Yup, The Bishop is bang on. Its worth noting though that there is a clear distinction between a Hacker and someone who conducts Forensics. Completely different ball game really.
Hacker will try to exploit weaknesses in your systems to pentrate them for some reason or another
Forensics is analysing data to prove/dissprove something (this can be logs generated by Firewalls/routers/hosts or it can be the actual hosts themselves (PC's, Servers, etc...) A mate of mine actually did some forensic work on an XBox which was going to court (really dodgy pictures on them).
Forensics you need to be very careful if its going up in court. You would generally take a complete snapshot of the hard drive BEFORE doing anything, all the forensic work would then be conducted on the snapshot to keep the original intact. Also you have a chain of evidence that needs to be documented and maintained through the lifecycle of the work (as it passes people, or even transported, etc...)
Wayne Murphy
Firewall.cx Team Member
www.firewall.cx
Now working for a Security Company called Sec-1 Ltd in the UK, for any
Penetration Testing work visit
www.sec-1.com
or PM me for details.
