pd.to_datetime(mft_data['SI_Created']).dt.year < 1990\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">print(f\"Potential Timestomp: {len(timestomp_candidates)} files\")\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">print(f\"Epoch Anomalies: {len(epoch_anomalies)} files\")\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">EOF\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"event-log-manipulation-detection\">Event Log Manipulation Detection\u003C/h3>\n\u003Cp>\u003Cstrong>Windows Event Log Gap Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_log_gaps\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(event_log_df):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Identifiziert verdächtige Lücken in Event-Log-Sequenzen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Event-Record-IDs sollten sequenziell sein\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event_log_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'RecordNumber'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_numeric(event_log_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'RecordNumber'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event_log_df \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> event_log_df.sort_values(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'RecordNumber'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Gaps in Record-Sequenz finden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> record_diffs \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> event_log_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'RecordNumber'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].diff()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> large_gaps \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> record_diffs[record_diffs \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 100\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#6A737D\"># Threshold anpassbar\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> large_gaps\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"automated-timeline-processing--ml-basierte-anomalie-erkennung\">Automated Timeline Processing & ML-basierte Anomalie-Erkennung\u003C/h2>\n\u003Ch3 id=\"machine-learning-für-pattern-recognition\">Machine Learning für Pattern Recognition\u003C/h3>\n\u003Cp>\u003Cstrong>Unsupervised Clustering für Event-Gruppierung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sklearn.cluster \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#79B8FF\"> DBSCAN\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sklearn.feature_extraction.text \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> TfidfVectorizer\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pandas \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> cluster_timeline_events\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_df):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Gruppiert ähnliche Events via DBSCAN-Clustering\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # TF-IDF für Event-Descriptions\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> vectorizer \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> TfidfVectorizer(\u003C/span>\u003Cspan style=\"color:#FFAB70\">max_features\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">1000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">stop_words\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'english'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> event_vectors \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> vectorizer.fit_transform(timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'description'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # DBSCAN-Clustering\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> clustering \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> DBSCAN(\u003C/span>\u003Cspan style=\"color:#FFAB70\">eps\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">0.5\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">min_samples\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">5\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).fit(event_vectors.toarray())\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'cluster'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> clustering.labels_\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Anomalie-Events (Cluster -1)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalous_events \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df[timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'cluster'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df, anomalous_events\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>\u003Cstrong>Time-Series-Anomalie-Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> sklearn.ensemble \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> IsolationForest\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> matplotlib.pyplot \u003C/span>\u003Cspan style=\"color:#F97583\">as\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> plt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> detect_temporal_anomalies\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_df):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Isolation Forest für zeitbasierte Anomalie-Detection\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Stündliche Aktivität aggregieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_datetime(timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hourly_activity \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df.groupby(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_df[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">].dt.floor(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'H'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ).size().reset_index(\u003C/span>\u003Cspan style=\"color:#FFAB70\">name\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'event_count'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Isolation Forest Training\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> iso_forest \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> IsolationForest(\u003C/span>\u003Cspan style=\"color:#FFAB70\">contamination\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">0.1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomaly_labels \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> iso_forest.fit_predict(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hourly_activity[[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'event_count'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Anomale Zeitfenster identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> hourly_activity[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'anomaly'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomaly_labels\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomalous_periods \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> hourly_activity[hourly_activity[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'anomaly'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">==\u003C/span>\u003Cspan style=\"color:#F97583\"> -\u003C/span>\u003Cspan style=\"color:#79B8FF\">1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomalous_periods\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"enterprise-scale-timeline-processing\">Enterprise-Scale Timeline Processing\u003C/h2>\n\u003Ch3 id=\"distributed-processing-für-große-datasets\">Distributed Processing für große Datasets\u003C/h3>\n\u003Cp>\u003Cstrong>Apache Spark für Big-Data-Timeline-Analyse:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pyspark.sql \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> SparkSession\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">from\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pyspark.sql.functions \u003C/span>\u003Cspan style=\"color:#F97583\">import\u003C/span>\u003Cspan style=\"color:#F97583\"> *\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> process_enterprise_timeline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(spark_session, timeline_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Spark-basierte Verarbeitung für TB-große Timeline-Daten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Timeline-Daten laden\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_df \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> spark_session.read.csv(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timeline_path, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\"> header\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">True\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\"> inferSchema\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">True\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Zeitfenster-basierte Aggregation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> windowed_activity \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> .withColumn(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"timestamp\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, to_timestamp(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"timestamp\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)) \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> .withColumn(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"hour_window\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, window(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"timestamp\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"1 hour\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)) \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> .groupBy(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"hour_window\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"source_system\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> .agg(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> count(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"*\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).alias(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"event_count\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> countDistinct(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"user\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).alias(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"unique_users\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> collect_set(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"event_type\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).alias(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"event_types\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> windowed_activity\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"cloud-forensics-timeline-integration\">Cloud-Forensics Timeline Integration\u003C/h3>\n\u003Cp>\u003Cstrong>AWS CloudTrail Timeline Correlation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># CloudTrail-Events mit lokaler Timeline korrelieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">aws\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> logs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> filter-log-events\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --log-group-name\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> CloudTrail\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --start-time\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1642636800000\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --end-time\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 1642723200000\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --filter-pattern\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"{ $.eventName = \u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\">AssumeRole\u003C/span>\u003Cspan style=\"color:#79B8FF\">\\\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> }\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> json\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cloudtrail_events.json\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># JSON zu CSV für Timeline-Integration\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">jq\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> '.events[] | [.eventTime, .sourceIPAddress, .eventName, .userIdentity.type] | @csv'\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> cloudtrail_events.json\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cloudtrail_timeline.csv\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"praktische-anwendungsszenarien\">Praktische Anwendungsszenarien\u003C/h2>\n\u003Ch3 id=\"szenario-1-advanced-persistent-threat-apt-investigation\">Szenario 1: Advanced Persistent Threat (APT) Investigation\u003C/h3>\n\u003Cp>\u003Cstrong>Mehrstufige Timeline-Analyse:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Initial Compromise Detection:\u003C/strong>\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Web-Browser-Downloads mit Malware-Signaturen korrelieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -E\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"(\\.exe|\\.zip|\\.pdf)\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> browser_downloads.csv\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">while\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> read\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> line\u003C/span>\u003Cspan style=\"color:#E1E4E8\">; \u003C/span>\u003Cspan style=\"color:#F97583\">do\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timestamp\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $line \u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">','\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> filename\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> $line \u003C/span>\u003Cspan style=\"color:#F97583\">|\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">','\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f3\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Hash-Verification gegen IOC-Liste\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> sha256\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$(\u003C/span>\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"/mnt/evidence/\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$filename\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#F97583\"> 2>\u003C/span>\u003Cspan style=\"color:#9ECBFF\">/dev/null\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> cut\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\">' '\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -q\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">$sha256\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ioc_hashes.txt\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"IOC Match: \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$timestamp\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> - \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$filename\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">done\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Col start=\"2\">\n\u003Cli>\u003Cstrong>Lateral Movement Tracking:\u003C/strong>\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"sql\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">-- Cross-System-Bewegung via RDP/SMB\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">SELECT\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">source_ip\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">t2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#79B8FF\">t2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">dest_ip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">FROM\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> network_timeline t1\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">JOIN\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> filesystem_timeline t2 \u003C/span>\u003Cspan style=\"color:#F97583\">ON\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> t2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> BETWEEN\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#F97583\"> +\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> INTERVAL \u003C/span>\u003Cspan style=\"color:#79B8FF\">5\u003C/span>\u003Cspan style=\"color:#F97583\"> MINUTE\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">WHERE\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">protocol\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'RDP'\u003C/span>\u003Cspan style=\"color:#F97583\"> AND\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t2\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">activity_type\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'file_creation'\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">ORDER BY\u003C/span>\u003Cspan style=\"color:#79B8FF\"> t1\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#79B8FF\">timestamp\u003C/span>\u003Cspan style=\"color:#E1E4E8\">;\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"szenario-2-insider-threat-analyse\">Szenario 2: Insider-Threat-Analyse\u003C/h3>\n\u003Cp>\u003Cstrong>Behavioral Baseline vs. Anomalie-Detection:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> analyze_insider_threat\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(user_timeline, baseline_days\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">30\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Vergleicht User-Aktivität mit historischer Baseline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Baseline-Zeitraum definieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> baseline_end \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_datetime(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'2024-01-01'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> baseline_start \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> baseline_end \u003C/span>\u003Cspan style=\"color:#F97583\">-\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.Timedelta(\u003C/span>\u003Cspan style=\"color:#FFAB70\">days\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">baseline_days)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> baseline_activity \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_timeline[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (user_timeline[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">>=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> baseline_start) \u003C/span>\u003Cspan style=\"color:#F97583\">&\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> (user_timeline[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\"><=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> baseline_end)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Anomale Aktivitätsmuster\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> analysis_period \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> user_timeline[\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> user_timeline[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> baseline_end\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ]\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Metriken: Off-Hours-Activity, Data-Volume, Access-Patterns\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> baseline_metrics \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> calculate_user_metrics(baseline_activity)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> current_metrics \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> calculate_user_metrics(analysis_period)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> anomaly_score \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> compare_metrics(baseline_metrics, current_metrics)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> anomaly_score\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"herausforderungen-und-lösungsansätze\">Herausforderungen und Lösungsansätze\u003C/h2>\n\u003Ch3 id=\"challenge-1-timezone-komplexität-in-multi-domain-umgebungen\">Challenge 1: Timezone-Komplexität in Multi-Domain-Umgebungen\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> Inkonsistente Timezones zwischen Systemen führen zu falschen Korrelationen.\u003C/p>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> unified_timezone_conversion\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_entries):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Intelligente Timezone-Detection und UTC-Normalisierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timezone_mapping \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'windows_local'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'Europe/Berlin'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'unix_utc'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'UTC'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'web_browser'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'client_timezone'\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Aus Browser-Metadaten\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> entry \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_entries:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> source_tz \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> detect_timezone_from_source(entry[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'source'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">])\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> entry[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp_utc'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> convert_to_utc(\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> entry[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">], \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> timezone_mapping.get(source_tz, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'UTC'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> )\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> return\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_entries\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"challenge-2-volume-skalierung-bei-enterprise-investigations\">Challenge 2: Volume-Skalierung bei Enterprise-Investigations\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> TB-große Timeline-Daten überschreiten Memory-Kapazitäten.\u003C/p>\n\u003Cp>\u003Cstrong>Lösung - Streaming-basierte Verarbeitung:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> stream_process_timeline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(file_path, chunk_size\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">10000\u003C/span>\u003Cspan style=\"color:#E1E4E8\">):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Memory-effiziente Timeline-Processing via Chunks\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> for\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> chunk \u003C/span>\u003Cspan style=\"color:#F97583\">in\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.read_csv(file_path, \u003C/span>\u003Cspan style=\"color:#FFAB70\">chunksize\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">chunk_size):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Chunk-weise Verarbeitung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> processed_chunk \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> apply_timeline_analysis(chunk)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Streaming-Output zu aggregated Results\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> yield\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> processed_chunk\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"challenge-3-anti-forensik-und-timeline-manipulation\">Challenge 3: Anti-Forensik und Timeline-Manipulation\u003C/h3>\n\u003Cp>\u003Cstrong>Problem:\u003C/strong> Adversaries manipulieren Timestamps zur Evidence-Destruction.\u003C/p>\n\u003Cp>\u003Cstrong>Lösung - Multi-Source-Validation:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Cross-Reference-Validation zwischen verschiedenen Timestamp-Quellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#F97583\"> <<\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> EOF\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"># \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$MFT\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vs. \u003C/span>\u003Cspan style=\"color:#E1E4E8\">$UsnJrnl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vs. Event-Logs vs. Registry\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">def validate_timestamp_integrity(file_path):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> sources = {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'mft_si': get_mft_si_time(file_path),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'mft_fn': get_mft_fn_time(file_path), \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'usnjrnl': get_usnjrnl_time(file_path),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'prefetch': get_prefetch_time(file_path),\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> 'eventlog': get_eventlog_time(file_path)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> }\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> # Timestamp-Inkonsistenzen identifizieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> inconsistencies = detect_timestamp_discrepancies(sources)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> confidence_score = calculate_integrity_confidence(sources)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> return inconsistencies, confidence_score\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">EOF\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"tool-integration-und-workflow-optimierung\">Tool-Integration und Workflow-Optimierung\u003C/h2>\n\u003Ch3 id=\"timeline-tool-ecosystem\">Timeline-Tool-Ecosystem\u003C/h3>\n\u003Cp>\u003Cstrong>Core-Tools-Integration:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">#!/bin/bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Comprehensive Timeline-Workflow-Automation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 1. Multi-Source-Acquisition\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">log2timeline.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --storage-file\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> case.plaso\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --parsers\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"win7,chrome,firefox,apache,nginx\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --hashers\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"sha256\"\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> /mnt/evidence/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 2. Memory-Timeline-Integration \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">volatility\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.vmem\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Win10x64\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeliner\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --output=csv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output-file=memory_timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 3. Network-Timeline-Addition\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">zeek\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> network.pcap\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> Log::default_path=/tmp/zeek_logs/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> zeek_to_timeline.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /tmp/zeek_logs/\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> network_timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 4. Timeline-Merge und Analysis\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -w\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> comprehensive_timeline.csv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> case.plaso\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> merge_timelines.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> comprehensive_timeline.csv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> memory_timeline.csv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> network_timeline.csv\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unified_timeline.csv\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># 5. Advanced-Analysis-Pipeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline_analyzer.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unified_timeline.csv\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> --detect-anomalies\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --pivot-analysis\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --correlation-strength=0.7\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"autopsy-timeline-viewer-integration\">Autopsy Timeline-Viewer Integration\u003C/h3>\n\u003Cp>\u003Cstrong>Autopsy-Import für Visual Timeline Analysis:\u003C/strong>\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"python\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">def\u003C/span>\u003Cspan style=\"color:#B392F0\"> export_autopsy_timeline\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(timeline_df, case_name):\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> Konvertiert Timeline zu Autopsy-kompatiblem Format\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> \"\"\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> autopsy_format \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> timeline_df[[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'source'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'event_type'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'description'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]].copy()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> autopsy_format[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">] \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> pd.to_datetime(autopsy_format[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">]).astype(\u003C/span>\u003Cspan style=\"color:#79B8FF\">int\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) \u003C/span>\u003Cspan style=\"color:#F97583\">//\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 10\u003C/span>\u003Cspan style=\"color:#F97583\">**\u003C/span>\u003Cspan style=\"color:#79B8FF\">9\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"> # Autopsy-CSV-Format\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> autopsy_format.to_csv(\u003C/span>\u003Cspan style=\"color:#F97583\">f\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"\u003C/span>\u003Cspan style=\"color:#79B8FF\">{\u003C/span>\u003Cspan style=\"color:#E1E4E8\">case_name\u003C/span>\u003Cspan style=\"color:#79B8FF\">}\u003C/span>\u003Cspan style=\"color:#9ECBFF\">_autopsy_timeline.csv\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\"> columns\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">[\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'timestamp'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'source'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'event_type'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'description'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">],\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#FFAB70\"> index\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#79B8FF\">False\u003C/span>\u003Cspan style=\"color:#E1E4E8\">)\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fazit-und-best-practices\">Fazit und Best Practices\u003C/h2>\n\u003Cp>Timeline-Analyse repräsentiert eine fundamentale Investigationstechnik, die bei korrekter Anwendung präzise Incident-Rekonstruktion ermöglicht. Die Kombination aus methodischer Multi-Source-Integration, Advanced-Correlation-Techniken und ML-basierter Anomalie-Detection bildet die Basis für moderne forensische Untersuchungen.\u003C/p>\n\u003Cp>\u003Cstrong>Key Success Factors:\u003C/strong>\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>Systematic Approach\u003C/strong>: Strukturierte Herangehensweise von Akquisition bis Analysis\u003C/li>\n\u003Cli>\u003Cstrong>Multi-Source-Validation\u003C/strong>: Cross-Reference zwischen verschiedenen Artefakt-Typen\u003C/li>\n\u003Cli>\u003Cstrong>Timezone-Awareness\u003C/strong>: Konsistente UTC-Normalisierung für akkurate Korrelation\u003C/li>\n\u003Cli>\u003Cstrong>Anti-Forensik-Resistenz\u003C/strong>: Detection von Timestamp-Manipulation und Evidence-Destruction\u003C/li>\n\u003Cli>\u003Cstrong>Scalability-Design\u003C/strong>: Enterprise-fähige Processing-Pipelines für Big-Data-Szenarien\u003C/li>\n\u003C/ol>\n\u003Cp>Die kontinuierliche Weiterentwicklung von Adversary-Techniken erfordert adaptive Timeline-Methoden, die sowohl traditionelle Artefakte als auch moderne Cloud- und Container-Umgebungen erfassen. Die Integration von Machine Learning in Timeline-Workflows eröffnet neue Möglichkeiten für automatisierte Anomalie-Detection und Pattern-Recognition bei gleichzeitiger Reduktion des manuellen Aufwands.\u003C/p>\n\u003Cp>\u003Cstrong>Nächste Schritte:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Vertiefung spezifischer Tool-Implementierungen (Autopsy, SIFT, etc.)\u003C/li>\n\u003Cli>Cloud-native Timeline-Techniken für AWS/Azure-Umgebungen\u003C/li>\n\u003Cli>Advanced Correlation-Algorithmen für Zero-Day-Detection\u003C/li>\n\u003Cli>Integration von Threat-Intelligence in Timeline-Workflows\u003C/li>\n\u003C/ul>",{"headings":1186,"localImagePaths":1279,"remoteImagePaths":1280,"frontmatter":1281,"imagePaths":1286},[1187,1189,1192,1195,1198,1201,1204,1207,1210,1213,1216,1219,1222,1225,1228,1230,1233,1236,1239,1242,1245,1248,1249,1252,1255,1258,1261,1264,1267,1270,1273,1276],{"depth":44,"slug":1188,"text":1162},"timeline-analyse--event-korrelation-methodische-rekonstruktion-forensischer-ereignisse",{"depth":47,"slug":1190,"text":1191},"grundlagen-der-forensischen-timeline-analyse","Grundlagen der forensischen Timeline-Analyse",{"depth":54,"slug":1193,"text":1194},"was-ist-timeline-analyse","Was ist Timeline-Analyse?",{"depth":54,"slug":1196,"text":1197},"typologie-forensischer-zeitstempel","Typologie forensischer Zeitstempel",{"depth":47,"slug":1199,"text":1200},"super-timeline-erstellung-methodisches-vorgehen","Super-Timeline-Erstellung: Methodisches Vorgehen",{"depth":54,"slug":1202,"text":1203},"phase-1-artefakt-akquisition-und-preprocessing","Phase 1: Artefakt-Akquisition und Preprocessing",{"depth":54,"slug":1205,"text":1206},"phase-2-zeitstempel-normalisierung-und-utc-konvertierung","Phase 2: Zeitstempel-Normalisierung und UTC-Konvertierung",{"depth":54,"slug":1208,"text":1209},"phase-3-log2timelineplaso-super-timeline-processing","Phase 3: Log2timeline/PLASO Super-Timeline-Processing",{"depth":47,"slug":1211,"text":1212},"advanced-correlation-techniken","Advanced Correlation-Techniken",{"depth":54,"slug":1214,"text":1215},"pivot-point-identifikation","Pivot-Point-Identifikation",{"depth":54,"slug":1217,"text":1218},"behavioral-pattern-recognition","Behavioral Pattern Recognition",{"depth":47,"slug":1220,"text":1221},"network-event-korrelation","Network-Event-Korrelation",{"depth":54,"slug":1223,"text":1224},"cross-system-timeline-correlation","Cross-System Timeline Correlation",{"depth":47,"slug":1226,"text":1227},"anti-forensik-detection-durch-timeline-inkonsistenzen","Anti-Forensik-Detection durch Timeline-Inkonsistenzen",{"depth":54,"slug":289,"text":1229},"Timestamp Manipulation Detection",{"depth":54,"slug":1231,"text":1232},"event-log-manipulation-detection","Event Log Manipulation Detection",{"depth":47,"slug":1234,"text":1235},"automated-timeline-processing--ml-basierte-anomalie-erkennung","Automated Timeline Processing & ML-basierte Anomalie-Erkennung",{"depth":54,"slug":1237,"text":1238},"machine-learning-für-pattern-recognition","Machine Learning für Pattern Recognition",{"depth":47,"slug":1240,"text":1241},"enterprise-scale-timeline-processing","Enterprise-Scale Timeline Processing",{"depth":54,"slug":1243,"text":1244},"distributed-processing-für-große-datasets","Distributed Processing für große Datasets",{"depth":54,"slug":1246,"text":1247},"cloud-forensics-timeline-integration","Cloud-Forensics Timeline Integration",{"depth":47,"slug":796,"text":797},{"depth":54,"slug":1250,"text":1251},"szenario-1-advanced-persistent-threat-apt-investigation","Szenario 1: Advanced Persistent Threat (APT) Investigation",{"depth":54,"slug":1253,"text":1254},"szenario-2-insider-threat-analyse","Szenario 2: Insider-Threat-Analyse",{"depth":47,"slug":1256,"text":1257},"herausforderungen-und-lösungsansätze","Herausforderungen und Lösungsansätze",{"depth":54,"slug":1259,"text":1260},"challenge-1-timezone-komplexität-in-multi-domain-umgebungen","Challenge 1: Timezone-Komplexität in Multi-Domain-Umgebungen",{"depth":54,"slug":1262,"text":1263},"challenge-2-volume-skalierung-bei-enterprise-investigations","Challenge 2: Volume-Skalierung bei Enterprise-Investigations",{"depth":54,"slug":1265,"text":1266},"challenge-3-anti-forensik-und-timeline-manipulation","Challenge 3: Anti-Forensik und Timeline-Manipulation",{"depth":47,"slug":1268,"text":1269},"tool-integration-und-workflow-optimierung","Tool-Integration und Workflow-Optimierung",{"depth":54,"slug":1271,"text":1272},"timeline-tool-ecosystem","Timeline-Tool-Ecosystem",{"depth":54,"slug":1274,"text":1275},"autopsy-timeline-viewer-integration","Autopsy Timeline-Viewer Integration",{"depth":47,"slug":1277,"text":1278},"fazit-und-best-practices","Fazit und Best Practices",[],[],{"title":1162,"description":1163,"author":18,"last_updated":1282,"difficulty":19,"categories":1283,"tags":1284,"tool_name":1165,"related_tools":1285,"published":34},["Date","2025-08-10T00:00:00.000Z"],[191,1169,697],[1171,1172,1173,1174,1175,1176,696,1177,697,1178,1179],[184,187,684,1167],[],"concept-timeline-analysis.md","method-android-logical-imaging",{"id":1288,"data":1290,"body":1302,"filePath":1303,"digest":1304,"rendered":1305,"legacyId":1538},{"title":1291,"description":1292,"last_updated":1293,"tool_name":1294,"related_tools":1295,"author":18,"difficulty":19,"categories":1296,"tags":1298,"published":34,"gated_content":35},"Extraktion logischer Dateisysteme alter Android-Smartphones - eine KI-Recherche","Wie man alte Android-Handys aufbekommen könnte - eine Recherche von Claude",["Date","2025-07-21T00:00:00.000Z"],"Android Logical Imaging",[],[1297],"data-collection",[1299,1300,1301],"imaging","filesystem","hardware-interface","# Übersicht\n\nOpen-Source Android Forensik bietet robuste Alternativen zu kommerziellen Lösungen wie Cellebrite UFED und Magnet AXIOM. Besonders für ältere Android-Geräte (5+ Jahre) existieren bewährte Methoden zur Datenextraktion und -analyse.\n\n## Kernkomponenten des Open-Source Forensik-Stacks\n\n**Autopsy Digital Forensics Platform** bildet das Fundament mit GUI-basierter Analyse und integrierten Android-Parsing-Fähigkeiten. Die Plattform unterstützt **ALEAPP (Android Logs Events And Protobuf Parser)**, das über 100 Artefakt-Kategorien aus Android-Extraktionen parst.\n\n**Mobile Verification Toolkit (MVT)** von Amnesty International bietet spezialisierte Command-Line-Tools für Android-Analyse mit Fokus auf Kompromittierungserkennung.\n\n**SIFT Workstation** stellt eine komplette Ubuntu-basierte forensische Umgebung mit 125+ vorinstallierten Tools bereit.\n\n## Erfolgsraten nach Gerätealter\n\n- **Pre-2017 Geräte**: 85-98% logische Extraktion, 30-70% physische Extraktion\n- **2017-2019 Geräte**: 80-95% logische Extraktion, 15-35% physische Extraktion \n- **2020+ Geräte**: 70-85% logische Extraktion, 5-15% physische Extraktion\n\n# Installation\n\n## SIFT Workstation Setup\n\n### Systemanforderungen\n- Quad-Core CPU 2.5GHz+\n- 16GB+ RAM\n- 500GB+ SSD Speicher\n- USB 3.0+ Anschlüsse\n\n### Installation\n1. Download von [SANS SIFT Workstation](https://www.sans.org/tools/sift-workstation/)\n2. VMware/VirtualBox Import der OVA-Datei\n3. VM-Konfiguration: 8GB+ RAM, 4+ CPU-Kerne\n\n```bash\n# Update nach Installation\nsudo apt update && sudo apt upgrade -y\nsudo sift update\n```\n\n## Autopsy Installation\n\n### Windows Installation\n1. Download von [autopsy.com](https://www.autopsy.com/)\n2. Java 8+ Installation erforderlich\n3. Installation mit Administratorrechten\n\n### Linux Installation\n```bash\n# Ubuntu/Debian\nsudo apt install autopsy sleuthkit\n# Oder manueller Download und Installation\nwget https://github.com/sleuthkit/autopsy/releases/latest\n```\n\n## Essential Tools Installation\n\n### Android Debug Bridge (ADB)\n```bash\n# Ubuntu/Debian\nsudo apt install android-tools-adb android-tools-fastboot\n\n# Windows - Download Android Platform Tools\n# https://developer.android.com/studio/releases/platform-tools\n```\n\n### ALEAPP Installation\n```bash\ngit clone https://github.com/abrignoni/ALEAPP.git\ncd ALEAPP\npip3 install -r requirements.txt\n```\n\n### Mobile Verification Toolkit (MVT)\n```bash\npip3 install mvt\n# Oder via GitHub für neueste Version\ngit clone https://github.com/mvt-project/mvt.git\ncd mvt && pip3 install .\n```\n\n### Andriller Installation\n```bash\ngit clone https://github.com/den4uk/andriller.git\ncd andriller\npip3 install -r requirements.txt\n```\n\n# Konfiguration\n\n## ADB Setup und Gerätevorbereitung\n\n### USB-Debugging aktivieren\n1. Entwickleroptionen freischalten (7x Build-Nummer antippen)\n2. USB-Debugging aktivieren\n3. Gerät via USB verbinden\n4. RSA-Fingerprint akzeptieren\n\n### ADB Verbindung testen\n```bash\nadb devices\n# Sollte Gerät mit \"device\" Status zeigen\nadb shell getprop ro.build.version.release # Android Version\nadb shell getprop ro.product.model # Gerätemodell\n```\n\n## Autopsy Projektkonfiguration\n\n### Case-Setup\n1. Neuen Fall erstellen\n2. Ermittler-Informationen eingeben\n3. Case-Verzeichnis festlegen (ausreichend Speicherplatz)\n\n### Android Analyzer Module aktivieren\n- Tools → Options → Modules\n- Android Analyzer aktivieren\n- ALEAPP Integration konfigurieren\n\n### Hash-Algorithmen konfigurieren\n- MD5, SHA-1, SHA-256 für Integritätsprüfung\n- Automatische Hash-Berechnung bei Import aktivieren\n\n## MVT Konfiguration\n\n### Konfigurationsdatei erstellen\n```yaml\n# ~/.mvt/config.yaml\nadb_path: \"/usr/bin/adb\"\noutput_folder: \"/home/user/mvt_output\"\n```\n\n# Verwendungsbeispiele\n\n## Fall 1: Logische Datenextraktion mit ADB\n\n### Geräteinformationen sammeln\n```bash\n# Systeminfo\nadb shell getprop > device_properties.txt\nadb shell cat /proc/version > kernel_info.txt\nadb shell mount > mount_info.txt\n\n# Installierte Apps\nadb shell pm list packages -f > installed_packages.txt\n```\n\n### Datenbank-Extraktion\n```bash\n# SMS/MMS Datenbank\nadb pull /data/data/com.android.providers.telephony/databases/mmssms.db\n\n# Kontakte\nadb pull /data/data/com.android.providers.contacts/databases/contacts2.db\n\n# Anrufliste \nadb pull /data/data/com.android.providers.contacts/databases/calllog.db\n```\n\n### WhatsApp Datenextraktion\n```bash\n# WhatsApp Datenbanken (Root erforderlich)\nadb shell su -c \"cp -r /data/data/com.whatsapp/ /sdcard/whatsapp_backup/\"\nadb pull /sdcard/whatsapp_backup/\n```\n\n## Fall 2: Android Backup-Analyse\n\n### Vollständiges Backup erstellen\n```bash\n# Umfassendes Backup (ohne Root)\nadb backup -all -system -apk -shared -f backup.ab\n\n# Backup entschlüsseln (falls verschlüsselt)\njava -jar abe.jar unpack backup.ab backup.tar\ntar -xf backup.tar\n```\n\n### Backup mit ALEAPP analysieren\n```bash\npython3 aleappGUI.py\n# Oder Command-Line\npython3 aleapp.py -t tar -i backup.tar -o output_folder\n```\n\n## Fall 3: MVT Kompromittierungsanalyse\n\n### Live-Geräteanalyse\n```bash\n# ADB-basierte Analyse\nmvt-android check-adb --output /path/to/output/\n\n# Backup-Analyse\nmvt-android check-backup --output /path/to/output/ backup.ab\n```\n\n### IOC-Suche mit Pegasus-Indikatoren\n```bash\n# Mit vorgefertigten IOCs\nmvt-android check-adb --iocs /path/to/pegasus.stix2 --output results/\n```\n\n## Fall 4: Physische Extraktion (Root erforderlich)\n\n### Device Rooting - MediaTek Geräte\n```bash\n# MTKClient für MediaTek-Chipsets\ngit clone https://github.com/bkerler/mtkclient.git\ncd mtkclient\npython3 mtk payload\n\n# Nach erfolgreichem Root\nadb shell su\n```\n\n### Vollständiges Memory Dump\n```bash\n# Partitionslayout ermitteln\nadb shell su -c \"cat /proc/partitions\"\nadb shell su -c \"ls -la /dev/block/\"\n\n# Vollständiges Device Image (Root erforderlich)\nadb shell su -c \"dd if=/dev/block/mmcblk0 of=/sdcard/full_device.img bs=4096\"\nadb pull /sdcard/full_device.img\n```\n\n# Best Practices\n\n## Rechtliche Compliance\n\n### Dokumentation und Chain of Custody\n- **Vollständige Dokumentation**: Wer, Was, Wann, Wo, Warum\n- **Hash-Verifikation**: MD5/SHA-256 für alle extrahierten Daten\n- **Nur forensische Kopien analysieren**, niemals Originaldaten\n- **Schriftliche Genehmigung** für Geräteanalyse einholen\n\n### Familiengeräte und Nachlässe\n- Genehmigung durch Nachlassverwalter erforderlich\n- Gerichtsbeschlüsse für Cloud-Zugang eventuell nötig\n- Drittpartei-Kommunikation kann weiterhin geschützt sein\n\n## Technische Best Practices\n\n### Hash-Integrität sicherstellen\n```bash\n# Hash vor und nach Transfer prüfen\nmd5sum original_file.db\nsha256sum original_file.db\n\n# Hash-Verifikation dokumentieren\necho \"$(date): MD5: $(md5sum file.db)\" >> chain_of_custody.log\n```\n\n### Sichere Arbeitsumgebung\n- Isolierte VM für Forensik-Arbeit\n- Netzwerk-Isolation während Analyse\n- Verschlüsselte Speicherung aller Evidenz\n- Regelmäßige Backups der Case-Datenbanken\n\n### Qualitätssicherung\n- Peer-Review kritischer Analysen\n- Standardisierte Arbeitsabläufe (SOPs)\n- Regelmäßige Tool-Validierung\n- Kontinuierliche Weiterbildung\n\n## Erfolgsmaximierung nach Gerätehersteller\n\n### MediaTek-Geräte (Höchste Erfolgsrate)\n- BootROM-Exploits für MT6735, MT6737, MT6750, MT6753, MT6797\n- MTKClient für Hardware-Level-Zugang\n- Erfolgsrate: 80%+ für Geräte 2015-2019\n\n### Samsung-Geräte\n- Ältere Knox-Implementierungen umgehbar\n- Emergency Dialer Exploits für Android 4.x\n- Erfolgsrate: 40-70% je nach Knox-Version\n\n### Pixel/Nexus-Geräte\n- Bootloader-Unlocking oft möglich\n- Fastboot-basierte Recovery-Installation\n- Erfolgsrate: 60-80% bei freigeschaltetem Bootloader\n\n# Troubleshooting\n\n## Problem: ADB erkennt Gerät nicht\n\n### Lösung: USB-Treiber und Berechtigungen\n```bash\n# Linux: USB-Berechtigungen prüfen\nlsusb | grep -i android\nsudo chmod 666 /dev/bus/usb/XXX/XXX\n\n# udev-Regeln erstellen\necho 'SUBSYSTEM==\"usb\", ATTR{idVendor}==\"18d1\", MODE=\"0666\", GROUP=\"plugdev\"' | sudo tee /etc/udev/rules.d/51-android.rules\nsudo udevadm control --reload-rules\n```\n\n### Windows: Treiber-Installation\n1. Geräte-Manager öffnen\n2. Android-Gerät mit Warnsymbol finden\n3. Treiber manuell installieren (Android USB Driver)\n\n## Problem: Verschlüsselte Android Backups\n\n### Lösung: Android Backup Extractor\n```bash\n# ADB Backup Extractor installieren\ngit clone https://github.com/nelenkov/android-backup-extractor.git\ncd android-backup-extractor\ngradle build\n\n# Backup entschlüsseln\njava -jar abe.jar unpack backup.ab backup.tar [password]\n```\n\n## Problem: Unzureichende Berechtigungen für Datenextraktion\n\n### Lösung: Alternative Extraktionsmethoden\n```bash\n# AFLogical OSE für begrenzte Extraktion ohne Root\n# WhatsApp Key/DB Extractor für spezifische Apps\n# Backup-basierte Extraktion als Fallback\n\n# Custom Recovery für erweiterten Zugang\nfastboot flash recovery twrp-device.img\n```\n\n## Problem: ALEAPP Parsing-Fehler\n\n### Lösung: Datenformat-Probleme beheben\n```bash\n# Log-Dateien prüfen\npython3 aleapp.py -t dir -i /path/to/data -o output --debug\n\n# Spezifische Parser deaktivieren\n# Manuelle SQLite-Analyse bei Parser-Fehlern\nsqlite3 database.db \".tables\"\nsqlite3 database.db \".schema table_name\"\n```\n\n# Erweiterte Techniken\n\n## Memory Forensics mit LiME\n\n### LiME für ARM-Devices kompilieren\n```bash\n# Cross-Compilation Setup\nexport ARCH=arm\nexport CROSS_COMPILE=arm-linux-gnueabi-\nexport KERNEL_DIR=/path/to/kernel/source\n\n# LiME Module kompilieren\ngit clone https://github.com/504ensicsLabs/LiME.git\ncd LiME/src\nmake\n\n# Memory Dump erstellen (Root erforderlich)\nadb push lime.ko /data/local/tmp/\nadb shell su -c \"insmod /data/local/tmp/lime.ko 'path=/sdcard/memory.lime format=lime'\"\n```\n\n### Volatility-Analyse von Android Memory\n```bash\n# Memory Dump analysieren\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.pslist\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.bash\npython vol.py -f memory.lime --profile=Linux \u003Cprofile> linux.netstat\n```\n\n## FRIDA-basierte Runtime-Analyse\n\n### FRIDA für Kryptographie-Hooks\n```javascript\n// crypto_hooks.js - SSL/TLS Traffic abfangen\nJava.perform(function() {\n var SSLContext = Java.use(\"javax.net.ssl.SSLContext\");\n SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(keyManagers, trustManagers, secureRandom) {\n console.log(\"[+] SSLContext.init() called\");\n this.init(keyManagers, trustManagers, secureRandom);\n };\n});\n```\n\n### FRIDA Installation und Verwendung\n```bash\n# FRIDA Server auf Android-Gerät installieren\nadb push frida-server /data/local/tmp/\nadb shell su -c \"chmod 755 /data/local/tmp/frida-server\"\nadb shell su -c \"/data/local/tmp/frida-server &\"\n\n# Script ausführen\nfrida -U -l crypto_hooks.js com.target.package\n```\n\n## Custom Recovery und Fastboot-Exploits\n\n### TWRP Installation für forensischen Zugang\n```bash\n# Bootloader entsperren (Herstellerabhängig)\nfastboot oem unlock\n# Oder\nfastboot flashing unlock\n\n# TWRP flashen\nfastboot flash recovery twrp-device.img\nfastboot boot twrp-device.img # Temporäre Installation\n\n# In TWRP: ADB-Zugang mit Root-Berechtigungen\nadb shell mount /system\nadb shell mount /data\n```\n\n### Partitions-Imaging mit dd\n```bash\n# Vollständige Partition-Liste\nadb shell cat /proc/partitions\n\n# Kritische Partitionen extrahieren\nadb shell dd if=/dev/block/bootdevice/by-name/system of=/external_sd/system.img\nadb shell dd if=/dev/block/bootdevice/by-name/userdata of=/external_sd/userdata.img\nadb shell dd if=/dev/block/bootdevice/by-name/boot of=/external_sd/boot.img\n```\n\n## SQLite Forensics und gelöschte Daten\n\n### Erweiterte SQLite-Analyse\n```bash\n# Freelist-Analyse für gelöschte Einträge\nsqlite3 database.db \"PRAGMA freelist_count;\"\nsqlite3 database.db \"PRAGMA page_size;\"\n\n# WAL-Datei Analyse\nsqlite3 database.db \"PRAGMA wal_checkpoint;\"\nstrings database.db-wal | grep -i \"search_term\"\n\n# Undark für Deleted Record Recovery\nundark database.db --freelist --export-csv\n```\n\n### Timeline-Rekonstruktion\n```bash\n# Autopsy Timeline-Generierung\n# Tools → Generate Timeline\n# Analyse von MAC-Times (Modified, Accessed, Created)\n\n# Plaso Timeline-Tools\nlog2timeline.py timeline.plaso /path/to/android/data/\npsort.py -o dynamic timeline.plaso\n```\n\n## Weiterführende Ressourcen\n\n### Dokumentation und Standards\n- [NIST SP 800-101 Rev. 1 - Mobile Device Forensics Guidelines](https://csrc.nist.gov/pubs/sp/800/101/r1/final)\n- [SANS FOR585 - Smartphone Forensics](https://www.sans.org/cyber-security-courses/advanced-smartphone-mobile-device-forensics/)\n- [ALEAPP GitHub Repository](https://github.com/abrignoni/ALEAPP)\n- [MVT Documentation](https://docs.mvt.re/en/latest/)\n\n### Community und Weiterbildung\n- [Autopsy User Documentation](https://sleuthkit.org/autopsy/docs/)\n- [Android Forensics References](https://github.com/impillar/AndroidReferences/blob/master/AndroidTools.md)\n- [Digital Forensics Framework Collection](https://github.com/mesquidar/ForensicsTools)\n\n### Spezialisierte Tools\n- [MTKClient für MediaTek Exploits](https://github.com/bkerler/mtkclient)\n- [Android Forensics Framework](https://github.com/nowsecure/android-forensics)\n- [Santoku Linux Mobile Forensics Distribution](https://santoku-linux.com/)\n\n---\n\n**Wichtiger Hinweis**: Diese Anleitung dient ausschließlich für autorisierte forensische Untersuchungen. Stellen Sie sicher, dass Sie über entsprechende rechtliche Befugnisse verfügen, bevor Sie diese Techniken anwenden. Bei Zweifeln konsultieren Sie Rechtsberatung.","src/content/knowledgebase/method-android-logical-imaging.md","7beea4180d8c1e9c",{"html":1306,"metadata":1307},"\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Open-Source Android Forensik bietet robuste Alternativen zu kommerziellen Lösungen wie Cellebrite UFED und Magnet AXIOM. Besonders für ältere Android-Geräte (5+ Jahre) existieren bewährte Methoden zur Datenextraktion und -analyse.\u003C/p>\n\u003Ch2 id=\"kernkomponenten-des-open-source-forensik-stacks\">Kernkomponenten des Open-Source Forensik-Stacks\u003C/h2>\n\u003Cp>\u003Cstrong>Autopsy Digital Forensics Platform\u003C/strong> bildet das Fundament mit GUI-basierter Analyse und integrierten Android-Parsing-Fähigkeiten. Die Plattform unterstützt \u003Cstrong>ALEAPP (Android Logs Events And Protobuf Parser)\u003C/strong>, das über 100 Artefakt-Kategorien aus Android-Extraktionen parst.\u003C/p>\n\u003Cp>\u003Cstrong>Mobile Verification Toolkit (MVT)\u003C/strong> von Amnesty International bietet spezialisierte Command-Line-Tools für Android-Analyse mit Fokus auf Kompromittierungserkennung.\u003C/p>\n\u003Cp>\u003Cstrong>SIFT Workstation\u003C/strong> stellt eine komplette Ubuntu-basierte forensische Umgebung mit 125+ vorinstallierten Tools bereit.\u003C/p>\n\u003Ch2 id=\"erfolgsraten-nach-gerätealter\">Erfolgsraten nach Gerätealter\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Pre-2017 Geräte\u003C/strong>: 85-98% logische Extraktion, 30-70% physische Extraktion\u003C/li>\n\u003Cli>\u003Cstrong>2017-2019 Geräte\u003C/strong>: 80-95% logische Extraktion, 15-35% physische Extraktion\u003C/li>\n\u003Cli>\u003Cstrong>2020+ Geräte\u003C/strong>: 70-85% logische Extraktion, 5-15% physische Extraktion\u003C/li>\n\u003C/ul>\n\u003Ch1 id=\"installation\">Installation\u003C/h1>\n\u003Ch2 id=\"sift-workstation-setup\">SIFT Workstation Setup\u003C/h2>\n\u003Ch3 id=\"systemanforderungen\">Systemanforderungen\u003C/h3>\n\u003Cul>\n\u003Cli>Quad-Core CPU 2.5GHz+\u003C/li>\n\u003Cli>16GB+ RAM\u003C/li>\n\u003Cli>500GB+ SSD Speicher\u003C/li>\n\u003Cli>USB 3.0+ Anschlüsse\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installation-1\">Installation\u003C/h3>\n\u003Col>\n\u003Cli>Download von \u003Ca href=\"https://www.sans.org/tools/sift-workstation/\">SANS SIFT Workstation\u003C/a>\u003C/li>\n\u003Cli>VMware/VirtualBox Import der OVA-Datei\u003C/li>\n\u003Cli>VM-Konfiguration: 8GB+ RAM, 4+ CPU-Kerne\u003C/li>\n\u003C/ol>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Update nach Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> upgrade\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -y\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sift\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"autopsy-installation\">Autopsy Installation\u003C/h2>\n\u003Ch3 id=\"windows-installation\">Windows Installation\u003C/h3>\n\u003Col>\n\u003Cli>Download von \u003Ca href=\"https://www.autopsy.com/\">autopsy.com\u003C/a>\u003C/li>\n\u003Cli>Java 8+ Installation erforderlich\u003C/li>\n\u003Cli>Installation mit Administratorrechten\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"linux-installation\">Linux Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ubuntu/Debian\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> autopsy\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> sleuthkit\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder manueller Download und Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/sleuthkit/autopsy/releases/latest\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"essential-tools-installation\">Essential Tools Installation\u003C/h2>\n\u003Ch3 id=\"android-debug-bridge-adb\">Android Debug Bridge (ADB)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Ubuntu/Debian\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-tools-adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-tools-fastboot\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Windows - Download Android Platform Tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># https://developer.android.com/studio/releases/platform-tools\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"aleapp-installation\">ALEAPP Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/abrignoni/ALEAPP.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ALEAPP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> requirements.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"mobile-verification-toolkit-mvt\">Mobile Verification Toolkit (MVT)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mvt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder via GitHub für neueste Version\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/mvt-project/mvt.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mvt\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> .\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"andriller-installation\">Andriller Installation\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/den4uk/andriller.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> andriller\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">pip3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -r\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> requirements.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"konfiguration\">Konfiguration\u003C/h1>\n\u003Ch2 id=\"adb-setup-und-gerätevorbereitung\">ADB Setup und Gerätevorbereitung\u003C/h2>\n\u003Ch3 id=\"usb-debugging-aktivieren\">USB-Debugging aktivieren\u003C/h3>\n\u003Col>\n\u003Cli>Entwickleroptionen freischalten (7x Build-Nummer antippen)\u003C/li>\n\u003Cli>USB-Debugging aktivieren\u003C/li>\n\u003Cli>Gerät via USB verbinden\u003C/li>\n\u003Cli>RSA-Fingerprint akzeptieren\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"adb-verbindung-testen\">ADB Verbindung testen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> devices\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Sollte Gerät mit \"device\" Status zeigen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ro.build.version.release\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Android Version\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> ro.product.model\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Gerätemodell\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"autopsy-projektkonfiguration\">Autopsy Projektkonfiguration\u003C/h2>\n\u003Ch3 id=\"case-setup\">Case-Setup\u003C/h3>\n\u003Col>\n\u003Cli>Neuen Fall erstellen\u003C/li>\n\u003Cli>Ermittler-Informationen eingeben\u003C/li>\n\u003Cli>Case-Verzeichnis festlegen (ausreichend Speicherplatz)\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"android-analyzer-module-aktivieren\">Android Analyzer Module aktivieren\u003C/h3>\n\u003Cul>\n\u003Cli>Tools → Options → Modules\u003C/li>\n\u003Cli>Android Analyzer aktivieren\u003C/li>\n\u003Cli>ALEAPP Integration konfigurieren\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"hash-algorithmen-konfigurieren\">Hash-Algorithmen konfigurieren\u003C/h3>\n\u003Cul>\n\u003Cli>MD5, SHA-1, SHA-256 für Integritätsprüfung\u003C/li>\n\u003Cli>Automatische Hash-Berechnung bei Import aktivieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"mvt-konfiguration\">MVT Konfiguration\u003C/h2>\n\u003Ch3 id=\"konfigurationsdatei-erstellen\">Konfigurationsdatei erstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"yaml\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ~/.mvt/config.yaml\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">adb_path\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/usr/bin/adb\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#85E89D\">output_folder\u003C/span>\u003Cspan style=\"color:#E1E4E8\">: \u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"/home/user/mvt_output\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h1>\n\u003Ch2 id=\"fall-1-logische-datenextraktion-mit-adb\">Fall 1: Logische Datenextraktion mit ADB\u003C/h2>\n\u003Ch3 id=\"geräteinformationen-sammeln\">Geräteinformationen sammeln\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Systeminfo\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> getprop\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> device_properties.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /proc/version\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> kernel_info.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount_info.txt\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Installierte Apps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pm\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> list\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> packages\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> installed_packages.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"datenbank-extraktion\">Datenbank-Extraktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># SMS/MMS Datenbank\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.telephony/databases/mmssms.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Kontakte\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.contacts/databases/contacts2.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Anrufliste \u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/data/com.android.providers.contacts/databases/calllog.db\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"whatsapp-datenextraktion\">WhatsApp Datenextraktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WhatsApp Datenbanken (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"cp -r /data/data/com.whatsapp/ /sdcard/whatsapp_backup/\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /sdcard/whatsapp_backup/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-2-android-backup-analyse\">Fall 2: Android Backup-Analyse\u003C/h2>\n\u003Ch3 id=\"vollständiges-backup-erstellen\">Vollständiges Backup erstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Umfassendes Backup (ohne Root)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -all\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -system\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -apk\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -shared\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup entschlüsseln (falls verschlüsselt)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">java\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> abe.jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unpack\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -xf\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"backup-mit-aleapp-analysieren\">Backup mit ALEAPP analysieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleappGUI.py\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder Command-Line\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleapp.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> output_folder\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-3-mvt-kompromittierungsanalyse\">Fall 3: MVT Kompromittierungsanalyse\u003C/h2>\n\u003Ch3 id=\"live-geräteanalyse\">Live-Geräteanalyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ADB-basierte Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-adb\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/output/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup-Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-backup\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/output/\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"ioc-suche-mit-pegasus-indikatoren\">IOC-Suche mit Pegasus-Indikatoren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Mit vorgefertigten IOCs\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">mvt-android\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> check-adb\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --iocs\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/pegasus.stix2\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --output\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> results/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"fall-4-physische-extraktion-root-erforderlich\">Fall 4: Physische Extraktion (Root erforderlich)\u003C/h2>\n\u003Ch3 id=\"device-rooting---mediatek-geräte\">Device Rooting - MediaTek Geräte\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MTKClient für MediaTek-Chipsets\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/bkerler/mtkclient.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mtkclient\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mtk\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> payload\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Nach erfolgreichem Root\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"vollständiges-memory-dump\">Vollständiges Memory Dump\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Partitionslayout ermitteln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"cat /proc/partitions\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"ls -la /dev/block/\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständiges Device Image (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"dd if=/dev/block/mmcblk0 of=/sdcard/full_device.img bs=4096\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /sdcard/full_device.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"best-practices\">Best Practices\u003C/h1>\n\u003Ch2 id=\"rechtliche-compliance\">Rechtliche Compliance\u003C/h2>\n\u003Ch3 id=\"dokumentation-und-chain-of-custody\">Dokumentation und Chain of Custody\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Vollständige Dokumentation\u003C/strong>: Wer, Was, Wann, Wo, Warum\u003C/li>\n\u003Cli>\u003Cstrong>Hash-Verifikation\u003C/strong>: MD5/SHA-256 für alle extrahierten Daten\u003C/li>\n\u003Cli>\u003Cstrong>Nur forensische Kopien analysieren\u003C/strong>, niemals Originaldaten\u003C/li>\n\u003Cli>\u003Cstrong>Schriftliche Genehmigung\u003C/strong> für Geräteanalyse einholen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"familiengeräte-und-nachlässe\">Familiengeräte und Nachlässe\u003C/h3>\n\u003Cul>\n\u003Cli>Genehmigung durch Nachlassverwalter erforderlich\u003C/li>\n\u003Cli>Gerichtsbeschlüsse für Cloud-Zugang eventuell nötig\u003C/li>\n\u003Cli>Drittpartei-Kommunikation kann weiterhin geschützt sein\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"technische-best-practices\">Technische Best Practices\u003C/h2>\n\u003Ch3 id=\"hash-integrität-sicherstellen\">Hash-Integrität sicherstellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash vor und nach Transfer prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_file.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sha256sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> original_file.db\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Hash-Verifikation dokumentieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"$(\u003C/span>\u003Cspan style=\"color:#B392F0\">date\u003C/span>\u003Cspan style=\"color:#9ECBFF\">): MD5: $(\u003C/span>\u003Cspan style=\"color:#B392F0\">md5sum\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> file.db)\"\u003C/span>\u003Cspan style=\"color:#F97583\"> >>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> chain_of_custody.log\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"sichere-arbeitsumgebung\">Sichere Arbeitsumgebung\u003C/h3>\n\u003Cul>\n\u003Cli>Isolierte VM für Forensik-Arbeit\u003C/li>\n\u003Cli>Netzwerk-Isolation während Analyse\u003C/li>\n\u003Cli>Verschlüsselte Speicherung aller Evidenz\u003C/li>\n\u003Cli>Regelmäßige Backups der Case-Datenbanken\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"qualitätssicherung\">Qualitätssicherung\u003C/h3>\n\u003Cul>\n\u003Cli>Peer-Review kritischer Analysen\u003C/li>\n\u003Cli>Standardisierte Arbeitsabläufe (SOPs)\u003C/li>\n\u003Cli>Regelmäßige Tool-Validierung\u003C/li>\n\u003Cli>Kontinuierliche Weiterbildung\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"erfolgsmaximierung-nach-gerätehersteller\">Erfolgsmaximierung nach Gerätehersteller\u003C/h2>\n\u003Ch3 id=\"mediatek-geräte-höchste-erfolgsrate\">MediaTek-Geräte (Höchste Erfolgsrate)\u003C/h3>\n\u003Cul>\n\u003Cli>BootROM-Exploits für MT6735, MT6737, MT6750, MT6753, MT6797\u003C/li>\n\u003Cli>MTKClient für Hardware-Level-Zugang\u003C/li>\n\u003Cli>Erfolgsrate: 80%+ für Geräte 2015-2019\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"samsung-geräte\">Samsung-Geräte\u003C/h3>\n\u003Cul>\n\u003Cli>Ältere Knox-Implementierungen umgehbar\u003C/li>\n\u003Cli>Emergency Dialer Exploits für Android 4.x\u003C/li>\n\u003Cli>Erfolgsrate: 40-70% je nach Knox-Version\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"pixelnexus-geräte\">Pixel/Nexus-Geräte\u003C/h3>\n\u003Cul>\n\u003Cli>Bootloader-Unlocking oft möglich\u003C/li>\n\u003Cli>Fastboot-basierte Recovery-Installation\u003C/li>\n\u003Cli>Erfolgsrate: 60-80% bei freigeschaltetem Bootloader\u003C/li>\n\u003C/ul>\n\u003Ch1 id=\"troubleshooting\">Troubleshooting\u003C/h1>\n\u003Ch2 id=\"problem-adb-erkennt-gerät-nicht\">Problem: ADB erkennt Gerät nicht\u003C/h2>\n\u003Ch3 id=\"lösung-usb-treiber-und-berechtigungen\">Lösung: USB-Treiber und Berechtigungen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Linux: USB-Berechtigungen prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">lsusb\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> chmod\u003C/span>\u003Cspan style=\"color:#79B8FF\"> 666\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /dev/bus/usb/XXX/XXX\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># udev-Regeln erstellen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">echo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'SUBSYSTEM==\"usb\", ATTR{idVendor}==\"18d1\", MODE=\"0666\", GROUP=\"plugdev\"'\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> tee\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /etc/udev/rules.d/51-android.rules\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> udevadm\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> control\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --reload-rules\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"windows-treiber-installation\">Windows: Treiber-Installation\u003C/h3>\n\u003Col>\n\u003Cli>Geräte-Manager öffnen\u003C/li>\n\u003Cli>Android-Gerät mit Warnsymbol finden\u003C/li>\n\u003Cli>Treiber manuell installieren (Android USB Driver)\u003C/li>\n\u003C/ol>\n\u003Ch2 id=\"problem-verschlüsselte-android-backups\">Problem: Verschlüsselte Android Backups\u003C/h2>\n\u003Ch3 id=\"lösung-android-backup-extractor\">Lösung: Android Backup Extractor\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># ADB Backup Extractor installieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/nelenkov/android-backup-extractor.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> android-backup-extractor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">gradle\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> build\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup entschlüsseln\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">java\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> abe.jar\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unpack\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.ab\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> backup.tar\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> [password]\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"problem-unzureichende-berechtigungen-für-datenextraktion\">Problem: Unzureichende Berechtigungen für Datenextraktion\u003C/h2>\n\u003Ch3 id=\"lösung-alternative-extraktionsmethoden\">Lösung: Alternative Extraktionsmethoden\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># AFLogical OSE für begrenzte Extraktion ohne Root\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WhatsApp Key/DB Extractor für spezifische Apps\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Backup-basierte Extraktion als Fallback\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Custom Recovery für erweiterten Zugang\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> recovery\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"problem-aleapp-parsing-fehler\">Problem: ALEAPP Parsing-Fehler\u003C/h2>\n\u003Ch3 id=\"lösung-datenformat-probleme-beheben\">Lösung: Datenformat-Probleme beheben\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Log-Dateien prüfen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> aleapp.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -t\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dir\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/data\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> output\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --debug\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Spezifische Parser deaktivieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Manuelle SQLite-Analyse bei Parser-Fehlern\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \".tables\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \".schema table_name\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch1 id=\"erweiterte-techniken\">Erweiterte Techniken\u003C/h1>\n\u003Ch2 id=\"memory-forensics-mit-lime\">Memory Forensics mit LiME\u003C/h2>\n\u003Ch3 id=\"lime-für-arm-devices-kompilieren\">LiME für ARM-Devices kompilieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Cross-Compilation Setup\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> ARCH\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">arm\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> CROSS_COMPILE\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">arm-linux-gnueabi-\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\">export\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> KERNEL_DIR\u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\">/path/to/kernel/source\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># LiME Module kompilieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/504ensicsLabs/LiME.git\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> LiME/src\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">make\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory Dump erstellen (Root erforderlich)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> push\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> lime.ko\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/local/tmp/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"insmod /data/local/tmp/lime.ko 'path=/sdcard/memory.lime format=lime'\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"volatility-analyse-von-android-memory\">Volatility-Analyse von Android Memory\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Memory Dump analysieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.pslist\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.bash\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">python\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> vol.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -f\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> memory.lime\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --profile=Linux\u003C/span>\u003Cspan style=\"color:#F97583\"> <\u003C/span>\u003Cspan style=\"color:#9ECBFF\">profil\u003C/span>\u003Cspan style=\"color:#E1E4E8\">e\u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> linux.netstat\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"frida-basierte-runtime-analyse\">FRIDA-basierte Runtime-Analyse\u003C/h2>\n\u003Ch3 id=\"frida-für-kryptographie-hooks\">FRIDA für Kryptographie-Hooks\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"javascript\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\">// crypto_hooks.js - SSL/TLS Traffic abfangen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">Java.\u003C/span>\u003Cspan style=\"color:#B392F0\">perform\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#F97583\">function\u003C/span>\u003Cspan style=\"color:#E1E4E8\">() {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#F97583\"> var\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> SSLContext \u003C/span>\u003Cspan style=\"color:#F97583\">=\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> Java.\u003C/span>\u003Cspan style=\"color:#B392F0\">use\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"javax.net.ssl.SSLContext\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> SSLContext.init.\u003C/span>\u003Cspan style=\"color:#B392F0\">overload\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">'[Ljavax.net.ssl.KeyManager;'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'[Ljavax.net.ssl.TrustManager;'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#9ECBFF\">'java.security.SecureRandom'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">).\u003C/span>\u003Cspan style=\"color:#B392F0\">implementation\u003C/span>\u003Cspan style=\"color:#F97583\"> =\u003C/span>\u003Cspan style=\"color:#F97583\"> function\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#FFAB70\">keyManagers\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">trustManagers\u003C/span>\u003Cspan style=\"color:#E1E4E8\">, \u003C/span>\u003Cspan style=\"color:#FFAB70\">secureRandom\u003C/span>\u003Cspan style=\"color:#E1E4E8\">) {\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> console.\u003C/span>\u003Cspan style=\"color:#B392F0\">log\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(\u003C/span>\u003Cspan style=\"color:#9ECBFF\">\"[+] SSLContext.init() called\"\u003C/span>\u003Cspan style=\"color:#E1E4E8\">);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> this\u003C/span>\u003Cspan style=\"color:#E1E4E8\">.\u003C/span>\u003Cspan style=\"color:#B392F0\">init\u003C/span>\u003Cspan style=\"color:#E1E4E8\">(keyManagers, trustManagers, secureRandom);\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> };\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">});\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"frida-installation-und-verwendung\">FRIDA Installation und Verwendung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># FRIDA Server auf Android-Gerät installieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> push\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frida-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data/local/tmp/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"chmod 755 /data/local/tmp/frida-server\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> su\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -c\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"/data/local/tmp/frida-server &\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Script ausführen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">frida\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -U\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -l\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> crypto_hooks.js\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> com.target.package\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"custom-recovery-und-fastboot-exploits\">Custom Recovery und Fastboot-Exploits\u003C/h2>\n\u003Ch3 id=\"twrp-installation-für-forensischen-zugang\">TWRP Installation für forensischen Zugang\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Bootloader entsperren (Herstellerabhängig)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> oem\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unlock\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Oder\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flashing\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unlock\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># TWRP flashen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> flash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> recovery\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">fastboot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> boot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> twrp-device.img\u003C/span>\u003Cspan style=\"color:#6A737D\"> # Temporäre Installation\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># In TWRP: ADB-Zugang mit Root-Berechtigungen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /system\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mount\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /data\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"partitions-imaging-mit-dd\">Partitions-Imaging mit dd\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Vollständige Partition-Liste\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> cat\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /proc/partitions\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Kritische Partitionen extrahieren\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/system\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/system.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/userdata\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/userdata.img\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">adb\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> shell\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> if=/dev/block/bootdevice/by-name/boot\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> of=/external_sd/boot.img\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"sqlite-forensics-und-gelöschte-daten\">SQLite Forensics und gelöschte Daten\u003C/h2>\n\u003Ch3 id=\"erweiterte-sqlite-analyse\">Erweiterte SQLite-Analyse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Freelist-Analyse für gelöschte Einträge\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA freelist_count;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA page_size;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># WAL-Datei Analyse\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sqlite3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"PRAGMA wal_checkpoint;\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">strings\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db-wal\u003C/span>\u003Cspan style=\"color:#F97583\"> |\u003C/span>\u003Cspan style=\"color:#B392F0\"> grep\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -i\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> \"search_term\"\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Undark für Deleted Record Recovery\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">undark\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> database.db\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --freelist\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --export-csv\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"timeline-rekonstruktion\">Timeline-Rekonstruktion\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Autopsy Timeline-Generierung\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Tools → Generate Timeline\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Analyse von MAC-Times (Modified, Accessed, Created)\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Plaso Timeline-Tools\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">log2timeline.py\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /path/to/android/data/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">psort.py\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -o\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dynamic\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> timeline.plaso\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"weiterführende-ressourcen\">Weiterführende Ressourcen\u003C/h2>\n\u003Ch3 id=\"dokumentation-und-standards\">Dokumentation und Standards\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://csrc.nist.gov/pubs/sp/800/101/r1/final\">NIST SP 800-101 Rev. 1 - Mobile Device Forensics Guidelines\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.sans.org/cyber-security-courses/advanced-smartphone-mobile-device-forensics/\">SANS FOR585 - Smartphone Forensics\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/abrignoni/ALEAPP\">ALEAPP GitHub Repository\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://docs.mvt.re/en/latest/\">MVT Documentation\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"community-und-weiterbildung\">Community und Weiterbildung\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://sleuthkit.org/autopsy/docs/\">Autopsy User Documentation\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/impillar/AndroidReferences/blob/master/AndroidTools.md\">Android Forensics References\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/mesquidar/ForensicsTools\">Digital Forensics Framework Collection\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"spezialisierte-tools\">Spezialisierte Tools\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://github.com/bkerler/mtkclient\">MTKClient für MediaTek Exploits\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://github.com/nowsecure/android-forensics\">Android Forensics Framework\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://santoku-linux.com/\">Santoku Linux Mobile Forensics Distribution\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Wichtiger Hinweis\u003C/strong>: Diese Anleitung dient ausschließlich für autorisierte forensische Untersuchungen. Stellen Sie sicher, dass Sie über entsprechende rechtliche Befugnisse verfügen, bevor Sie diese Techniken anwenden. Bei Zweifeln konsultieren Sie Rechtsberatung.\u003C/p>",{"headings":1308,"localImagePaths":1529,"remoteImagePaths":1530,"frontmatter":1531,"imagePaths":1537},[1309,1312,1315,1318,1321,1324,1325,1327,1330,1333,1336,1339,1342,1345,1348,1351,1354,1357,1360,1363,1366,1369,1372,1375,1378,1381,1384,1387,1390,1393,1396,1399,1402,1405,1408,1411,1414,1417,1420,1423,1424,1427,1428,1431,1434,1437,1440,1441,1444,1447,1450,1453,1455,1458,1461,1464,1467,1470,1473,1476,1479,1482,1485,1488,1491,1494,1497,1500,1503,1506,1509,1512,1515,1518,1521,1522,1525,1528],{"depth":44,"slug":1310,"text":1311},"übersicht","Übersicht",{"depth":47,"slug":1313,"text":1314},"kernkomponenten-des-open-source-forensik-stacks","Kernkomponenten des Open-Source Forensik-Stacks",{"depth":47,"slug":1316,"text":1317},"erfolgsraten-nach-gerätealter","Erfolgsraten nach Gerätealter",{"depth":44,"slug":1319,"text":1320},"installation","Installation",{"depth":47,"slug":1322,"text":1323},"sift-workstation-setup","SIFT Workstation Setup",{"depth":54,"slug":718,"text":719},{"depth":54,"slug":1326,"text":1320},"installation-1",{"depth":47,"slug":1328,"text":1329},"autopsy-installation","Autopsy Installation",{"depth":54,"slug":1331,"text":1332},"windows-installation","Windows Installation",{"depth":54,"slug":1334,"text":1335},"linux-installation","Linux Installation",{"depth":47,"slug":1337,"text":1338},"essential-tools-installation","Essential Tools Installation",{"depth":54,"slug":1340,"text":1341},"android-debug-bridge-adb","Android Debug Bridge (ADB)",{"depth":54,"slug":1343,"text":1344},"aleapp-installation","ALEAPP Installation",{"depth":54,"slug":1346,"text":1347},"mobile-verification-toolkit-mvt","Mobile Verification Toolkit (MVT)",{"depth":54,"slug":1349,"text":1350},"andriller-installation","Andriller Installation",{"depth":44,"slug":1352,"text":1353},"konfiguration","Konfiguration",{"depth":47,"slug":1355,"text":1356},"adb-setup-und-gerätevorbereitung","ADB Setup und Gerätevorbereitung",{"depth":54,"slug":1358,"text":1359},"usb-debugging-aktivieren","USB-Debugging aktivieren",{"depth":54,"slug":1361,"text":1362},"adb-verbindung-testen","ADB Verbindung testen",{"depth":47,"slug":1364,"text":1365},"autopsy-projektkonfiguration","Autopsy Projektkonfiguration",{"depth":54,"slug":1367,"text":1368},"case-setup","Case-Setup",{"depth":54,"slug":1370,"text":1371},"android-analyzer-module-aktivieren","Android Analyzer Module aktivieren",{"depth":54,"slug":1373,"text":1374},"hash-algorithmen-konfigurieren","Hash-Algorithmen konfigurieren",{"depth":47,"slug":1376,"text":1377},"mvt-konfiguration","MVT Konfiguration",{"depth":54,"slug":1379,"text":1380},"konfigurationsdatei-erstellen","Konfigurationsdatei erstellen",{"depth":44,"slug":1382,"text":1383},"verwendungsbeispiele","Verwendungsbeispiele",{"depth":47,"slug":1385,"text":1386},"fall-1-logische-datenextraktion-mit-adb","Fall 1: Logische Datenextraktion mit ADB",{"depth":54,"slug":1388,"text":1389},"geräteinformationen-sammeln","Geräteinformationen sammeln",{"depth":54,"slug":1391,"text":1392},"datenbank-extraktion","Datenbank-Extraktion",{"depth":54,"slug":1394,"text":1395},"whatsapp-datenextraktion","WhatsApp Datenextraktion",{"depth":47,"slug":1397,"text":1398},"fall-2-android-backup-analyse","Fall 2: Android Backup-Analyse",{"depth":54,"slug":1400,"text":1401},"vollständiges-backup-erstellen","Vollständiges Backup erstellen",{"depth":54,"slug":1403,"text":1404},"backup-mit-aleapp-analysieren","Backup mit ALEAPP analysieren",{"depth":47,"slug":1406,"text":1407},"fall-3-mvt-kompromittierungsanalyse","Fall 3: MVT Kompromittierungsanalyse",{"depth":54,"slug":1409,"text":1410},"live-geräteanalyse","Live-Geräteanalyse",{"depth":54,"slug":1412,"text":1413},"ioc-suche-mit-pegasus-indikatoren","IOC-Suche mit Pegasus-Indikatoren",{"depth":47,"slug":1415,"text":1416},"fall-4-physische-extraktion-root-erforderlich","Fall 4: Physische Extraktion (Root erforderlich)",{"depth":54,"slug":1418,"text":1419},"device-rooting---mediatek-geräte","Device Rooting - MediaTek Geräte",{"depth":54,"slug":1421,"text":1422},"vollständiges-memory-dump","Vollständiges Memory Dump",{"depth":44,"slug":459,"text":460},{"depth":47,"slug":1425,"text":1426},"rechtliche-compliance","Rechtliche Compliance",{"depth":54,"slug":316,"text":317},{"depth":54,"slug":1429,"text":1430},"familiengeräte-und-nachlässe","Familiengeräte und Nachlässe",{"depth":47,"slug":1432,"text":1433},"technische-best-practices","Technische Best Practices",{"depth":54,"slug":1435,"text":1436},"hash-integrität-sicherstellen","Hash-Integrität sicherstellen",{"depth":54,"slug":1438,"text":1439},"sichere-arbeitsumgebung","Sichere Arbeitsumgebung",{"depth":54,"slug":319,"text":320},{"depth":47,"slug":1442,"text":1443},"erfolgsmaximierung-nach-gerätehersteller","Erfolgsmaximierung nach Gerätehersteller",{"depth":54,"slug":1445,"text":1446},"mediatek-geräte-höchste-erfolgsrate","MediaTek-Geräte (Höchste Erfolgsrate)",{"depth":54,"slug":1448,"text":1449},"samsung-geräte","Samsung-Geräte",{"depth":54,"slug":1451,"text":1452},"pixelnexus-geräte","Pixel/Nexus-Geräte",{"depth":44,"slug":193,"text":1454},"Troubleshooting",{"depth":47,"slug":1456,"text":1457},"problem-adb-erkennt-gerät-nicht","Problem: ADB erkennt Gerät nicht",{"depth":54,"slug":1459,"text":1460},"lösung-usb-treiber-und-berechtigungen","Lösung: USB-Treiber und Berechtigungen",{"depth":54,"slug":1462,"text":1463},"windows-treiber-installation","Windows: Treiber-Installation",{"depth":47,"slug":1465,"text":1466},"problem-verschlüsselte-android-backups","Problem: Verschlüsselte Android Backups",{"depth":54,"slug":1468,"text":1469},"lösung-android-backup-extractor","Lösung: Android Backup Extractor",{"depth":47,"slug":1471,"text":1472},"problem-unzureichende-berechtigungen-für-datenextraktion","Problem: Unzureichende Berechtigungen für Datenextraktion",{"depth":54,"slug":1474,"text":1475},"lösung-alternative-extraktionsmethoden","Lösung: Alternative Extraktionsmethoden",{"depth":47,"slug":1477,"text":1478},"problem-aleapp-parsing-fehler","Problem: ALEAPP Parsing-Fehler",{"depth":54,"slug":1480,"text":1481},"lösung-datenformat-probleme-beheben","Lösung: Datenformat-Probleme beheben",{"depth":44,"slug":1483,"text":1484},"erweiterte-techniken","Erweiterte Techniken",{"depth":47,"slug":1486,"text":1487},"memory-forensics-mit-lime","Memory Forensics mit LiME",{"depth":54,"slug":1489,"text":1490},"lime-für-arm-devices-kompilieren","LiME für ARM-Devices kompilieren",{"depth":54,"slug":1492,"text":1493},"volatility-analyse-von-android-memory","Volatility-Analyse von Android Memory",{"depth":47,"slug":1495,"text":1496},"frida-basierte-runtime-analyse","FRIDA-basierte Runtime-Analyse",{"depth":54,"slug":1498,"text":1499},"frida-für-kryptographie-hooks","FRIDA für Kryptographie-Hooks",{"depth":54,"slug":1501,"text":1502},"frida-installation-und-verwendung","FRIDA Installation und Verwendung",{"depth":47,"slug":1504,"text":1505},"custom-recovery-und-fastboot-exploits","Custom Recovery und Fastboot-Exploits",{"depth":54,"slug":1507,"text":1508},"twrp-installation-für-forensischen-zugang","TWRP Installation für forensischen Zugang",{"depth":54,"slug":1510,"text":1511},"partitions-imaging-mit-dd","Partitions-Imaging mit dd",{"depth":47,"slug":1513,"text":1514},"sqlite-forensics-und-gelöschte-daten","SQLite Forensics und gelöschte Daten",{"depth":54,"slug":1516,"text":1517},"erweiterte-sqlite-analyse","Erweiterte SQLite-Analyse",{"depth":54,"slug":1519,"text":1520},"timeline-rekonstruktion","Timeline-Rekonstruktion",{"depth":47,"slug":166,"text":167},{"depth":54,"slug":1523,"text":1524},"dokumentation-und-standards","Dokumentation und Standards",{"depth":54,"slug":1526,"text":1527},"community-und-weiterbildung","Community und Weiterbildung",{"depth":54,"slug":326,"text":327},[],[],{"title":1291,"tool_name":1294,"description":1292,"last_updated":1532,"author":18,"difficulty":19,"categories":1533,"tags":1534,"sections":1535,"review_status":1536},["Date","2025-07-21T00:00:00.000Z"],[1297],[1299,1300,1301],{"overview":34,"installation":34,"configuration":34,"usage_examples":34,"best_practices":34,"troubleshooting":34,"advanced_topics":34},"published",[],"method-android-logical-imaging.md","tool-kali-linux",{"id":1539,"data":1541,"body":1556,"filePath":1557,"digest":1558,"rendered":1559,"legacyId":1619},{"title":1542,"description":1543,"last_updated":1544,"tool_name":1545,"related_tools":1546,"author":18,"difficulty":189,"categories":1547,"tags":1550,"published":34,"gated_content":35},"Kali Linux - Die Hacker-Distribution für Forensik & Penetration Testing","Leitfaden zur Installation, Nutzung und Best Practices für Kali Linux – die All-in-One-Plattform für Security-Profis.",["Date","2025-08-10T00:00:00.000Z"],"Kali Linux",[],[697,1548,1549],"forensics","penetration-testing",[1551,1552,1549,1553,1554,1555],"live-boot","tool-collection","forensics-suite","virtualization","arm-support","> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nKali Linux ist eine auf Debian basierende Linux-Distribution, die speziell für Penetration Testing, digitale Forensik, Reverse Engineering und Incident Response entwickelt wurde. Mit über 600 vorinstallierten Tools ist sie ein unverzichtbares Werkzeug für Security-Experten, Ermittler und forensische Analysten. Die Live-Boot-Funktion erlaubt es, Systeme ohne Spuren zu hinterlassen zu analysieren – ideal für forensische Untersuchungen.\n\n## Installation\n\n### Option 1: Live-System (USB/DVD)\n\n1. ISO-Image von [kali.org](https://www.kali.org/get-kali/) herunterladen.\n2. Mit **Rufus** oder **balenaEtcher** auf einen USB-Stick schreiben.\n3. Vom USB-Stick booten (ggf. Boot-Reihenfolge im BIOS anpassen).\n4. Kali kann direkt ohne Installation im Live-Modus verwendet werden.\n\n### Option 2: Installation auf Festplatte\n\n1. ISO-Image booten und **Graphical Install** wählen.\n2. Schritt-für-Schritt durch den Installationsassistenten navigieren:\n - Sprache, Zeitzone und Tastaturlayout auswählen\n - Partitionierung konfigurieren (automatisch oder manuell)\n - Benutzerkonten erstellen\n3. Nach Installation Neustart durchführen.\n\n### Option 3: Virtuelle Maschine (VM)\n\n- Offizielle VM-Images für VirtualBox und VMware von der [Kali-Website](https://www.kali.org/get-kali/#kali-virtual-machines)\n- Importieren, ggf. Netzwerkbrücke und Shared Folders aktivieren\n\n## Konfiguration\n\n### Netzwerkeinstellungen\n\n- Konfiguration über `nmtui` oder `/etc/network/interfaces`\n- VPN und Proxy-Integration über GUI oder Terminal\n\n### Updates & Paketquellen\n\n```bash\nsudo apt update && sudo apt full-upgrade\n````\n\n> Hinweis: `kali-rolling` ist die Standard-Distribution für kontinuierliche Updates.\n\n### Sprache & Lokalisierung\n\n```bash\nsudo dpkg-reconfigure locales\nsudo dpkg-reconfigure keyboard-configuration\n```\n\n## Verwendungsbeispiele\n\n### 1. Netzwerkscan mit Nmap\n\n```bash\nnmap -sS -T4 -A 192.168.1.0/24\n```\n\n### 2. Passwort-Cracking mit John the Ripper\n\n```bash\njohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt\n```\n\n### 3. Forensik mit Autopsy\n\n```bash\nautopsy &\n```\n\n### 4. Android-Analyse mit MobSF (in Docker)\n\n```bash\ndocker pull opensecurity/mobile-security-framework-mobsf\ndocker run -it -p 8000:8000 mobsf\n```\n\n## Best Practices\n\n* Nutze immer **aktuelle Snapshots** oder VM-Clones vor gefährlichen Tests\n* Verwende separate Netzwerke (z. B. Host-only oder NAT) für Tests\n* Deaktiviere automatisches WLAN bei forensischen Analysen\n* Prüfe und aktualisiere regelmäßig Toolsets (`apt`, `git`, `pip`)\n* Halte deine ISO-Images versioniert für forensische Reproduzierbarkeit\n\n## Troubleshooting\n\n### Problem: Keine Internetverbindung nach Installation\n\n**Lösung:** Netzwerkadapter prüfen, ggf. mit `ifconfig` oder `ip a` überprüfen, DHCP aktivieren.\n\n### Problem: Tools fehlen nach Update\n\n**Lösung:** Tool-Gruppen wie `kali-linux-default` manuell nachinstallieren:\n\n```bash\nsudo apt install kali-linux-default\n```\n\n### Problem: „Permission Denied“ bei Tools\n\n**Lösung:** Root-Rechte nutzen oder mit `sudo` ausführen.\n\n## Weiterführende Themen\n\n* **Kustomisierung von Kali ISOs** mit `live-build`\n* **NetHunter**: Kali für mobile Geräte (Android)\n* **Kali Purple**: Defensive Security Suite\n* Integration mit **Cloud-Infrastrukturen** via WSL oder Azure\n\n---\n\n**Links & Ressourcen:**\n\n* Offizielle Website: [https://kali.org](https://kali.org/)\n* Dokumentation: [https://docs.kali.org/](https://docs.kali.org/)\n* GitLab Repo: [https://gitlab.com/kalilinux](https://gitlab.com/kalilinux)\n* Discord-Community: [https://discord.com/invite/kali-linux](https://discord.com/invite/kali-linux)","src/content/knowledgebase/tool-kali-linux.md","f6b0350b2b091ed2",{"html":1560,"metadata":1561},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Kali Linux ist eine auf Debian basierende Linux-Distribution, die speziell für Penetration Testing, digitale Forensik, Reverse Engineering und Incident Response entwickelt wurde. Mit über 600 vorinstallierten Tools ist sie ein unverzichtbares Werkzeug für Security-Experten, Ermittler und forensische Analysten. Die Live-Boot-Funktion erlaubt es, Systeme ohne Spuren zu hinterlassen zu analysieren – ideal für forensische Untersuchungen.\u003C/p>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"option-1-live-system-usbdvd\">Option 1: Live-System (USB/DVD)\u003C/h3>\n\u003Col>\n\u003Cli>ISO-Image von \u003Ca href=\"https://www.kali.org/get-kali/\">kali.org\u003C/a> herunterladen.\u003C/li>\n\u003Cli>Mit \u003Cstrong>Rufus\u003C/strong> oder \u003Cstrong>balenaEtcher\u003C/strong> auf einen USB-Stick schreiben.\u003C/li>\n\u003Cli>Vom USB-Stick booten (ggf. Boot-Reihenfolge im BIOS anpassen).\u003C/li>\n\u003Cli>Kali kann direkt ohne Installation im Live-Modus verwendet werden.\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"option-2-installation-auf-festplatte\">Option 2: Installation auf Festplatte\u003C/h3>\n\u003Col>\n\u003Cli>ISO-Image booten und \u003Cstrong>Graphical Install\u003C/strong> wählen.\u003C/li>\n\u003Cli>Schritt-für-Schritt durch den Installationsassistenten navigieren:\n\u003Cul>\n\u003Cli>Sprache, Zeitzone und Tastaturlayout auswählen\u003C/li>\n\u003Cli>Partitionierung konfigurieren (automatisch oder manuell)\u003C/li>\n\u003Cli>Benutzerkonten erstellen\u003C/li>\n\u003C/ul>\n\u003C/li>\n\u003Cli>Nach Installation Neustart durchführen.\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"option-3-virtuelle-maschine-vm\">Option 3: Virtuelle Maschine (VM)\u003C/h3>\n\u003Cul>\n\u003Cli>Offizielle VM-Images für VirtualBox und VMware von der \u003Ca href=\"https://www.kali.org/get-kali/#kali-virtual-machines\">Kali-Website\u003C/a>\u003C/li>\n\u003Cli>Importieren, ggf. Netzwerkbrücke und Shared Folders aktivieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"netzwerkeinstellungen\">Netzwerkeinstellungen\u003C/h3>\n\u003Cul>\n\u003Cli>Konfiguration über \u003Ccode>nmtui\u003C/code> oder \u003Ccode>/etc/network/interfaces\u003C/code>\u003C/li>\n\u003Cli>VPN und Proxy-Integration über GUI oder Terminal\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"updates--paketquellen\">Updates & Paketquellen\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> full-upgrade\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cblockquote>\n\u003Cp>Hinweis: \u003Ccode>kali-rolling\u003C/code> ist die Standard-Distribution für kontinuierliche Updates.\u003C/p>\n\u003C/blockquote>\n\u003Ch3 id=\"sprache--lokalisierung\">Sprache & Lokalisierung\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dpkg-reconfigure\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> locales\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> dpkg-reconfigure\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> keyboard-configuration\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"1-netzwerkscan-mit-nmap\">1. Netzwerkscan mit Nmap\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">nmap\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -sS\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -T4\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -A\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 192.168.1.0/24\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"2-passwort-cracking-mit-john-the-ripper\">2. Passwort-Cracking mit John the Ripper\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">john\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --wordlist=/usr/share/wordlists/rockyou.txt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> hashes.txt\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-forensik-mit-autopsy\">3. Forensik mit Autopsy\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">autopsy\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> &\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"4-android-analyse-mit-mobsf-in-docker\">4. Android-Analyse mit MobSF (in Docker)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">docker\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> pull\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> opensecurity/mobile-security-framework-mobsf\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">docker\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> run\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -it\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -p\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 8000:8000\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mobsf\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Nutze immer \u003Cstrong>aktuelle Snapshots\u003C/strong> oder VM-Clones vor gefährlichen Tests\u003C/li>\n\u003Cli>Verwende separate Netzwerke (z. B. Host-only oder NAT) für Tests\u003C/li>\n\u003Cli>Deaktiviere automatisches WLAN bei forensischen Analysen\u003C/li>\n\u003Cli>Prüfe und aktualisiere regelmäßig Toolsets (\u003Ccode>apt\u003C/code>, \u003Ccode>git\u003C/code>, \u003Ccode>pip\u003C/code>)\u003C/li>\n\u003Cli>Halte deine ISO-Images versioniert für forensische Reproduzierbarkeit\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-keine-internetverbindung-nach-installation\">Problem: Keine Internetverbindung nach Installation\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Netzwerkadapter prüfen, ggf. mit \u003Ccode>ifconfig\u003C/code> oder \u003Ccode>ip a\u003C/code> überprüfen, DHCP aktivieren.\u003C/p>\n\u003Ch3 id=\"problem-tools-fehlen-nach-update\">Problem: Tools fehlen nach Update\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Tool-Gruppen wie \u003Ccode>kali-linux-default\u003C/code> manuell nachinstallieren:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> kali-linux-default\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-permission-denied-bei-tools\">Problem: „Permission Denied“ bei Tools\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Root-Rechte nutzen oder mit \u003Ccode>sudo\u003C/code> ausführen.\u003C/p>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Kustomisierung von Kali ISOs\u003C/strong> mit \u003Ccode>live-build\u003C/code>\u003C/li>\n\u003Cli>\u003Cstrong>NetHunter\u003C/strong>: Kali für mobile Geräte (Android)\u003C/li>\n\u003Cli>\u003Cstrong>Kali Purple\u003C/strong>: Defensive Security Suite\u003C/li>\n\u003Cli>Integration mit \u003Cstrong>Cloud-Infrastrukturen\u003C/strong> via WSL oder Azure\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Links & Ressourcen:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Offizielle Website: \u003Ca href=\"https://kali.org/\">https://kali.org\u003C/a>\u003C/li>\n\u003Cli>Dokumentation: \u003Ca href=\"https://docs.kali.org/\">https://docs.kali.org/\u003C/a>\u003C/li>\n\u003Cli>GitLab Repo: \u003Ca href=\"https://gitlab.com/kalilinux\">https://gitlab.com/kalilinux\u003C/a>\u003C/li>\n\u003Cli>Discord-Community: \u003Ca href=\"https://discord.com/invite/kali-linux\">https://discord.com/invite/kali-linux\u003C/a>\u003C/li>\n\u003C/ul>",{"headings":1562,"localImagePaths":1611,"remoteImagePaths":1612,"frontmatter":1613,"imagePaths":1618},[1563,1564,1565,1568,1571,1574,1575,1578,1581,1584,1585,1588,1591,1594,1597,1598,1599,1602,1605,1608],{"depth":44,"slug":1310,"text":1311},{"depth":47,"slug":1319,"text":1320},{"depth":54,"slug":1566,"text":1567},"option-1-live-system-usbdvd","Option 1: Live-System (USB/DVD)",{"depth":54,"slug":1569,"text":1570},"option-2-installation-auf-festplatte","Option 2: Installation auf Festplatte",{"depth":54,"slug":1572,"text":1573},"option-3-virtuelle-maschine-vm","Option 3: Virtuelle Maschine (VM)",{"depth":47,"slug":1352,"text":1353},{"depth":54,"slug":1576,"text":1577},"netzwerkeinstellungen","Netzwerkeinstellungen",{"depth":54,"slug":1579,"text":1580},"updates--paketquellen","Updates & Paketquellen",{"depth":54,"slug":1582,"text":1583},"sprache--lokalisierung","Sprache & Lokalisierung",{"depth":47,"slug":1382,"text":1383},{"depth":54,"slug":1586,"text":1587},"1-netzwerkscan-mit-nmap","1. Netzwerkscan mit Nmap",{"depth":54,"slug":1589,"text":1590},"2-passwort-cracking-mit-john-the-ripper","2. Passwort-Cracking mit John the Ripper",{"depth":54,"slug":1592,"text":1593},"3-forensik-mit-autopsy","3. Forensik mit Autopsy",{"depth":54,"slug":1595,"text":1596},"4-android-analyse-mit-mobsf-in-docker","4. Android-Analyse mit MobSF (in Docker)",{"depth":47,"slug":459,"text":460},{"depth":47,"slug":193,"text":1454},{"depth":54,"slug":1600,"text":1601},"problem-keine-internetverbindung-nach-installation","Problem: Keine Internetverbindung nach Installation",{"depth":54,"slug":1603,"text":1604},"problem-tools-fehlen-nach-update","Problem: Tools fehlen nach Update",{"depth":54,"slug":1606,"text":1607},"problem-permission-denied-bei-tools","Problem: „Permission Denied“ bei Tools",{"depth":47,"slug":1609,"text":1610},"weiterführende-themen","Weiterführende Themen",[],[],{"title":1542,"tool_name":1545,"description":1543,"last_updated":1614,"author":18,"difficulty":189,"categories":1615,"tags":1616,"sections":1617,"review_status":1536},["Date","2025-08-10T00:00:00.000Z"],[697,1548,1549],[1551,1552,1549,1553,1554,1555],{"overview":34,"installation":34,"configuration":34,"usage_examples":34,"best_practices":34,"troubleshooting":34,"advanced_topics":34},[],"tool-kali-linux.md","tool-misp",{"id":1620,"data":1622,"body":1639,"filePath":1640,"digest":1641,"rendered":1642,"legacyId":1689},{"title":1623,"description":1624,"last_updated":1625,"tool_name":1626,"related_tools":1627,"author":18,"difficulty":189,"categories":1628,"tags":1633,"published":34,"gated_content":35},"MISP - Plattform für Threat Intelligence Sharing","Das Rückgrat des modernen Threat-Intelligence-Sharings mit über 40.000 aktiven Instanzen weltweit.",["Date","2025-07-20T00:00:00.000Z"],"MISP",[],[697,1629,1630,1631,1632],"static-investigations","malware-analysis","network-forensics","cloud-forensics",[1634,1635,1636,1637,1638,859],"web-based","threat-intelligence","api","correlation","ioc-sharing","\u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls title=\"Nextcloud Demo\">\u003C/video>\n\u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls title=\"Training Video\">\u003C/video>\n\u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls>\u003C/video>\n\n> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\n**MISP (Malware Information Sharing Platform & Threat Sharing)** ist eine freie Open-Source-Plattform zur strukturierten Erfassung, Speicherung, Analyse und gemeinsamen Nutzung von Cyber-Bedrohungsdaten. Mit über 40.000 Instanzen weltweit ist MISP der De-facto-Standard für den Austausch von Indicators of Compromise (IoCs) und Threat Intelligence zwischen CERTs, SOCs, Strafverfolgungsbehörden und anderen sicherheitsrelevanten Organisationen.\n\nDie föderierte Architektur ermöglicht einen kontrollierten, dezentralen Austausch von Informationen über vertrauenswürdige Partner hinweg. Durch Taxonomien, Tags und integrierte APIs ist eine automatische Anreicherung, Korrelation und Verarbeitung von Informationen in SIEMs, Firewalls oder Endpoint-Lösungen möglich.\n\n## Installation\n\n### Voraussetzungen\n\n- **Server-Betriebssystem:** Linux (empfohlen: Debian/Ubuntu)\n- **Abhängigkeiten:** MariaDB/MySQL, PHP, Apache/Nginx, Redis\n- **Ressourcen:** Mindestens 4 GB RAM, SSD empfohlen\n\n### Installationsschritte\n\n```bash\n# Beispiel für Debian/Ubuntu:\nsudo apt update && sudo apt install -y curl gnupg git python3 python3-pip redis-server mariadb-server apache2 php libapache2-mod-php\n\n# MISP klonen\ngit clone https://github.com/MISP/MISP.git /var/www/MISP\n\n# Setup-Skript nutzen\ncd /var/www/MISP && bash INSTALL/INSTALL.debian.sh\n````\n\nWeitere Details: [Offizielle Installationsanleitung](https://misp.github.io/MISP/INSTALL.debian/)\n\n## Konfiguration\n\n### Webserver\n\n* HTTPS aktivieren (Let's Encrypt oder Reverse Proxy)\n* PHP-Konfiguration anpassen (`upload_max_filesize`, `memory_limit`, `post_max_size`)\n\n### Benutzerrollen\n\n* Administrator, Org-Admin, Analyst etc.\n* Zugriffsbeschränkungen nach Organisation/Feed definierbar\n\n### Feeds und Galaxies\n\n* Aktivierung von Feeds (z. B. CIRCL, Abuse.ch, OpenCTI)\n* Nutzung von Galaxies zur Klassifizierung (APT-Gruppen, Malware-Familien)\n\n## Verwendungsbeispiele\n\n### Beispiel 1: Import von IoCs aus externem Feed\n\n1. Feed aktivieren unter **Administration → List Feeds**\n2. Feed synchronisieren\n3. Ereignisse durchsuchen, analysieren, ggf. mit eigenen Daten korrelieren\n\n### Beispiel 2: Automatisierte Anbindung an SIEM\n\n* REST-API-Token erstellen\n* API-Calls zur Abfrage neuer Events (z. B. mit Python, Logstash oder MISP Workbench)\n* Integration in Security-Systeme über JSON/STIX export\n\n## Best Practices\n\n* Regelmäßige Backups der Datenbank\n* Taxonomien konsistent verwenden\n* Nutzung der Sighting-Funktion zur Validierung von IoCs\n* Vertrauensstufen (TLP, PAP) korrekt setzen\n* Nicht nur konsumieren – auch teilen!\n\n## Troubleshooting\n\n### Problem: MISP-Feeds laden nicht\n\n**Lösung:**\n\n* Internetverbindung prüfen\n* Cronjobs aktiv?\n* Logs prüfen: `/var/www/MISP/app/tmp/logs/error.log`\n\n### Problem: API gibt 403 zurück\n\n**Lösung:**\n\n* Ist der API-Key korrekt und aktiv?\n* Rechte des Benutzers überprüfen\n* IP-Filter im MISP-Backend beachten\n\n### Problem: Hohe Datenbanklast\n\n**Lösung:**\n\n* Indizes optimieren\n* Redis aktivieren\n* Alte Events regelmäßig archivieren oder löschen\n\n## Weiterführende Themen\n\n* STIX2-Import/Export\n* Erweiterungen mit MISP Modules (z. B. für Virustotal, YARA)\n* Föderierte Netzwerke und Community-Portale\n* Integration mit OpenCTI oder TheHive\n\n---\n\n**Links:**\n\n* 🌐 [Offizielle Projektseite](https://misp-project.org/)\n* 📦 [CC24-MISP-Instanz](https://misp.cc24.dev)\n* 📊 [Status-Monitoring](https://status.mikoshi.de/api/badge/34/status)\n\nLizenz: **AGPL-3.0**","src/content/knowledgebase/tool-misp.md","edd8828fced9aa3a",{"html":1643,"metadata":1644},"\u003Cp>\u003C/p>\u003Cdiv class=\"video-container aspect-16:9\">\n \u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls style=\"width: 100%; height: 100%;\" data-video-title=\"Nextcloud Demo\">\n \u003Cp>Your browser does not support the video element.\u003C/p>\n \u003C/video>\n \u003Cdiv class=\"video-metadata\">\n \u003Cdiv class=\"video-title\">Nextcloud Demo\u003C/div>\n \u003C/div>\n \u003C/div>\n\u003Cdiv class=\"video-container aspect-16:9\">\n \u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls style=\"width: 100%; height: 100%;\" data-video-title=\"Training Video\">\n \u003Cp>Your browser does not support the video element.\u003C/p>\n \u003C/video>\n \u003Cdiv class=\"video-metadata\">\n \u003Cdiv class=\"video-title\">Training Video\u003C/div>\n \u003C/div>\n \u003C/div>\n\u003Cdiv class=\"video-container aspect-16:9\">\n \u003Cvideo src=\"https://cloud.cc24.dev/s/HdRwZXJ8NL6CT2q/download\" controls style=\"width: 100%; height: 100%;\" data-video-title=\"Video\">\n \u003Cp>Your browser does not support the video element.\u003C/p>\n \u003C/video>\n \u003Cdiv class=\"video-metadata\">\n \u003Cdiv class=\"video-title\">Video\u003C/div>\n \u003C/div>\n \u003C/div>\u003Cp>\u003C/p>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>\u003Cstrong>MISP (Malware Information Sharing Platform & Threat Sharing)\u003C/strong> ist eine freie Open-Source-Plattform zur strukturierten Erfassung, Speicherung, Analyse und gemeinsamen Nutzung von Cyber-Bedrohungsdaten. Mit über 40.000 Instanzen weltweit ist MISP der De-facto-Standard für den Austausch von Indicators of Compromise (IoCs) und Threat Intelligence zwischen CERTs, SOCs, Strafverfolgungsbehörden und anderen sicherheitsrelevanten Organisationen.\u003C/p>\n\u003Cp>Die föderierte Architektur ermöglicht einen kontrollierten, dezentralen Austausch von Informationen über vertrauenswürdige Partner hinweg. Durch Taxonomien, Tags und integrierte APIs ist eine automatische Anreicherung, Korrelation und Verarbeitung von Informationen in SIEMs, Firewalls oder Endpoint-Lösungen möglich.\u003C/p>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Server-Betriebssystem:\u003C/strong> Linux (empfohlen: Debian/Ubuntu)\u003C/li>\n\u003Cli>\u003Cstrong>Abhängigkeiten:\u003C/strong> MariaDB/MySQL, PHP, Apache/Nginx, Redis\u003C/li>\n\u003Cli>\u003Cstrong>Ressourcen:\u003C/strong> Mindestens 4 GB RAM, SSD empfohlen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installationsschritte\">Installationsschritte\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Beispiel für Debian/Ubuntu:\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -y\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> curl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> gnupg\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> python3\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> python3-pip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> redis-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mariadb-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apache2\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> libapache2-mod-php\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># MISP klonen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> clone\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/MISP/MISP.git\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/MISP\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#6A737D\"># Setup-Skript nutzen\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\">cd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/MISP\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">bash\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> INSTALL/INSTALL.debian.sh\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Weitere Details: \u003Ca href=\"https://misp.github.io/MISP/INSTALL.debian/\">Offizielle Installationsanleitung\u003C/a>\u003C/p>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"webserver\">Webserver\u003C/h3>\n\u003Cul>\n\u003Cli>HTTPS aktivieren (Let’s Encrypt oder Reverse Proxy)\u003C/li>\n\u003Cli>PHP-Konfiguration anpassen (\u003Ccode>upload_max_filesize\u003C/code>, \u003Ccode>memory_limit\u003C/code>, \u003Ccode>post_max_size\u003C/code>)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"benutzerrollen\">Benutzerrollen\u003C/h3>\n\u003Cul>\n\u003Cli>Administrator, Org-Admin, Analyst etc.\u003C/li>\n\u003Cli>Zugriffsbeschränkungen nach Organisation/Feed definierbar\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"feeds-und-galaxies\">Feeds und Galaxies\u003C/h3>\n\u003Cul>\n\u003Cli>Aktivierung von Feeds (z. B. CIRCL, Abuse.ch, OpenCTI)\u003C/li>\n\u003Cli>Nutzung von Galaxies zur Klassifizierung (APT-Gruppen, Malware-Familien)\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"beispiel-1-import-von-iocs-aus-externem-feed\">Beispiel 1: Import von IoCs aus externem Feed\u003C/h3>\n\u003Col>\n\u003Cli>Feed aktivieren unter \u003Cstrong>Administration → List Feeds\u003C/strong>\u003C/li>\n\u003Cli>Feed synchronisieren\u003C/li>\n\u003Cli>Ereignisse durchsuchen, analysieren, ggf. mit eigenen Daten korrelieren\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"beispiel-2-automatisierte-anbindung-an-siem\">Beispiel 2: Automatisierte Anbindung an SIEM\u003C/h3>\n\u003Cul>\n\u003Cli>REST-API-Token erstellen\u003C/li>\n\u003Cli>API-Calls zur Abfrage neuer Events (z. B. mit Python, Logstash oder MISP Workbench)\u003C/li>\n\u003Cli>Integration in Security-Systeme über JSON/STIX export\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Regelmäßige Backups der Datenbank\u003C/li>\n\u003Cli>Taxonomien konsistent verwenden\u003C/li>\n\u003Cli>Nutzung der Sighting-Funktion zur Validierung von IoCs\u003C/li>\n\u003Cli>Vertrauensstufen (TLP, PAP) korrekt setzen\u003C/li>\n\u003Cli>Nicht nur konsumieren – auch teilen!\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-misp-feeds-laden-nicht\">Problem: MISP-Feeds laden nicht\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Internetverbindung prüfen\u003C/li>\n\u003Cli>Cronjobs aktiv?\u003C/li>\n\u003Cli>Logs prüfen: \u003Ccode>/var/www/MISP/app/tmp/logs/error.log\u003C/code>\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-api-gibt-403-zurück\">Problem: API gibt 403 zurück\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Ist der API-Key korrekt und aktiv?\u003C/li>\n\u003Cli>Rechte des Benutzers überprüfen\u003C/li>\n\u003Cli>IP-Filter im MISP-Backend beachten\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-hohe-datenbanklast\">Problem: Hohe Datenbanklast\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Indizes optimieren\u003C/li>\n\u003Cli>Redis aktivieren\u003C/li>\n\u003Cli>Alte Events regelmäßig archivieren oder löschen\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>STIX2-Import/Export\u003C/li>\n\u003Cli>Erweiterungen mit MISP Modules (z. B. für Virustotal, YARA)\u003C/li>\n\u003Cli>Föderierte Netzwerke und Community-Portale\u003C/li>\n\u003Cli>Integration mit OpenCTI oder TheHive\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>\u003Cstrong>Links:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>🌐 \u003Ca href=\"https://misp-project.org/\">Offizielle Projektseite\u003C/a>\u003C/li>\n\u003Cli>📦 \u003Ca href=\"https://misp.cc24.dev\">CC24-MISP-Instanz\u003C/a>\u003C/li>\n\u003Cli>📊 \u003Ca href=\"https://status.mikoshi.de/api/badge/34/status\">Status-Monitoring\u003C/a>\u003C/li>\n\u003C/ul>\n\u003Cp>Lizenz: \u003Cstrong>AGPL-3.0\u003C/strong>\u003C/p>",{"headings":1645,"localImagePaths":1681,"remoteImagePaths":1682,"frontmatter":1683,"imagePaths":1688},[1646,1647,1648,1649,1652,1653,1656,1659,1662,1663,1666,1669,1670,1671,1674,1677,1680],{"depth":44,"slug":1310,"text":1311},{"depth":47,"slug":1319,"text":1320},{"depth":54,"slug":712,"text":713},{"depth":54,"slug":1650,"text":1651},"installationsschritte","Installationsschritte",{"depth":47,"slug":1352,"text":1353},{"depth":54,"slug":1654,"text":1655},"webserver","Webserver",{"depth":54,"slug":1657,"text":1658},"benutzerrollen","Benutzerrollen",{"depth":54,"slug":1660,"text":1661},"feeds-und-galaxies","Feeds und Galaxies",{"depth":47,"slug":1382,"text":1383},{"depth":54,"slug":1664,"text":1665},"beispiel-1-import-von-iocs-aus-externem-feed","Beispiel 1: Import von IoCs aus externem Feed",{"depth":54,"slug":1667,"text":1668},"beispiel-2-automatisierte-anbindung-an-siem","Beispiel 2: Automatisierte Anbindung an SIEM",{"depth":47,"slug":459,"text":460},{"depth":47,"slug":193,"text":1454},{"depth":54,"slug":1672,"text":1673},"problem-misp-feeds-laden-nicht","Problem: MISP-Feeds laden nicht",{"depth":54,"slug":1675,"text":1676},"problem-api-gibt-403-zurück","Problem: API gibt 403 zurück",{"depth":54,"slug":1678,"text":1679},"problem-hohe-datenbanklast","Problem: Hohe Datenbanklast",{"depth":47,"slug":1609,"text":1610},[],[],{"title":1623,"tool_name":1626,"description":1624,"last_updated":1684,"author":18,"difficulty":189,"categories":1685,"tags":1686,"sections":1687,"review_status":1536},["Date","2025-07-20T00:00:00.000Z"],[697,1629,1630,1631,1632],[1634,1635,1636,1637,1638,859],{"overview":34,"installation":34,"configuration":34,"usage_examples":34,"best_practices":34,"troubleshooting":34,"advanced_topics":35},[],"tool-misp.md","tool-velociraptor",{"id":1690,"data":1692,"body":1705,"filePath":1706,"digest":1707,"rendered":1708,"legacyId":1758},{"title":1693,"description":1694,"last_updated":1695,"tool_name":1696,"related_tools":1697,"author":18,"difficulty":19,"categories":1698,"tags":1699,"published":34,"gated_content":34},"Velociraptor – Skalierbare Endpoint-Forensik mit VQL","Detaillierte Anleitung und Best Practices für Velociraptor – Remote-Forensik der nächsten Generation",["Date","2025-07-20T00:00:00.000Z"],"Velociraptor",[],[697,1630,1631],[1634,1700,1701,1702,1703,1704],"endpoint-monitoring","artifact-extraction","scripting","live-forensics","hunting","> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nVelociraptor ist ein Open-Source-Tool zur Endpoint-Forensik mit Fokus auf Skalierbarkeit, Präzision und Geschwindigkeit. Es ermöglicht die zielgerichtete Erfassung und Analyse digitaler Artefakte über eine eigene Query Language – VQL (Velociraptor Query Language). Die Architektur erlaubt remote Zugriff auf tausende Endpoints gleichzeitig, ohne dass vollständige Disk-Images erforderlich sind.\n\n## Hauptmerkmale\n\n- 🌐 Web-basierte Benutzeroberfläche\n- 💡 VQL – mächtige, SQL-ähnliche Abfragesprache\n- 🚀 Hochskalierbare Hunt-Funktionalität\n- 🔍 Artefaktbasierte Sammlung (ohne Full-Image)\n- 🖥️ Plattformunterstützung für Windows, macOS, Linux\n- 📦 Apache 2.0 Lizenz – Open Source\n\nWeitere Infos: [velociraptor.app](https://www.velociraptor.app/) \nProjektspiegel: [raptor.cc24.dev](https://raptor.cc24.dev) \nStatus: ![Status](https://status.mikoshi.de/api/badge/33/status)\n\n---\n\n## Installation\n\n### Voraussetzungen\n\n- Python ≥ 3.9\n- Adminrechte auf dem System\n- Firewall-Freigaben für Webport (Standard: 8000)\n\n### Installation unter Linux/macOS\n\n```bash\nwget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor\nchmod +x velociraptor\nsudo mv velociraptor /usr/local/bin/\n````\n\n### Installation unter Windows\n\n1. Download der `.exe` von der [Release-Seite](https://github.com/Velocidex/velociraptor/releases)\n2. Ausführung in PowerShell mit Adminrechten:\n\n ```powershell\n .\\velociraptor.exe config generate > server.config.yaml\n ```\n\n---\n\n## Konfiguration\n\n### Server Setup\n\n1. Generiere die Konfigurationsdatei:\n\n ```bash\n velociraptor config generate > server.config.yaml\n ```\n2. Starte den Server:\n\n ```bash\n velociraptor --config server.config.yaml frontend\n ```\n3. Zugriff über Browser via `https://\u003Chostname>:8000`\n\n### Client Deployment\n\n* MSI/EXE für Windows, oder `deb/rpm` für Linux\n* Unterstützt automatische Registrierung am Server\n* Deployment über GPO, Puppet, Ansible etc. möglich\n\n---\n\n## Verwendungsbeispiele\n\n### 1. Live-Memory-Artefakte sammeln\n\n```vql\nSELECT * FROM Artifact.MemoryInfo()\n```\n\n### 2. Hunt starten auf verdächtige Prozesse\n\n```vql\nSELECT * FROM pslist()\nWHERE Name =~ \"mimikatz|cobaltstrike\"\n```\n\n### 3. Dateiinhalt extrahieren\n\n```vql\nSELECT * FROM glob(globs=\"C:\\\\Users\\\\*\\\\AppData\\\\*.dat\")\n```\n\n---\n\n## Best Practices\n\n* Erstelle eigene Artefakte für unternehmensspezifische Bedrohungsmodelle\n* Verwende \"Notebook\"-Funktion für strukturierte Analysen\n* Nutze \"Labels\", um Endpoints zu organisieren (z. B. `location:Berlin`)\n* Kombiniere Velociraptor mit SIEM/EDR-Systemen über REST API\n\n---\n\n## Troubleshooting\n\n### Problem: Keine Verbindung vom Client zum Server\n\n**Lösung:**\n\n* Ports freigegeben? (Default: 8000/tcp)\n* TLS-Zertifikate korrekt generiert?\n* `server.config.yaml` auf korrekte `public_ip` prüfen\n\n### Problem: Hunt hängt in Warteschleife\n\n**Lösung:**\n\n* Genügend Worker-Prozesse aktiv?\n* Endpoint online?\n* `log_level` auf `debug` setzen und Log analysieren\n\n---\n\n## Weiterführende Themen\n\n* Eigene Artefakte schreiben mit VQL\n* Integration mit ELK Stack\n* Automatisiertes Incident Response Playbook\n* Velociraptor als IR-as-a-Service einsetzen\n\n---\n\n🧠 **Tipp:** Die Lernkurve bei VQL ist steil – aber mit hohem ROI. Testumgebung aufsetzen und mit Community-Artefakten starten.\n\n📚 Weitere Ressourcen:\n\n* [Offizielle Doku](https://docs.velociraptor.app/)\n* [YouTube Channel](https://www.youtube.com/c/VelociraptorDFIR)\n* [Community auf Discord](https://www.velociraptor.app/community/)","src/content/knowledgebase/tool-velociraptor.md","aaeaefab11b85e48",{"html":1709,"metadata":1710},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Velociraptor ist ein Open-Source-Tool zur Endpoint-Forensik mit Fokus auf Skalierbarkeit, Präzision und Geschwindigkeit. Es ermöglicht die zielgerichtete Erfassung und Analyse digitaler Artefakte über eine eigene Query Language – VQL (Velociraptor Query Language). Die Architektur erlaubt remote Zugriff auf tausende Endpoints gleichzeitig, ohne dass vollständige Disk-Images erforderlich sind.\u003C/p>\n\u003Ch2 id=\"hauptmerkmale\">Hauptmerkmale\u003C/h2>\n\u003Cul>\n\u003Cli>🌐 Web-basierte Benutzeroberfläche\u003C/li>\n\u003Cli>💡 VQL – mächtige, SQL-ähnliche Abfragesprache\u003C/li>\n\u003Cli>🚀 Hochskalierbare Hunt-Funktionalität\u003C/li>\n\u003Cli>🔍 Artefaktbasierte Sammlung (ohne Full-Image)\u003C/li>\n\u003Cli>🖥️ Plattformunterstützung für Windows, macOS, Linux\u003C/li>\n\u003Cli>📦 Apache 2.0 Lizenz – Open Source\u003C/li>\n\u003C/ul>\n\u003Cp>Weitere Infos: \u003Ca href=\"https://www.velociraptor.app/\">velociraptor.app\u003C/a>\u003Cbr>\nProjektspiegel: \u003Ca href=\"https://raptor.cc24.dev\">raptor.cc24.dev\u003C/a>\u003Cbr>\nStatus: \u003Cimg src=\"https://status.mikoshi.de/api/badge/33/status\" alt=\"Status\">\u003C/p>\n\u003Chr>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>Python ≥ 3.9\u003C/li>\n\u003Cli>Adminrechte auf dem System\u003C/li>\n\u003Cli>Firewall-Freigaben für Webport (Standard: 8000)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installation-unter-linuxmacos\">Installation unter Linux/macOS\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">chmod\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> +x\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> velociraptor\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mv\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> velociraptor\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /usr/local/bin/\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"installation-unter-windows\">Installation unter Windows\u003C/h3>\n\u003Col>\n\u003Cli>\n\u003Cp>Download der \u003Ccode>.exe\u003C/code> von der \u003Ca href=\"https://github.com/Velocidex/velociraptor/releases\">Release-Seite\u003C/a>\u003C/p>\n\u003C/li>\n\u003Cli>\n\u003Cp>Ausführung in PowerShell mit Adminrechten:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"powershell\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\">.\\\u003C/span>\u003Cspan style=\"color:#79B8FF\">velociraptor.exe\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> config generate \u003C/span>\u003Cspan style=\"color:#F97583\">>\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> server.config.yaml\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003C/ol>\n\u003Chr>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Ch3 id=\"server-setup\">Server Setup\u003C/h3>\n\u003Col>\n\u003Cli>\n\u003Cp>Generiere die Konfigurationsdatei:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">velociraptor\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> config\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> generate\u003C/span>\u003Cspan style=\"color:#F97583\"> >\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> server.config.yaml\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>Starte den Server:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">velociraptor\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --config\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> server.config.yaml\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> frontend\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003C/li>\n\u003Cli>\n\u003Cp>Zugriff über Browser via \u003Ccode>https://<hostname>:8000\u003C/code>\u003C/p>\n\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"client-deployment\">Client Deployment\u003C/h3>\n\u003Cul>\n\u003Cli>MSI/EXE für Windows, oder \u003Ccode>deb/rpm\u003C/code> für Linux\u003C/li>\n\u003Cli>Unterstützt automatische Registrierung am Server\u003C/li>\n\u003Cli>Deployment über GPO, Puppet, Ansible etc. möglich\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"1-live-memory-artefakte-sammeln\">1. Live-Memory-Artefakte sammeln\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM Artifact.MemoryInfo()\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"2-hunt-starten-auf-verdächtige-prozesse\">2. Hunt starten auf verdächtige Prozesse\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM pslist()\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan>WHERE Name =~ \"mimikatz|cobaltstrike\"\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"3-dateiinhalt-extrahieren\">3. Dateiinhalt extrahieren\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"plaintext\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan>SELECT * FROM glob(globs=\"C:\\\\Users\\\\*\\\\AppData\\\\*.dat\")\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Chr>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Erstelle eigene Artefakte für unternehmensspezifische Bedrohungsmodelle\u003C/li>\n\u003Cli>Verwende “Notebook”-Funktion für strukturierte Analysen\u003C/li>\n\u003Cli>Nutze “Labels”, um Endpoints zu organisieren (z. B. \u003Ccode>location:Berlin\u003C/code>)\u003C/li>\n\u003Cli>Kombiniere Velociraptor mit SIEM/EDR-Systemen über REST API\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-keine-verbindung-vom-client-zum-server\">Problem: Keine Verbindung vom Client zum Server\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Ports freigegeben? (Default: 8000/tcp)\u003C/li>\n\u003Cli>TLS-Zertifikate korrekt generiert?\u003C/li>\n\u003Cli>\u003Ccode>server.config.yaml\u003C/code> auf korrekte \u003Ccode>public_ip\u003C/code> prüfen\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"problem-hunt-hängt-in-warteschleife\">Problem: Hunt hängt in Warteschleife\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong>\u003C/p>\n\u003Cul>\n\u003Cli>Genügend Worker-Prozesse aktiv?\u003C/li>\n\u003Cli>Endpoint online?\u003C/li>\n\u003Cli>\u003Ccode>log_level\u003C/code> auf \u003Ccode>debug\u003C/code> setzen und Log analysieren\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>Eigene Artefakte schreiben mit VQL\u003C/li>\n\u003Cli>Integration mit ELK Stack\u003C/li>\n\u003Cli>Automatisiertes Incident Response Playbook\u003C/li>\n\u003Cli>Velociraptor als IR-as-a-Service einsetzen\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Cp>🧠 \u003Cstrong>Tipp:\u003C/strong> Die Lernkurve bei VQL ist steil – aber mit hohem ROI. Testumgebung aufsetzen und mit Community-Artefakten starten.\u003C/p>\n\u003Cp>📚 Weitere Ressourcen:\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://docs.velociraptor.app/\">Offizielle Doku\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.youtube.com/c/VelociraptorDFIR\">YouTube Channel\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://www.velociraptor.app/community/\">Community auf Discord\u003C/a>\u003C/li>\n\u003C/ul>",{"headings":1711,"localImagePaths":1750,"remoteImagePaths":1751,"frontmatter":1752,"imagePaths":1757},[1712,1713,1716,1717,1718,1721,1724,1725,1728,1731,1732,1735,1738,1741,1742,1743,1746,1749],{"depth":44,"slug":1310,"text":1311},{"depth":47,"slug":1714,"text":1715},"hauptmerkmale","Hauptmerkmale",{"depth":47,"slug":1319,"text":1320},{"depth":54,"slug":712,"text":713},{"depth":54,"slug":1719,"text":1720},"installation-unter-linuxmacos","Installation unter Linux/macOS",{"depth":54,"slug":1722,"text":1723},"installation-unter-windows","Installation unter Windows",{"depth":47,"slug":1352,"text":1353},{"depth":54,"slug":1726,"text":1727},"server-setup","Server Setup",{"depth":54,"slug":1729,"text":1730},"client-deployment","Client Deployment",{"depth":47,"slug":1382,"text":1383},{"depth":54,"slug":1733,"text":1734},"1-live-memory-artefakte-sammeln","1. Live-Memory-Artefakte sammeln",{"depth":54,"slug":1736,"text":1737},"2-hunt-starten-auf-verdächtige-prozesse","2. Hunt starten auf verdächtige Prozesse",{"depth":54,"slug":1739,"text":1740},"3-dateiinhalt-extrahieren","3. Dateiinhalt extrahieren",{"depth":47,"slug":459,"text":460},{"depth":47,"slug":193,"text":1454},{"depth":54,"slug":1744,"text":1745},"problem-keine-verbindung-vom-client-zum-server","Problem: Keine Verbindung vom Client zum Server",{"depth":54,"slug":1747,"text":1748},"problem-hunt-hängt-in-warteschleife","Problem: Hunt hängt in Warteschleife",{"depth":47,"slug":1609,"text":1610},[],[],{"title":1693,"tool_name":1696,"description":1694,"last_updated":1753,"author":18,"difficulty":19,"categories":1754,"gated_content":34,"tags":1755,"sections":1756,"review_status":1536},["Date","2025-07-20T00:00:00.000Z"],[697,1630,1631],[1634,1700,1701,1702,1703,1704],{"overview":34,"installation":34,"configuration":34,"usage_examples":34,"best_practices":34,"troubleshooting":34,"advanced_topics":34},[],"tool-velociraptor.md","tool-nextcloud",{"id":1759,"data":1761,"body":1775,"filePath":1776,"digest":1777,"rendered":1778,"legacyId":1819},{"title":1762,"description":1763,"last_updated":1764,"tool_name":1765,"related_tools":1766,"author":18,"difficulty":1767,"categories":1768,"tags":1770,"published":34,"gated_content":35},"Nextcloud - Sichere Kollaborationsplattform","Detaillierte Anleitung und Best Practices für Nextcloud in forensischen Einsatzszenarien",["Date","2025-07-20T00:00:00.000Z"],"Nextcloud",[],"novice",[1769],"collaboration-general",[1634,1771,1772,1636,1773,1774],"collaboration","file-sharing","encryption","document-management","> **⚠️ Hinweis**: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\n\n\n# Übersicht\n\nNextcloud ist eine Open-Source-Cloud-Suite, die speziell für die sichere Zusammenarbeit entwickelt wurde. Sie eignet sich ideal für forensische Teams, da sie eine DSGVO-konforme Umgebung mit verschlüsselter Dateiablage, Office-Integration und Videokonferenzen bereitstellt. Zusätzlich bietet Nextcloud einen integrierten SSO-Provider, der das Identitätsmanagement für andere forensische Tools stark vereinfacht.\n\nSkalierbar von kleinen Raspberry-Pi-Installationen bis hin zu hochverfügbaren Multi-Node-Setups.\n\n- **Website:** [nextcloud.com](https://nextcloud.com/)\n- **Demo/Projektinstanz:** [cloud.cc24.dev](https://cloud.cc24.dev)\n- **Statusseite:** [Mikoshi Status](https://status.mikoshi.de/api/badge/11/status)\n- **Lizenz:** AGPL-3.0\n\n---\n\n## Installation\n\n### Voraussetzungen\n\n- Linux-Server oder Raspberry Pi\n- PHP 8.1 oder höher\n- MariaDB/PostgreSQL\n- Webserver (Apache/Nginx)\n- SSL-Zertifikat (empfohlen: Let's Encrypt)\n\n### Installationsschritte (Ubuntu Beispiel)\n\n```bash\nsudo apt update && sudo apt upgrade\nsudo apt install apache2 mariadb-server libapache2-mod-php php php-mysql \\\n php-gd php-xml php-mbstring php-curl php-zip php-intl php-bcmath unzip\n\nwget https://download.nextcloud.com/server/releases/latest.zip\nunzip latest.zip -d /var/www/\nchown -R www-data:www-data /var/www/nextcloud\n````\n\nDanach den Web-Installer im Browser aufrufen (`https://\u003Cyour-domain>/nextcloud`) und Setup abschließen.\n\n## Konfiguration\n\n* **Trusted Domains** in `config.php` definieren\n* SSO mit OpenID Connect aktivieren\n* Dateiverschlüsselung aktivieren (`Settings → Security`)\n* Benutzer und Gruppen über LDAP oder SAML integrieren\n\n## Verwendungsbeispiele\n\n### Gemeinsame Fallbearbeitung\n\n1. Ermittlungsordner als geteiltes Gruppenverzeichnis anlegen\n2. Versionierung und Kommentare zu forensischen Berichten aktivieren\n3. Vorschau für Office-Dateien, PDFs und Bilder direkt im Browser nutzen\n\n### Videokonferenzen mit \"Nextcloud Talk\"\n\n* Sichere Kommunikation zwischen Ermittlern und Sachverständigen\n* Ende-zu-Ende-verschlüsselt\n* Bildschirmfreigabe möglich\n\n### Automatischer Dateiimport per API\n\n* REST-Schnittstelle nutzen, um z. B. automatisch Logdateien oder Exportdaten hochzuladen\n* Ideal für Anbindung an SIEM, DLP oder Analyse-Pipelines\n\n## Best Practices\n\n* Zwei-Faktor-Authentifizierung aktivieren\n* Tägliche Backups der Datenbank und Datenstruktur\n* Nutzung von OnlyOffice oder Collabora für revisionssichere Dokumentenbearbeitung\n* Zugriff regelmäßig überprüfen, insbesondere bei externen Partnern\n\n## Troubleshooting\n\n### Problem: Langsame Performance\n\n**Lösung:** APCu aktivieren und Caching optimieren (`config.php → 'memcache.local'`).\n\n### Problem: Dateien erscheinen nicht im Sync\n\n**Lösung:** Cronjob für `files:scan` konfigurieren oder manuell ausführen:\n\n```bash\nsudo -u www-data php /var/www/nextcloud/occ files:scan --all\n```\n\n### Problem: Fehlermeldung \"Trusted domain not set\"\n\n**Lösung:** In `config/config.php` Eintrag `trusted_domains` korrekt konfigurieren:\n\n```php\n'trusted_domains' =>\n array (\n 0 => 'yourdomain.tld',\n 1 => 'cloud.cc24.dev',\n ),\n```\n\n## Weiterführende Themen\n\n* **Integration mit Forensik-Plattformen** (über WebDAV, API oder SSO)\n* **Custom Apps entwickeln** für spezielle Ermittlungs-Workflows\n* **Auditing aktivieren**: Nutzung und Änderungen nachvollziehen mit Protokollierungsfunktionen","src/content/knowledgebase/tool-nextcloud.md","036ee34add1eec9b",{"html":1779,"metadata":1780},"\u003Cblockquote>\n\u003Cp>\u003Cstrong>⚠️ Hinweis\u003C/strong>: Dies ist ein vorläufiger, KI-generierter Knowledgebase-Eintrag. Wir freuen uns über Verbesserungen und Ergänzungen durch die Community!\u003C/p>\n\u003C/blockquote>\n\u003Ch1 id=\"übersicht\">Übersicht\u003C/h1>\n\u003Cp>Nextcloud ist eine Open-Source-Cloud-Suite, die speziell für die sichere Zusammenarbeit entwickelt wurde. Sie eignet sich ideal für forensische Teams, da sie eine DSGVO-konforme Umgebung mit verschlüsselter Dateiablage, Office-Integration und Videokonferenzen bereitstellt. Zusätzlich bietet Nextcloud einen integrierten SSO-Provider, der das Identitätsmanagement für andere forensische Tools stark vereinfacht.\u003C/p>\n\u003Cp>Skalierbar von kleinen Raspberry-Pi-Installationen bis hin zu hochverfügbaren Multi-Node-Setups.\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>Website:\u003C/strong> \u003Ca href=\"https://nextcloud.com/\">nextcloud.com\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Demo/Projektinstanz:\u003C/strong> \u003Ca href=\"https://cloud.cc24.dev\">cloud.cc24.dev\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Statusseite:\u003C/strong> \u003Ca href=\"https://status.mikoshi.de/api/badge/11/status\">Mikoshi Status\u003C/a>\u003C/li>\n\u003Cli>\u003Cstrong>Lizenz:\u003C/strong> AGPL-3.0\u003C/li>\n\u003C/ul>\n\u003Chr>\n\u003Ch2 id=\"installation\">Installation\u003C/h2>\n\u003Ch3 id=\"voraussetzungen\">Voraussetzungen\u003C/h3>\n\u003Cul>\n\u003Cli>Linux-Server oder Raspberry Pi\u003C/li>\n\u003Cli>PHP 8.1 oder höher\u003C/li>\n\u003Cli>MariaDB/PostgreSQL\u003C/li>\n\u003Cli>Webserver (Apache/Nginx)\u003C/li>\n\u003Cli>SSL-Zertifikat (empfohlen: Let’s Encrypt)\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"installationsschritte-ubuntu-beispiel\">Installationsschritte (Ubuntu Beispiel)\u003C/h3>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> update\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> && \u003C/span>\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> upgrade\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apt\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> install\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> apache2\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> mariadb-server\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> libapache2-mod-php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-mysql\u003C/span>\u003Cspan style=\"color:#79B8FF\"> \\\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\"> php-gd\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-xml\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-mbstring\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-curl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-zip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-intl\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php-bcmath\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> unzip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">wget\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> https://download.nextcloud.com/server/releases/latest.zip\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">unzip\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> latest.zip\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -d\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">chown\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -R\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> www-data:www-data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/nextcloud\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Cp>Danach den Web-Installer im Browser aufrufen (\u003Ccode>https://<your-domain>/nextcloud\u003C/code>) und Setup abschließen.\u003C/p>\n\u003Ch2 id=\"konfiguration\">Konfiguration\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Trusted Domains\u003C/strong> in \u003Ccode>config.php\u003C/code> definieren\u003C/li>\n\u003Cli>SSO mit OpenID Connect aktivieren\u003C/li>\n\u003Cli>Dateiverschlüsselung aktivieren (\u003Ccode>Settings → Security\u003C/code>)\u003C/li>\n\u003Cli>Benutzer und Gruppen über LDAP oder SAML integrieren\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"verwendungsbeispiele\">Verwendungsbeispiele\u003C/h2>\n\u003Ch3 id=\"gemeinsame-fallbearbeitung\">Gemeinsame Fallbearbeitung\u003C/h3>\n\u003Col>\n\u003Cli>Ermittlungsordner als geteiltes Gruppenverzeichnis anlegen\u003C/li>\n\u003Cli>Versionierung und Kommentare zu forensischen Berichten aktivieren\u003C/li>\n\u003Cli>Vorschau für Office-Dateien, PDFs und Bilder direkt im Browser nutzen\u003C/li>\n\u003C/ol>\n\u003Ch3 id=\"videokonferenzen-mit-nextcloud-talk\">Videokonferenzen mit “Nextcloud Talk”\u003C/h3>\n\u003Cul>\n\u003Cli>Sichere Kommunikation zwischen Ermittlern und Sachverständigen\u003C/li>\n\u003Cli>Ende-zu-Ende-verschlüsselt\u003C/li>\n\u003Cli>Bildschirmfreigabe möglich\u003C/li>\n\u003C/ul>\n\u003Ch3 id=\"automatischer-dateiimport-per-api\">Automatischer Dateiimport per API\u003C/h3>\n\u003Cul>\n\u003Cli>REST-Schnittstelle nutzen, um z. B. automatisch Logdateien oder Exportdaten hochzuladen\u003C/li>\n\u003Cli>Ideal für Anbindung an SIEM, DLP oder Analyse-Pipelines\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"best-practices\">Best Practices\u003C/h2>\n\u003Cul>\n\u003Cli>Zwei-Faktor-Authentifizierung aktivieren\u003C/li>\n\u003Cli>Tägliche Backups der Datenbank und Datenstruktur\u003C/li>\n\u003Cli>Nutzung von OnlyOffice oder Collabora für revisionssichere Dokumentenbearbeitung\u003C/li>\n\u003Cli>Zugriff regelmäßig überprüfen, insbesondere bei externen Partnern\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"troubleshooting\">Troubleshooting\u003C/h2>\n\u003Ch3 id=\"problem-langsame-performance\">Problem: Langsame Performance\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> APCu aktivieren und Caching optimieren (\u003Ccode>config.php → 'memcache.local'\u003C/code>).\u003C/p>\n\u003Ch3 id=\"problem-dateien-erscheinen-nicht-im-sync\">Problem: Dateien erscheinen nicht im Sync\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> Cronjob für \u003Ccode>files:scan\u003C/code> konfigurieren oder manuell ausführen:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"bash\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#B392F0\">sudo\u003C/span>\u003Cspan style=\"color:#79B8FF\"> -u\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> www-data\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> php\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> /var/www/nextcloud/occ\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> files:scan\u003C/span>\u003Cspan style=\"color:#79B8FF\"> --all\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch3 id=\"problem-fehlermeldung-trusted-domain-not-set\">Problem: Fehlermeldung “Trusted domain not set”\u003C/h3>\n\u003Cp>\u003Cstrong>Lösung:\u003C/strong> In \u003Ccode>config/config.php\u003C/code> Eintrag \u003Ccode>trusted_domains\u003C/code> korrekt konfigurieren:\u003C/p>\n\u003Cpre class=\"astro-code github-dark\" style=\"background-color:#24292e;color:#e1e4e8; overflow-x: auto;\" tabindex=\"0\" data-language=\"php\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:#9ECBFF\">'trusted_domains'\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> array\u003C/span>\u003Cspan style=\"color:#E1E4E8\"> (\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> 0\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'yourdomain.tld'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#79B8FF\"> 1\u003C/span>\u003Cspan style=\"color:#F97583\"> =>\u003C/span>\u003Cspan style=\"color:#9ECBFF\"> 'cloud.cc24.dev'\u003C/span>\u003Cspan style=\"color:#E1E4E8\">,\u003C/span>\u003C/span>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:#E1E4E8\"> ),\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\n\u003Ch2 id=\"weiterführende-themen\">Weiterführende Themen\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Integration mit Forensik-Plattformen\u003C/strong> (über WebDAV, API oder SSO)\u003C/li>\n\u003Cli>\u003Cstrong>Custom Apps entwickeln\u003C/strong> für spezielle Ermittlungs-Workflows\u003C/li>\n\u003Cli>\u003Cstrong>Auditing aktivieren\u003C/strong>: Nutzung und Änderungen nachvollziehen mit Protokollierungsfunktionen\u003C/li>\n\u003C/ul>",{"headings":1781,"localImagePaths":1811,"remoteImagePaths":1812,"frontmatter":1813,"imagePaths":1818},[1782,1783,1784,1785,1788,1789,1790,1793,1796,1799,1800,1801,1804,1807,1810],{"depth":44,"slug":1310,"text":1311},{"depth":47,"slug":1319,"text":1320},{"depth":54,"slug":712,"text":713},{"depth":54,"slug":1786,"text":1787},"installationsschritte-ubuntu-beispiel","Installationsschritte (Ubuntu Beispiel)",{"depth":47,"slug":1352,"text":1353},{"depth":47,"slug":1382,"text":1383},{"depth":54,"slug":1791,"text":1792},"gemeinsame-fallbearbeitung","Gemeinsame Fallbearbeitung",{"depth":54,"slug":1794,"text":1795},"videokonferenzen-mit-nextcloud-talk","Videokonferenzen mit “Nextcloud Talk”",{"depth":54,"slug":1797,"text":1798},"automatischer-dateiimport-per-api","Automatischer Dateiimport per API",{"depth":47,"slug":459,"text":460},{"depth":47,"slug":193,"text":1454},{"depth":54,"slug":1802,"text":1803},"problem-langsame-performance","Problem: Langsame Performance",{"depth":54,"slug":1805,"text":1806},"problem-dateien-erscheinen-nicht-im-sync","Problem: Dateien erscheinen nicht im Sync",{"depth":54,"slug":1808,"text":1809},"problem-fehlermeldung-trusted-domain-not-set","Problem: Fehlermeldung “Trusted domain not set”",{"depth":47,"slug":1609,"text":1610},[],[],{"title":1762,"tool_name":1765,"description":1763,"last_updated":1814,"author":18,"difficulty":1767,"categories":1815,"tags":1816,"sections":1817,"review_status":1536},["Date","2025-07-20T00:00:00.000Z"],[1769],[1634,1771,1772,1636,1773,1774],{"overview":34,"installation":34,"configuration":34,"usage_examples":34,"best_practices":34,"troubleshooting":34,"advanced_topics":35},[],"tool-nextcloud.md"] \ No newline at end of file diff --git a/.env.example b/.env.example index ce55860..26050b7 100644 --- a/.env.example +++ b/.env.example @@ -68,6 +68,36 @@ AI_EMBEDDINGS_MODEL=mistral-embed # User rate limiting (queries per minute) AI_RATE_LIMIT_MAX_REQUESTS=4 +# ============================================================================ +# 🎥 VIDEO EMBEDDING - PRODUCTION CONFIGURATION +# ============================================================================ + +# Enable local caching of Nextcloud videos (highly recommended) +VIDEO_CACHE_ENABLED=true + +# Directory for cached videos (ensure it's writable and has sufficient space) +# This directory will grow over time as videos are cached permanently +VIDEO_CACHE_DIR=./cache/videos + +# Emergency cleanup threshold in MB - videos are cached indefinitely +# Only triggers cleanup when approaching this limit to prevent disk full +# Recommended: 2000MB (2GB) for small deployments, 5000MB+ for larger ones +VIDEO_CACHE_MAX_SIZE=2000 + +# Maximum individual video file size for caching in MB +# Videos larger than this will stream directly without caching +VIDEO_MAX_SIZE=200 + +# ============================================================================ +# CACHING BEHAVIOR +# ============================================================================ +# - Videos downloaded once, cached permanently +# - No time-based expiration +# - Dramatically improves loading times after first download +# - Emergency cleanup only when approaching disk space limit +# - Perfect for manually curated forensics training content +# ============================================================================ + # ============================================================================ # 🎛️ PERFORMANCE TUNING - SENSIBLE DEFAULTS PROVIDED # ============================================================================ diff --git a/astro.config.mjs b/astro.config.mjs index 16016d8..b1187e9 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -1,5 +1,6 @@ import { defineConfig } from 'astro/config'; import node from '@astrojs/node'; +import { remarkVideoPlugin } from './src/utils/remarkVideoPlugin.ts'; export default defineConfig({ output: 'server', @@ -7,6 +8,13 @@ export default defineConfig({ mode: 'standalone' }), + markdown: { + remarkPlugins: [ + remarkVideoPlugin + ], + extendDefaultPlugins: true + }, + build: { assets: '_astro' }, @@ -16,4 +24,4 @@ export default defineConfig({ host: true }, allowImportingTsExtensions: true -}); +}); \ No newline at end of file diff --git a/package.json b/package.json index 7367a40..a9de490 100644 --- a/package.json +++ b/package.json @@ -11,6 +11,8 @@ }, "dependencies": { "@astrojs/node": "^9.3.0", + "@aws-sdk/client-s3": "^3.864.0", + "@aws-sdk/s3-request-presigner": "^3.864.0", "astro": "^5.12.3", "cookie": "^1.0.2", "dotenv": "^16.4.5", diff --git a/src/components/ToolMatrix.astro b/src/components/ToolMatrix.astro index 10db0eb..d2f64b8 100644 --- a/src/components/ToolMatrix.astro +++ b/src/components/ToolMatrix.astro @@ -193,7 +193,6 @@ domains.forEach((domain: any) => { diff --git a/src/pages/api/auth/login.ts b/src/pages/api/auth/login.ts index dde23f2..374473d 100644 --- a/src/pages/api/auth/login.ts +++ b/src/pages/api/auth/login.ts @@ -1,5 +1,7 @@ +// src/pages/api/auth/login.ts import type { APIRoute } from 'astro'; import { generateAuthUrl, generateState, logAuthEvent } from '../../../utils/auth.js'; +import { serialize } from 'cookie'; export const prerender = false; @@ -8,14 +10,27 @@ export const GET: APIRoute = async ({ url, redirect }) => { const state = generateState(); const authUrl = generateAuthUrl(state); - console.log('Generated auth URL:', authUrl); + console.log('[AUTH] Generated auth URL:', authUrl); const returnTo = url.searchParams.get('returnTo') || '/'; logAuthEvent('Login initiated', { returnTo, authUrl }); const stateData = JSON.stringify({ state, returnTo }); - const stateCookie = `auth_state=${encodeURIComponent(stateData)}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600`; + + const publicBaseUrl = process.env.PUBLIC_BASE_URL || ''; + const isProduction = process.env.NODE_ENV === 'production'; + const isSecure = publicBaseUrl.startsWith('https://') || isProduction; + + const stateCookie = serialize('auth_state', stateData, { + httpOnly: true, + secure: isSecure, + sameSite: 'lax', + maxAge: 600, // 10 minutes + path: '/' + }); + + console.log('[AUTH] Setting auth state cookie:', stateCookie.substring(0, 50) + '...'); return new Response(null, { status: 302, diff --git a/src/pages/api/auth/process.ts b/src/pages/api/auth/process.ts index e7abed9..929707e 100644 --- a/src/pages/api/auth/process.ts +++ b/src/pages/api/auth/process.ts @@ -1,4 +1,4 @@ -// src/pages/api/auth/process.ts (FIXED - Proper cookie handling) +// src/pages/api/auth/process.ts import type { APIRoute } from 'astro'; import { verifyAuthState, @@ -7,7 +7,7 @@ import { createSessionWithCookie, logAuthEvent } from '../../../utils/auth.js'; -import { apiError, apiSpecial, apiWithHeaders, handleAPIRequest } from '../../../utils/api.js'; +import { apiError, apiSpecial, handleAPIRequest } from '../../../utils/api.js'; export const prerender = false; @@ -30,9 +30,15 @@ export const POST: APIRoute = async ({ request }) => { const stateVerification = verifyAuthState(request, state); if (!stateVerification.isValid || !stateVerification.stateData) { + logAuthEvent('State verification failed', { + error: stateVerification.error, + hasStateData: !!stateVerification.stateData + }); return apiError.badRequest(stateVerification.error || 'Invalid state parameter'); } + console.log('[AUTH] State verification successful, exchanging code for tokens'); + const tokens = await exchangeCodeForTokens(code); const userInfo = await getUserInfo(tokens.access_token); @@ -43,6 +49,12 @@ export const POST: APIRoute = async ({ request }) => { email: sessionResult.userEmail }); + const returnUrl = new URL(stateVerification.stateData.returnTo, request.url); + returnUrl.searchParams.set('auth', 'success'); + const redirectUrl = returnUrl.toString(); + + console.log('[AUTH] Redirecting to:', redirectUrl); + const responseHeaders = new Headers(); responseHeaders.set('Content-Type', 'application/json'); @@ -51,7 +63,7 @@ export const POST: APIRoute = async ({ request }) => { return new Response(JSON.stringify({ success: true, - redirectTo: stateVerification.stateData.returnTo + redirectTo: redirectUrl }), { status: 200, headers: responseHeaders diff --git a/src/pages/api/auth/status.ts b/src/pages/api/auth/status.ts index cd67258..2cfa9b6 100644 --- a/src/pages/api/auth/status.ts +++ b/src/pages/api/auth/status.ts @@ -9,16 +9,16 @@ export const GET: APIRoute = async ({ request }) => { return await handleAPIRequest(async () => { const contributionAuth = await withAPIAuth(request, 'contributions'); const aiAuth = await withAPIAuth(request, 'ai'); - const gatedContentAuth = await withAPIAuth(request, 'gatedcontent'); // ADDED + const gatedContentAuth = await withAPIAuth(request, 'gatedcontent'); return apiResponse.success({ authenticated: contributionAuth.authenticated || aiAuth.authenticated || gatedContentAuth.authenticated, contributionAuthRequired: contributionAuth.authRequired, aiAuthRequired: aiAuth.authRequired, - gatedContentAuthRequired: gatedContentAuth.authRequired, // ADDED + gatedContentAuthRequired: gatedContentAuth.authRequired, contributionAuthenticated: contributionAuth.authenticated, aiAuthenticated: aiAuth.authenticated, - gatedContentAuthenticated: gatedContentAuth.authenticated, // ADDED + gatedContentAuthenticated: gatedContentAuth.authenticated, expires: contributionAuth.session?.exp ? new Date(contributionAuth.session.exp * 1000).toISOString() : null }); }, 'Status check failed'); diff --git a/src/pages/api/contribute/knowledgebase.ts b/src/pages/api/contribute/knowledgebase.ts index a60e89c..85bd2d0 100644 --- a/src/pages/api/contribute/knowledgebase.ts +++ b/src/pages/api/contribute/knowledgebase.ts @@ -1,4 +1,4 @@ -// src/pages/api/contribute/knowledgebase.ts - SIMPLIFIED: Issues only, minimal validation +// src/pages/api/contribute/knowledgebase.ts import type { APIRoute } from 'astro'; import { withAPIAuth } from '../../../utils/auth.js'; import { apiResponse, apiError, apiServerError, handleAPIRequest } from '../../../utils/api.js'; diff --git a/src/pages/api/contribute/tool.ts b/src/pages/api/contribute/tool.ts index 1cb90d8..a2f9fee 100644 --- a/src/pages/api/contribute/tool.ts +++ b/src/pages/api/contribute/tool.ts @@ -1,4 +1,4 @@ -// src/pages/api/contribute/tool.ts (UPDATED - Using consolidated API responses + related_software) +// src/pages/api/contribute/tool.ts import type { APIRoute } from 'astro'; import { withAPIAuth } from '../../../utils/auth.js'; import { apiResponse, apiError, apiServerError, apiSpecial, handleAPIRequest } from '../../../utils/api.js'; @@ -82,31 +82,27 @@ function sanitizeInput(obj: any): any { } function preprocessFormData(body: any): any { - // Handle comma-separated strings from autocomplete inputs if (body.tool) { - // Handle tags if (typeof body.tool.tags === 'string') { body.tool.tags = body.tool.tags.split(',').map((t: string) => t.trim()).filter(Boolean); } - // Handle related concepts if (body.tool.relatedConcepts) { if (typeof body.tool.relatedConcepts === 'string') { body.tool.related_concepts = body.tool.relatedConcepts.split(',').map((t: string) => t.trim()).filter(Boolean); } else { body.tool.related_concepts = body.tool.relatedConcepts; } - delete body.tool.relatedConcepts; // Remove the original key + delete body.tool.relatedConcepts; } - // Handle related software if (body.tool.relatedSoftware) { if (typeof body.tool.relatedSoftware === 'string') { body.tool.related_software = body.tool.relatedSoftware.split(',').map((t: string) => t.trim()).filter(Boolean); } else { body.tool.related_software = body.tool.relatedSoftware; } - delete body.tool.relatedSoftware; // Remove the original key + delete body.tool.relatedSoftware; } } @@ -142,14 +138,11 @@ async function validateToolData(tool: any, action: string): Promise<{ valid: boo } } - // Validate related items exist (optional validation - could be enhanced) if (tool.related_concepts && tool.related_concepts.length > 0) { - // Could validate that referenced concepts actually exist console.log('[VALIDATION] Related concepts provided:', tool.related_concepts); } if (tool.related_software && tool.related_software.length > 0) { - // Could validate that referenced software actually exists console.log('[VALIDATION] Related software provided:', tool.related_software); } diff --git a/src/pages/api/search/semantic.ts b/src/pages/api/search/semantic.ts index 1a2b262..6aec40a 100644 --- a/src/pages/api/search/semantic.ts +++ b/src/pages/api/search/semantic.ts @@ -35,7 +35,6 @@ export const POST: APIRoute = async ({ request }) => { ); } - /* --- (rest of the handler unchanged) -------------------------- */ const { embeddingsService } = await import('../../../utils/embeddings.js'); if (!embeddingsService.isEnabled()) { diff --git a/src/pages/contribute/tool.astro b/src/pages/contribute/tool.astro index 1e80526..2447805 100644 --- a/src/pages/contribute/tool.astro +++ b/src/pages/contribute/tool.astro @@ -23,7 +23,6 @@ const editToolName = Astro.url.searchParams.get('edit'); const editTool = editToolName ? existingTools.find(tool => tool.name === editToolName) : null; const isEdit = !!editTool; -// Extract data for autocomplete const allTags = [...new Set(existingTools.flatMap(tool => tool.tags || []))].sort(); const allSoftwareAndMethods = existingTools .filter(tool => tool.type === 'software' || tool.type === 'method') @@ -300,7 +299,6 @@ const allConcepts = existingTools diff --git a/src/styles/knowledgebase.css b/src/styles/knowledgebase.css index f85541a..6537109 100644 --- a/src/styles/knowledgebase.css +++ b/src/styles/knowledgebase.css @@ -688,3 +688,245 @@ /* Expand content */ .article-main { max-width: 100% !important; } } + + +/* ========================================================================== + VIDEO EMBEDDING - Add to knowledgebase.css + ========================================================================== */ + +/* Video Container and Responsive Wrapper */ +:where(.markdown-content) .video-container { + position: relative; + width: 100%; + margin: 2rem 0; + border-radius: var(--radius-lg, 0.75rem); + overflow: hidden; + background-color: var(--color-bg-tertiary, #000); + box-shadow: var(--shadow-lg, 0 12px 30px rgba(0,0,0,0.16)); +} + +/* Responsive 16:9 aspect ratio by default */ +:where(.markdown-content) .video-container.aspect-16-9 { + aspect-ratio: 16 / 9; +} + +:where(.markdown-content) .video-container.aspect-4-3 { + aspect-ratio: 4 / 3; +} + +:where(.markdown-content) .video-container.aspect-1-1 { + aspect-ratio: 1 / 1; +} + +/* Video Element Styling */ +:where(.markdown-content) .video-container video { + width: 100%; + height: 100%; + object-fit: contain; + background-color: #000; + border: none; + outline: none; +} + +/* Custom Video Controls Enhancement */ +:where(.markdown-content) video::-webkit-media-controls-panel { + background-color: rgba(0, 0, 0, 0.8); +} + +:where(.markdown-content) video::-webkit-media-controls-current-time-display, +:where(.markdown-content) video::-webkit-media-controls-time-remaining-display { + color: white; + text-shadow: none; +} + +/* Video Loading State */ +:where(.markdown-content) .video-container .video-loading { + position: absolute; + top: 50%; + left: 50%; + transform: translate(-50%, -50%); + color: var(--color-text-secondary); + display: flex; + flex-direction: column; + align-items: center; + gap: 1rem; +} + +:where(.markdown-content) .video-container .video-loading .spinner { + width: 2rem; + height: 2rem; + border: 3px solid var(--color-border); + border-top: 3px solid var(--color-primary); + border-radius: 50%; + animation: spin 1s linear infinite; +} + +@keyframes spin { + 0% { transform: rotate(0deg); } + 100% { transform: rotate(360deg); } +} + +/* Video Error State */ +:where(.markdown-content) .video-container .video-error { + position: absolute; + top: 50%; + left: 50%; + transform: translate(-50%, -50%); + text-align: center; + color: var(--color-error, #dc3545); + padding: 2rem; +} + +:where(.markdown-content) .video-container .video-error .error-icon { + font-size: 3rem; + margin-bottom: 1rem; +} + +/* Video Metadata Overlay */ +:where(.markdown-content) .video-metadata { + background-color: var(--color-bg-secondary); + border: 1px solid var(--color-border); + border-top: none; + padding: 1rem 1.5rem; + font-size: 0.875rem; + color: var(--color-text-secondary); + border-radius: 0 0 var(--radius-lg, 0.75rem) var(--radius-lg, 0.75rem); +} + +:where(.markdown-content) .video-metadata .video-title { + font-weight: 600; + color: var(--color-text); + margin-bottom: 0.5rem; +} + +:where(.markdown-content) .video-metadata .video-info { + display: flex; + gap: 1rem; + flex-wrap: wrap; + align-items: center; +} + +:where(.markdown-content) .video-metadata .video-duration, +:where(.markdown-content) .video-metadata .video-size, +:where(.markdown-content) .video-metadata .video-format { + display: flex; + align-items: center; + gap: 0.25rem; +} + +/* Fullscreen Support */ +:where(.markdown-content) .video-container video:fullscreen { + background-color: #000; +} + +:where(.markdown-content) .video-container video:-webkit-full-screen { + background-color: #000; +} + +:where(.markdown-content) .video-container video:-moz-full-screen { + background-color: #000; +} + +/* Video Thumbnail/Poster Styling */ +:where(.markdown-content) .video-container video[poster] { + object-fit: cover; +} + +/* Protected Video Overlay */ +:where(.markdown-content) .video-container .video-protected { + position: absolute; + top: 0; + left: 0; + right: 0; + bottom: 0; + background-color: rgba(0, 0, 0, 0.8); + display: flex; + flex-direction: column; + align-items: center; + justify-content: center; + color: white; + text-align: center; + padding: 2rem; +} + +:where(.markdown-content) .video-container .video-protected .lock-icon { + font-size: 3rem; + margin-bottom: 1rem; + opacity: 0.8; +} + +/* Responsive Design */ +@media (max-width: 768px) { + :where(.markdown-content) .video-container { + margin: 1.5rem -0.5rem; /* Extend to edges on mobile */ + border-radius: 0; + } + + :where(.markdown-content) .video-metadata { + padding: 0.75rem 1rem; + font-size: 0.8125rem; + border-radius: 0; + } + + :where(.markdown-content) .video-metadata .video-info { + flex-direction: column; + gap: 0.5rem; + align-items: flex-start; + } +} + +/* Dark Theme Adjustments */ +[data-theme="dark"] :where(.markdown-content) .video-container { + box-shadow: 0 12px 30px rgba(0,0,0,0.4); +} + +[data-theme="dark"] :where(.markdown-content) .video-metadata { + background-color: var(--color-bg-tertiary); + border-color: color-mix(in srgb, var(--color-border) 60%, transparent); +} + +/* Video Caption/Description Support */ +:where(.markdown-content) .video-caption { + margin-top: 1rem; + font-size: 0.9375rem; + color: var(--color-text-secondary); + text-align: center; + font-style: italic; + line-height: 1.5; +} + +/* Video Gallery Support (multiple videos) */ +:where(.markdown-content) .video-gallery { + display: grid; + grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); + gap: 2rem; + margin: 2rem 0; +} + +:where(.markdown-content) .video-gallery .video-container { + margin: 0; +} + +/* Accessibility Improvements */ +:where(.markdown-content) .video-container video:focus { + outline: 3px solid var(--color-primary); + outline-offset: 3px; +} + +/* Print Media - Hide Videos */ +@media print { + :where(.markdown-content) .video-container { + display: none !important; + } + + :where(.markdown-content) .video-container::after { + content: "[Video: " attr(data-video-title, "Embedded Video") "]"; + display: block; + padding: 1rem; + background-color: #f5f5f5; + border: 1px solid #ddd; + text-align: center; + font-style: italic; + color: #666; + } +} \ No newline at end of file diff --git a/src/utils/aiPipeline.ts b/src/utils/aiPipeline.ts index 2bf712d..75d962a 100644 --- a/src/utils/aiPipeline.ts +++ b/src/utils/aiPipeline.ts @@ -1083,7 +1083,6 @@ class ImprovedMicroTaskAIPipeline { return; } - // Step 1: AI selection of tools for completion const selectionPrompt = AI_PROMPTS.generatePhaseCompletionPrompt(originalQuery, phase, phaseTools, phaseConcepts); const selectionResult = await this.callMicroTaskAI(selectionPrompt, context, 800); @@ -1108,7 +1107,6 @@ class ImprovedMicroTaskAIPipeline { return; } - // Step 2: Generate detailed reasoning for each selected tool for (const tool of validTools) { console.log('[AI-PIPELINE] Generating reasoning for phase completion tool:', tool.name); diff --git a/src/utils/auth.ts b/src/utils/auth.ts index ed55d3a..cceb186 100644 --- a/src/utils/auth.ts +++ b/src/utils/auth.ts @@ -1,4 +1,4 @@ -// src/utils/auth.js (ENHANCED - Added gated content support) +// src/utils/auth.js import type { AstroGlobal } from 'astro'; import crypto from 'crypto'; import { config } from 'dotenv'; @@ -390,12 +390,10 @@ export function getAuthRequirementForContext(context: AuthContextType): boolean return getAuthRequirement(context); } -// NEW: Helper function to check if gated content requires authentication export function isGatedContentAuthRequired(): boolean { return getAuthRequirement('gatedcontent'); } -// NEW: Check if specific content should be gated export function shouldGateContent(isGatedContent: boolean): boolean { return isGatedContent && isGatedContentAuthRequired(); } \ No newline at end of file diff --git a/src/utils/clientUtils.ts b/src/utils/clientUtils.ts index 0d766e1..f0a6796 100644 --- a/src/utils/clientUtils.ts +++ b/src/utils/clientUtils.ts @@ -1,5 +1,5 @@ // src/utils/clientUtils.ts -// Client-side utilities that mirror server-side toolHelpers.ts + export function createToolSlug(toolName: string): string { if (!toolName || typeof toolName !== 'string') { @@ -8,10 +8,10 @@ export function createToolSlug(toolName: string): string { } return toolName.toLowerCase() - .replace(/[^a-z0-9\s-]/g, '') // Remove special characters - .replace(/\s+/g, '-') // Replace spaces with hyphens - .replace(/-+/g, '-') // Remove duplicate hyphens - .replace(/^-|-$/g, ''); // Remove leading/trailing hyphens + .replace(/[^a-z0-9\s-]/g, '') + .replace(/\s+/g, '-') + .replace(/-+/g, '-') + .replace(/^-|-$/g, ''); } export function findToolByIdentifier(tools: any[], identifier: string): any | undefined { @@ -30,7 +30,6 @@ export function isToolHosted(tool: any): boolean { tool.projectUrl.trim() !== ""; } -// Consolidated Autocomplete Functionality interface AutocompleteOptions { minLength?: number; maxResults?: number; @@ -97,7 +96,6 @@ export class AutocompleteManager { display: none; `; - // Insert dropdown after input const parentElement = this.input.parentNode as HTMLElement; parentElement.style.position = 'relative'; parentElement.insertBefore(this.dropdown, this.input.nextSibling); @@ -119,7 +117,6 @@ export class AutocompleteManager { }); this.input.addEventListener('blur', () => { - // Delay to allow click events on dropdown items setTimeout(() => { const activeElement = document.activeElement; if (!activeElement || !this.dropdown.contains(activeElement)) { @@ -226,7 +223,6 @@ export class AutocompleteManager { }) .join(''); - // Bind click events this.dropdown.querySelectorAll('.autocomplete-option').forEach((option, index) => { option.addEventListener('click', () => { this.selectItem(this.filteredData[index]); @@ -260,7 +256,6 @@ export class AutocompleteManager { this.hideDropdown(); } - // Trigger change event this.input.dispatchEvent(new CustomEvent('autocomplete:select', { detail: { item, text, selectedItems: Array.from(this.selectedItems) } })); @@ -307,7 +302,6 @@ export class AutocompleteManager { `) .join(''); - // Bind remove events this.selectedContainer.querySelectorAll('.autocomplete-remove').forEach(btn => { btn.addEventListener('click', (e) => { e.preventDefault(); diff --git a/src/utils/remarkVideoPlugin.ts b/src/utils/remarkVideoPlugin.ts new file mode 100644 index 0000000..e7af280 --- /dev/null +++ b/src/utils/remarkVideoPlugin.ts @@ -0,0 +1,85 @@ +// src/utils/remarkVideoPlugin.ts +import { visit } from 'unist-util-visit'; +import type { Plugin } from 'unified'; +import type { Root } from 'hast'; + + +export const remarkVideoPlugin: Plugin<[], Root> = () => { + return (tree: Root) => { + visit(tree, 'html', (node: any, index: number | undefined, parent: any) => { + if (node.value && node.value.includes(' + + ${title !== 'Video' ? ` +
+
${escapeHtml(title)}
+
+ ` : ''} + + `.trim(); + + parent.children[index] = { type: 'html', value: enhancedHTML }; + + console.log(`[VIDEO] Processed: ${title}`); + console.log(`[VIDEO] Final URL: ${finalSrc}`); + } + } + }); + }; +}; + + +function processNextcloudUrl(originalUrl: string): string { + if (isNextcloudShareUrl(originalUrl) && !originalUrl.includes('/download')) { + const downloadUrl = `${originalUrl}/download`; + console.log(`[VIDEO] Auto-added /download: ${originalUrl} → ${downloadUrl}`); + return downloadUrl; + } + + return originalUrl; +} + +function isNextcloudShareUrl(url: string): boolean { + const pattern = /\/s\/[a-zA-Z0-9]+/; + return pattern.test(url) && (url.includes('nextcloud') || url.includes('cloud.')); +} + +function escapeHtml(unsafe: string): string { + if (typeof unsafe !== 'string') return ''; + + return unsafe + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} \ No newline at end of file diff --git a/src/utils/toolHelpers.ts b/src/utils/toolHelpers.ts index 47f572f..5f8edae 100644 --- a/src/utils/toolHelpers.ts +++ b/src/utils/toolHelpers.ts @@ -1,3 +1,5 @@ +// src/utils/toolHelpers.ts + export interface Tool { name: string; type?: 'software' | 'method' | 'concept'; @@ -13,31 +15,8 @@ export interface Tool { related_concepts?: string[]; } -export function createToolSlug(toolName: string): string { - if (!toolName || typeof toolName !== 'string') { - console.warn('[toolHelpers] Invalid toolName provided to createToolSlug:', toolName); - return ''; - } - - return toolName.toLowerCase() - .replace(/[^a-z0-9\s-]/g, '') // Remove special characters - .replace(/\s+/g, '-') // Replace spaces with hyphens - .replace(/-+/g, '-') // Remove duplicate hyphens - .replace(/^-|-$/g, ''); // Remove leading/trailing hyphens -} - -export function findToolByIdentifier(tools: Tool[], identifier: string): Tool | undefined { - if (!identifier || !Array.isArray(tools)) return undefined; - - return tools.find(tool => - tool.name === identifier || - createToolSlug(tool.name) === identifier.toLowerCase() - ); -} - -export function isToolHosted(tool: Tool): boolean { - return tool.projectUrl !== undefined && - tool.projectUrl !== null && - tool.projectUrl !== "" && - tool.projectUrl.trim() !== ""; -} \ No newline at end of file +export { + createToolSlug, + findToolByIdentifier, + isToolHosted +} from './clientUtils.js'; \ No newline at end of file diff --git a/src/utils/videoUtils.ts b/src/utils/videoUtils.ts new file mode 100644 index 0000000..bb4d9d7 --- /dev/null +++ b/src/utils/videoUtils.ts @@ -0,0 +1,115 @@ +// src/utils/videoUtils.ts - SIMPLIFIED - Basic utilities only +import 'dotenv/config'; + + +export interface SimpleVideoMetadata { + title?: string; + description?: string; +} + +export function getVideoMimeType(url: string): string { + let extension: string | undefined; + try { + const pathname = new URL(url).pathname; + extension = pathname.split('.').pop()?.toLowerCase(); + } catch { + extension = url.split('?')[0].split('.').pop()?.toLowerCase(); + } + + const mimeTypes: Record = { + mp4: 'video/mp4', + webm: 'video/webm', + ogg: 'video/ogg', + mov: 'video/quicktime', + avi: 'video/x-msvideo', + m4v: 'video/m4v', + mkv: 'video/x-matroska', + flv: 'video/x-flv' + }; + + return (extension && mimeTypes[extension]) || 'video/mp4'; +} + +export function formatDuration(seconds: number): string { + const hours = Math.floor(seconds / 3600); + const minutes = Math.floor((seconds % 3600) / 60); + const remainingSeconds = Math.floor(seconds % 60); + + if (hours > 0) { + return `${hours}:${minutes.toString().padStart(2, '0')}:${remainingSeconds.toString().padStart(2, '0')}`; + } + + return `${minutes}:${remainingSeconds.toString().padStart(2, '0')}`; +} + +export function formatFileSize(bytes: number): string { + if (bytes < 1024) return `${bytes} B`; + if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`; + if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`; + return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`; +} + +export function escapeHtml(unsafe: string): string { + if (typeof unsafe !== 'string') return ''; + + return unsafe + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} + +export function generateVideoHTML( + src: string, + options: { + title?: string; + controls?: boolean; + autoplay?: boolean; + muted?: boolean; + loop?: boolean; + preload?: 'none' | 'metadata' | 'auto'; + aspectRatio?: '16:9' | '4:3' | '1:1'; + showMetadata?: boolean; + } = {} +): string { + const { + title = 'Video', + controls = true, + autoplay = false, + muted = false, + loop = false, + preload = 'metadata', + aspectRatio = '16:9', + showMetadata = true + } = options; + + const aspectClass = `aspect-${aspectRatio.replace(':', '-')}`; + const videoAttributes = [ + controls ? 'controls' : '', + autoplay ? 'autoplay' : '', + muted ? 'muted' : '', + loop ? 'loop' : '', + `preload="${preload}"` + ].filter(Boolean).join(' '); + + const metadataHTML = showMetadata && title !== 'Video' ? ` +
+
${escapeHtml(title)}
+
+ ` : ''; + + return ` +
+ + ${metadataHTML} +
+ `.trim(); +} \ No newline at end of file