<div id="pf1" class="pf w0 h0" data-page-no="1"><div class="pc pc1 w0 h0"><div class="t m0 x0 h1 y0 ff1 fs0 fc0 sc0 ls0 ws0">An´<span class="_0 blank"></span>alise F<span class="_1 blank"></span>orense de In<span class="_2 blank"></span>trus\u02dc<span class="_0 blank"></span>oes em Sistemas</div><div class="t m0 x1 h1 y1 ff1 fs0 fc0 sc0 ls0 ws1">Computacionais:<span class="_3 blank"> </span>T<span class="_2 blank"></span>´<span class="_4 blank"></span>ecnicas,<span class="_5 blank"> </span>Pro cedimen<span class="_2 blank"></span>tos<span class="_5 blank"> </span>e</div><div class="t m0 x2 h1 y2 ff1 fs0 fc0 sc0 ls0 ws2">F<span class="_1 blank"></span>erramen<span class="_2 blank"></span>tas</div><div class="t m0 x3 h2 y3 ff2 fs1 fc0 sc0 ls0 ws3">Marcelo<span class="_6 blank"> </span>Ab dalla<span class="_6 blank"> </span>dos<span class="_6 blank"> </span>Reis</div><div class="t m0 x4 h3 y4 ff3 fs1 fc0 sc0 ls0 ws4">Instituto de Computa¸<span class="_7 blank"></span>c\u02dc<span class="_8 blank"></span>ao</div><div class="t m0 x5 h3 y5 ff3 fs1 fc0 sc0 ls0 ws5">Univ<span class="_9 blank"></span>ersidade Estadual de Campinas</div><div class="t m0 x6 h3 y6 ff3 fs1 fc0 sc0 ls0 ws6">13083-970 Campinas - SP</div><div class="t m0 x5 h3 y7 ff3 fs1 fc0 sc0 ls0 ws7">h<span class="_9 blank"></span>ttp://www.ic.unicamp.br/ra000504</div><div class="t m0 x7 h4 y8 ff4 fs1 fc0 sc0 ls0 ws8">mar<span class="_2 blank"></span>c<span class="_9 blank"></span>elo.r<span class="_2 blank"></span>eis@ic.unic<span class="_2 blank"></span>amp.br</div><div class="t m0 x8 h2 y9 ff2 fs1 fc0 sc0 ls0 ws9">P<span class="_9 blank"></span>aulo L<span class="_a blank"></span>´<span class="_7 blank"></span>\u0131cio de Geus</div><div class="t m0 x9 h3 ya ff3 fs1 fc0 sc0 ls0 wsa">Instituto de Computa¸<span class="_7 blank"></span>c\u02dc<span class="_8 blank"></span>ao</div><div class="t m0 xa h3 yb ff3 fs1 fc0 sc0 ls0 wsb">Univ<span class="_9 blank"></span>ersidade Estadual de Campinas</div><div class="t m0 xb h3 yc ff3 fs1 fc0 sc0 ls0 wsc">13083-970 Campinas - SP</div><div class="t m0 xc h3 yd ff3 fs1 fc0 sc0 ls0 ws7">h<span class="_9 blank"></span>ttp://www.ic.unicamp.br/paulo</div><div class="t m0 xd h4 ye ff4 fs1 fc0 sc0 ls0 ws8">p<span class="_2 blank"></span>aulo@ic.unic<span class="_2 blank"></span>amp.br</div><div class="t m0 xe h5 yf ff5 fs2 fc0 sc0 ls0 wsd">RESUMO</div><div class="t m0 xf h4 y10 ff4 fs1 fc0 sc0 ls0 wse">A te<span class="_2 blank"></span>cnolo<span class="_9 blank"></span>gia dos c<span class="_2 blank"></span>omputador<span class="_2 blank"></span>es est´<span class="_8 blank"></span>a envolvida em um n´<span class="_8 blank"></span>umer<span class="_2 blank"></span>o cr<span class="_2 blank"></span>esc<span class="_2 blank"></span>ente de atividades</div><div class="t m0 x0 h4 y11 ff4 fs1 fc0 sc0 ls0 wsf">il<span class="_b blank"></span>´<span class="_c blank"></span>\u0131citas, o que r<span class="_2 blank"></span>e<span class="_9 blank"></span>quer um maior entendimento de c<span class="_2 blank"></span>omo se<span class="_d blank"> </span>obter e utilizar evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias ele-</div><div class="t m0 x0 h4 y12 ff4 fs1 fc0 sc0 ls0 ws10">tr\u02c6<span class="_8 blank"></span>onic<span class="_2 blank"></span>as armazenadas em c<span class="_2 blank"></span>omputador<span class="_2 blank"></span>es.<span class="_e blank"> </span>Este tr<span class="_2 blank"></span>ab<span class="_9 blank"></span>alho apr<span class="_2 blank"></span>esenta uma discuss\u02dc<span class="_8 blank"></span>ao detalhada</div><div class="t m0 x0 h4 y13 ff4 fs1 fc0 sc0 ls0 ws11">sobr<span class="_2 blank"></span>e a investiga¸<span class="_7 blank"></span>c\u02dc<span class="_8 blank"></span>ao for<span class="_2 blank"></span>ense de intrus\u02dc<span class="_8 blank"></span>oes em sistemas c<span class="_2 blank"></span>omputacionais, tendo c<span class="_2 blank"></span>omo obje-</div><div class="t m0 x0 h4 y14 ff4 fs1 fc0 sc0 ls0 ws12">tivo princip<span class="_2 blank"></span>al forne<span class="_2 blank"></span>c<span class="_9 blank"></span>er uma descri¸<span class="_7 blank"></span>c\u02dc<span class="_8 blank"></span>ao c<span class="_2 blank"></span>ompleta sobr<span class="_2 blank"></span>e onde, c<span class="_2 blank"></span>omo e<span class="_f blank"> </span>o qu<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>e pr<span class="_9 blank"></span>o<span class="_2 blank"></span>cur<span class="_2 blank"></span>ar em um</div><div class="t m0 x0 h4 y15 ff4 fs1 fc0 sc0 ls0 ws13">sistema invadido.</div><div class="t m0 x10 h5 y16 ff5 fs2 fc0 sc0 ls0 wsd">ABSTRA<span class="_9 blank"></span>CT</div><div class="t m0 xf h4 y17 ff4 fs1 fc0 sc0 ls0 ws14">The<span class="_e blank"> </span>c<span class="_9 blank"></span>omputer<span class="_e blank"> </span>te<span class="_2 blank"></span>cnolo<span class="_9 blank"></span>gy<span class="_e blank"> </span>is<span class="_10 blank"> </span>involve<span class="_2 blank"></span>d<span class="_10 blank"> </span>in<span class="_e blank"> </span>a<span class="_10 blank"> </span>gr<span class="_2 blank"></span>owing<span class="_10 blank"> </span>numb<span class="_2 blank"></span>er<span class="_e blank"> </span>of<span class="_10 blank"> </span>il le<span class="_2 blank"></span>gal<span class="_10 blank"> </span>activities.<span class="_11 blank"> </span>This</div><div class="t m0 x0 h4 y18 ff4 fs1 fc0 sc0 ls0 ws15">situation r<span class="_2 blank"></span>e<span class="_2 blank"></span>quir<span class="_9 blank"></span>es a major understanding on how to obtain and use digital evidenc<span class="_2 blank"></span>e stor<span class="_9 blank"></span>e<span class="_2 blank"></span>d</div><div class="t m0 x0 h4 y19 ff4 fs1 fc0 sc0 ls0 ws16">in c<span class="_2 blank"></span>omputers.<span class="_12 blank"> </span>This work pr<span class="_2 blank"></span>esents a detaile<span class="_9 blank"></span>d discution ab<span class="_2 blank"></span>out for<span class="_2 blank"></span>ensic investigation of</div><div class="t m0 x0 h4 y1a ff4 fs1 fc0 sc0 ls0 ws17">intrusions in c<span class="_2 blank"></span>omputer systems,<span class="_e blank"> </span>pr<span class="_2 blank"></span>oviding a c<span class="_2 blank"></span>omplete description ab<span class="_9 blank"></span>out wher<span class="_2 blank"></span>e,<span class="_e blank"> </span>how and</div><div class="t m0 x0 h4 y1b ff4 fs1 fc0 sc0 ls0 ws18">what to lo<span class="_2 blank"></span>ok for in a<span class="_6 blank"> </span>c<span class="_2 blank"></span>ompr<span class="_2 blank"></span>omise<span class="_9 blank"></span>d system.</div><div class="t m0 x11 h6 y1c ff6 fs3 fc0 sc0 ls0 ws19">1<span class="_13 blank"> </span>In<span class="_2 blank"></span>tro du¸<span class="_14 blank"></span>c\u02dc<span class="_15 blank"></span>ao</div><div class="t m0 x11 h5 y1d ff5 fs2 fc0 sc0 ls0 ws1a">As<span class="_e blank"> </span>´<span class="_16 blank"></span>ultimas d<span class="_9 blank"></span>´<span class="_8 blank"></span>ecadas foram marcad<span class="_9 blank"></span>as p<span class="_17 blank"> </span>ela in<span class="_9 blank"></span>tegra¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>ao dos co<span class="_9 blank"></span>mputadores no modo de vida das</div><div class="t m0 x11 h5 y1e ff5 fs2 fc0 sc0 ls0 ws1b">p essoas.<span class="_e blank"> </span>Infraestruturas<span class="_18 blank"> </span>b´<span class="_19 blank"></span>asicas<span class="_18 blank"> </span>da<span class="_1a blank"> </span>so ciedade,<span class="_1a blank"> </span>como<span class="_18 blank"> </span>redes<span class="_1a blank"> </span>\ufb01nanceiras,<span class="_18 blank"> </span>sistemas<span class="_1a blank"> </span>de<span class="_18 blank"> </span>comunica¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,</div><div class="t m0 x11 h5 y1f ff5 fs2 fc0 sc0 ls0 ws1c">esta¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes de energia e sistemas de sa<span class="_17 blank"> </span>´<span class="_16 blank"></span>ude, dep<span class="_17 blank"> </span>endem todas de sistemas computacionais para seu</div><div class="t m0 x11 h5 y20 ff5 fs2 fc0 sc0 ls0 ws1b">funcionamen<span class="_9 blank"></span>to<span class="_18 blank"> </span>e\ufb01cien<span class="_2 blank"></span>te<span class="_18 blank"> </span>e<span class="_18 blank"> </span>con\ufb01´<span class="_19 blank"></span>av<span class="_9 blank"></span>el.<span class="_e blank"> </span>Al<span class="_9 blank"></span>´<span class="_8 blank"></span>em<span class="_18 blank"> </span>disso,<span class="_1b blank"> </span>´<span class="_8 blank"></span>e<span class="_18 blank"> </span>crescen<span class="_2 blank"></span>te<span class="_18 blank"> </span>o<span class="_18 blank"> </span>n ´<span class="_16 blank"></span>umero<span class="_18 blank"> </span>de<span class="_18 blank"> </span>indiv<span class="_a blank"></span>´<span class="_c blank"></span>\u0131duos<span class="_1b blank"> </span>que<span class="_18 blank"> </span>utilizam</div><div class="t m0 x11 h5 y21 ff5 fs2 fc0 sc0 ls0 ws1b">computadores<span class="_1a blank"> </span>p essoais<span class="_1a blank"> </span>p or<span class="_1a blank"> </span>con<span class="_9 blank"></span>v<span class="_9 blank"></span>eni<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia,<span class="_1a blank"> </span>educa¸<span class="_7 blank"></span>c\u02dc<span class="_16 blank"></span>ao<span class="_1a blank"> </span>e<span class="_1a blank"> </span>entretenim<span class="_9 blank"></span>en<span class="_9 blank"></span>to.<span class="_e blank"> </span>A<span class="_1a blank"> </span>conectividade<span class="_1a blank"> </span>oferecida</div><div class="t m0 x11 h5 y22 ff5 fs2 fc0 sc0 ls0 ws1d">p ela<span class="_1c blank"> </span>In<span class="_9 blank"></span>ternet<span class="_1c blank"> </span>tam<span class="_9 blank"></span>b<span class="_9 blank"></span>´<span class="_8 blank"></span>em<span class="_1c blank"> </span>in<span class="_2 blank"></span>tro duziu<span class="_1c blank"> </span>uma<span class="_1c blank"> </span>s´<span class="_19 blank"></span>erie<span class="_1c blank"> </span>de<span class="_1c blank"> </span>nov<span class="_2 blank"></span>as<span class="_1c blank"> </span>facilid<span class="_9 blank"></span>ades<span class="_1c blank"> </span>no<span class="_1c blank"> </span>dia<span class="_1c blank"> </span>a<span class="_1c blank"> </span>dia<span class="_1c blank"> </span>das<span class="_1c blank"> </span>p essoas,<span class="_1c blank"> </span>como</div><div class="t m0 x11 h5 y23 ff5 fs2 fc0 sc0 ls0 ws1e">o correio eletr\u02c6<span class="_19 blank"></span>onico e a <span class="ff7 ws1f">World Wide Web</span><span class="ws20">, p<span class="_17 blank"> </span>ermitindo o acesso an\u02c6<span class="_16 blank"></span>onimo a quase to<span class="_17 blank"> </span>do tip<span class="_17 blank"> </span>o de</span></div><div class="t m0 x11 h5 y24 ff5 fs2 fc0 sc0 ls0 ws21">informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao ou sistema.</div><div class="t m0 x12 h5 y25 ff5 fs2 fc0 sc0 ls0 ws22">N\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>´<span class="_8 blank"></span>e de se espan<span class="_2 blank"></span>tar o fato de que essa revolu¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao computacional tenha atingido tam<span class="_2 blank"></span>b´<span class="_19 blank"></span>em o</div><div class="t m0 x11 h5 y26 ff5 fs2 fc0 sc0 ls0 ws1d">m<span class="_9 blank"></span>undo<span class="_6 blank"> </span>do<span class="_d blank"> </span>crime.<span class="_1d blank"> </span>A<span class="_d blank"> </span>tecnologia<span class="_6 blank"> </span>dos<span class="_d blank"> </span>computadores<span class="_d blank"> </span>est´<span class="_19 blank"></span>a<span class="_d blank"> </span>env<span class="_2 blank"></span>olvida<span class="_d blank"> </span>em<span class="_d blank"> </span>um<span class="_d blank"> </span>n ´<span class="_16 blank"></span>umero<span class="_6 blank"> </span>crescente<span class="_6 blank"> </span>de</div><div class="t m0 x13 h5 y27 ff5 fs2 fc0 sc0 ls0">1</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf2" class="pf w0 h0" data-page-no="2"><div class="pc pc2 w0 h0"><img class="bi x11 y28 w1 h7" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg2.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 ws24">1.<span class="_1e blank"> </span>In<span class="_9 blank"></span>tro du¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1f blank"> </span><span class="ff5">2</span></div><div class="t m0 x11 h5 y2a ff5 fs2 fc0 sc0 ls0 ws25">atividades il<span class="_a blank"></span>´<span class="_c blank"></span>\u0131citas.<span class="_1d blank"> </span>Al<span class="_2 blank"></span>´<span class="_8 blank"></span>em de serem utilizados como ferramen<span class="_9 blank"></span>tas para a consuma¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de alguns</div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 ws26">tip<span class="_17 blank"> </span>os de crimes (como, p<span class="_17 blank"> </span>or exemplo, in<span class="_9 blank"></span>v<span class="_2 blank"></span>as\u02dc<span class="_16 blank"></span>ao de sistemas,<span class="_1c blank"> </span>dissemina¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de p<span class="_17 blank"> </span>ornogra\ufb01a infan<span class="_9 blank"></span>til e</div><div class="t m0 x11 h8 y2c ff5 fs2 fc0 sc0 ls0 ws27">fraude),<span class="_18 blank"> </span>os<span class="_18 blank"> </span>computadores<span class="_1b blank"> </span>p<span class="_17 blank"> </span>o dem<span class="_18 blank"> </span>con<span class="_9 blank"></span>ter<span class="_18 blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="ff9 fs4 ls1 v1">1</span><span class="ws28">relacionadas<span class="_18 blank"> </span>com<span class="_18 blank"> </span>qualquer<span class="_1b blank"> </span>tip o<span class="_18 blank"> </span>de<span class="_18 blank"> </span>atividade</span></div><div class="t m0 x11 h5 y2d ff5 fs2 fc0 sc0 ls0 ws29">il<span class="_a blank"></span>´<span class="_c blank"></span>\u0131cita, incluindo homic<span class="_a blank"></span>´<span class="_c blank"></span>\u0131dio e estupro.</div><div class="t m0 x12 h5 y2e ff5 fs2 fc0 sc0 ls0 ws2a">O aumen<span class="_9 blank"></span>to dram´<span class="_16 blank"></span>atico em crimes relacionados com computadores requer um maior en<span class="_9 blank"></span>ten-</div><div class="t m0 x11 h5 y2f ff5 fs2 fc0 sc0 ls0 ws2b">dimen<span class="_9 blank"></span>to de como se obter e utilizar evid<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encias eletr\u02c6<span class="_19 blank"></span>onicas armazenadas em computadores.<span class="_e blank"> </span>T<span class="_2 blank"></span>al</div><div class="t m0 x11 h5 y30 ff5 fs2 fc0 sc0 ls0 ws1b">en<span class="_9 blank"></span>tendimen<span class="_9 blank"></span>to<span class="_1c blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_f blank"> </span>alcan¸<span class="_8 blank"></span>cado<span class="_f blank"> </span>atrav<span class="_2 blank"></span>´<span class="_8 blank"></span>es<span class="_f blank"> </span>dos<span class="_1c blank"> </span>conceitos<span class="_f blank"> </span>e<span class="_f blank"> </span>meto dologias<span class="_1c blank"> </span>da<span class="_f blank"> </span>forense<span class="_f blank"> </span>computacio-</div><div class="t m0 x11 h5 y31 ff5 fs2 fc0 sc0 ls0 wsd">nal.</div><div class="t m0 x12 h5 y32 ff5 fs2 fc0 sc0 ls0 ws2c">A forense computacional compreende a aquisi¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao, preserv<span class="_2 blank"></span>a¸<span class="_7 blank"></span>c<span class="_9 blank"></span>\u02dc<span class="_19 blank"></span>ao, iden<span class="_9 blank"></span>ti\ufb01ca¸<span class="_7 blank"></span>c\u02dc<span class="_16 blank"></span>ao, extra¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao, res-</div><div class="t m0 x11 h5 y33 ff5 fs2 fc0 sc0 ls0 ws2d">taura¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_1a blank"> </span>an´<span class="_19 blank"></span>alise<span class="_18 blank"> </span>e<span class="_18 blank"> </span>do cumen<span class="_9 blank"></span>ta¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_18 blank"> </span>de<span class="_18 blank"> </span>evid\u02c6<span class="_19 blank"></span>encias<span class="_18 blank"> </span>computacionais,<span class="_18 blank"> </span>quer<span class="_18 blank"> </span>sejam<span class="_18 blank"> </span>componentes<span class="_1b blank"> </span>f<span class="_b blank"></span>´<span class="_c blank"></span>\u0131sicos</div><div class="t m0 x11 h5 y34 ff5 fs2 fc0 sc0 ls0 ws2e">ou dados que foram processados eletronicamen<span class="_9 blank"></span>te e armazenados em m<span class="_a blank"></span>´<span class="_c blank"></span>\u0131dias computacionais</div><div class="t m0 x11 h5 y35 ff5 fs2 fc0 sc0 ls0 ws2f">[14, 17].</div><div class="t m0 x12 h5 y36 ff5 fs2 fc0 sc0 ls0 ws30">O<span class="_1c blank"> </span>prop´<span class="_19 blank"></span>osito<span class="_1c blank"> </span>do<span class="_1c blank"> </span>exame<span class="_1c blank"> </span>forense<span class="_1a blank"> </span>´<span class="_8 blank"></span>e<span class="_1c blank"> </span>a<span class="_1c blank"> </span>pro cura<span class="_1c blank"> </span>e<span class="_f blank"> </span>extra¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_1c blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="_1c blank"> </span>relacionadas<span class="_1c blank"> </span>com<span class="_1c blank"> </span>o<span class="_1c blank"> </span>caso</div><div class="t m0 x11 h5 y37 ff5 fs2 fc0 sc0 ls0 ws1b">in<span class="_9 blank"></span>v<span class="_9 blank"></span>estigado,<span class="_e blank"> </span>que<span class="_e blank"> </span>p ermitam<span class="_e blank"> </span>a<span class="_e blank"> </span>form<span class="_2 blank"></span>ula¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_e blank"> </span>de<span class="_e blank"> </span>conclus\u02dc<span class="_16 blank"></span>oes<span class="_e blank"> </span>acerca<span class="_e blank"> </span>da<span class="_e blank"> </span>infra¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_e blank"> </span>[9].<span class="_21 blank"> </span>Existem<span class="_e blank"> </span>duas</div><div class="t m0 x11 h5 y38 ff5 fs2 fc0 sc0 ls0 ws31">ab ordagens<span class="_e blank"> </span>no<span class="_10 blank"> </span>que<span class="_10 blank"> </span>diz<span class="_e blank"> </span>resp eito<span class="_10 blank"> </span>ao<span class="_e blank"> </span>ob<span class="_22 blank"> </span>jetiv<span class="_9 blank"></span>o<span class="_e blank"> </span>\ufb01nal<span class="_10 blank"> </span>da<span class="_10 blank"> </span>an´<span class="_16 blank"></span>alise<span class="_10 blank"> </span>forense.<span class="_1e blank"> </span>Na<span class="_e blank"> </span>primeira,<span class="_23 blank"> </span>a<span class="_e blank"> </span>an´<span class="_19 blank"></span>alise</div><div class="t m0 x11 h5 y39 ff5 fs2 fc0 sc0 ls0 ws32">forense<span class="_1c blank"> </span>busca<span class="_f blank"> </span>obter<span class="_f blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_f blank"> </span>v<span class="_2 blank"></span>alor<span class="_f blank"> </span>proban<span class="_9 blank"></span>te<span class="_1c blank"> </span>(co erente<span class="_1c blank"> </span>com<span class="_1c blank"> </span>as<span class="_f blank"> </span>regras<span class="_f blank"> </span>e<span class="_f blank"> </span>leis<span class="_f blank"> </span>das<span class="_f blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias</div><div class="t m0 x11 h5 y3a ff5 fs2 fc0 sc0 ls0 ws30">e<span class="_24 blank"> </span>admiss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el<span class="_24 blank"> </span>em<span class="_d blank"> </span>uma<span class="_24 blank"> </span>corte<span class="_24 blank"> </span>de<span class="_24 blank"> </span>justi¸<span class="_20 blank"></span>ca)<span class="_24 blank"> </span>a<span class="_24 blank"> </span>ser<span class="_24 blank"> </span>utilizada<span class="_24 blank"> </span>em<span class="_24 blank"> </span>um<span class="_24 blank"> </span>processo<span class="_24 blank"> </span>criminal.<span class="_5 blank"> </span>Na<span class="_24 blank"> </span>segunda</div><div class="t m0 x11 h5 y3b ff5 fs2 fc0 sc0 ls0 ws33">ab<span class="_17 blank"> </span>ordagem, o exame<span class="_1b blank"> </span>´<span class="_8 blank"></span>e realizado den<span class="_2 blank"></span>tro de uma corp<span class="_17 blank"> </span>ora¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao com o ob<span class="_17 blank"> </span>jetivo de determinar a cau<span class="_9 blank"></span>sa</div><div class="t m0 x11 h5 y3c ff5 fs2 fc0 sc0 ls0 ws34">de<span class="_d blank"> </span>um<span class="_24 blank"> </span>inciden<span class="_9 blank"></span>te<span class="_24 blank"> </span>e<span class="_d blank"> </span>assegurar<span class="_24 blank"> </span>que<span class="_24 blank"> </span>o<span class="_d blank"> </span>mesmo<span class="_24 blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_24 blank"> </span>o corra<span class="_24 blank"> </span>no<span class="_9 blank"></span>v<span class="_2 blank"></span>amen<span class="_9 blank"></span>te,<span class="_24 blank"> </span>sem<span class="_d blank"> </span>que<span class="_24 blank"> </span>ha<span class="_22 blank"> </span>ja<span class="_d blank"> </span>preo cupa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao</div><div class="t m0 x11 h5 y3d ff5 fs2 fc0 sc0 ls0 ws35">com formalidades legais.</div><div class="t m0 x12 h5 y3e ff5 fs2 fc0 sc0 ls0 ws36">Mesmo que n\u02dc<span class="_16 blank"></span>ao ha<span class="_22 blank"> </span>ja in<span class="_9 blank"></span>ten¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>ao de se institu<span class="_9 blank"></span>ir um pro<span class="_17 blank"> </span>cesso criminal, toda inv<span class="_2 blank"></span>estiga¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao deve</div><div class="t m0 x11 h5 y3f ff5 fs2 fc0 sc0 ls0 ws37">considerar como pr´<span class="_16 blank"></span>atica padr\u02dc<span class="_19 blank"></span>ao a utiliza¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao de meto<span class="_17 blank"> </span>dologias e prot<span class="_9 blank"></span>o<span class="_17 blank"> </span>colos que garan<span class="_9 blank"></span>tam sua</div><div class="t m0 x11 h5 y40 ff5 fs2 fc0 sc0 ls0 ws38">p<span class="_17 blank"> </span>oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el aceita¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao em uma corte de justi¸<span class="_20 blank"></span>ca [14].<span class="_5 blank"> </span>T<span class="_b blank"></span>ratar to<span class="_17 blank"> </span>do caso com a formalidade de um</div><div class="t m0 x11 h5 y41 ff5 fs2 fc0 sc0 ls0 ws39">pro<span class="_17 blank"> </span>cesso criminal a<span class="_17 blank"> </span>juda a desen<span class="_9 blank"></span>v<span class="_9 blank"></span>olv<span class="_9 blank"></span>er b<span class="_17 blank"> </span>ons h´<span class="_16 blank"></span>abitos de inv<span class="_2 blank"></span>estiga¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao.</div><div class="t m0 x12 h5 y42 ff5 fs2 fc0 sc0 ls0 ws3a">Nesse sen<span class="_9 blank"></span>tido, existem alguns asp<span class="_17 blank"> </span>ectos c<span class="_9 blank"></span>ha<span class="_9 blank"></span>v<span class="_9 blank"></span>e que constituem as etapas do processo de an´<span class="_19 blank"></span>alise</div><div class="t m0 x11 h5 y43 ff5 fs2 fc0 sc0 ls0 ws3b">forense de um sistema computacional [5]:</div><div class="t m0 x1 h5 y44 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws3c">coleta de informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_6 blank"> </span>(ou <span class="ff7 ws3d">information gathering</span><span class="wsd">);</span></span></div><div class="t m0 x1 h5 y45 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws3e">reconhecimen<span class="_9 blank"></span>to das evid<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encias;</span></div><div class="t m0 x1 h5 y46 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws3f">coleta,<span class="_f blank"> </span>restaura¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_f blank"> </span>do cumenta¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>e<span class="_f blank"> </span>preserv<span class="_2 blank"></span>a¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>das<span class="_f blank"> </span>evid\u02c6<span class="_19 blank"></span>encias<span class="_f blank"> </span>encontra<span class="_9 blank"></span>das;</span></div><div class="t m0 x1 h5 y47 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws40">correla¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao das evid\u02c6<span class="_19 blank"></span>encias;</span></div><div class="t m0 x1 h5 y48 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws41">reconstru¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao dos even<span class="_2 blank"></span>tos;</span></div><div class="t m0 x12 h5 y49 ff5 fs2 fc0 sc0 ls0 ws42">T<span class="_b blank"></span>o da<span class="_f blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>relev<span class="_2 blank"></span>ante<span class="_1c blank"> </span>dev<span class="_9 blank"></span>e<span class="_f blank"> </span>ser<span class="_1c blank"> </span>coletada<span class="_f blank"> </span>para<span class="_1c blank"> </span>an´<span class="_19 blank"></span>alise<span class="_f blank"> </span>e,<span class="_f blank"> </span>conforme<span class="_1c blank"> </span>as<span class="_f blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="_1c blank"> </span>digitais</div><div class="t m0 x11 h5 y4a ff5 fs2 fc0 sc0 ls0 ws43">s\u02dc<span class="_19 blank"></span>ao encon<span class="_9 blank"></span>tradas, elas devem ser extra<span class="_a blank"></span>´<span class="_c blank"></span>\u0131das, restauradas quando necess´<span class="_16 blank"></span>ario (evid\u02c6<span class="_19 blank"></span>encias dani\ufb01-</div><div class="t m0 x11 h5 y4b ff5 fs2 fc0 sc0 ls0 ws1b">cadas<span class="_24 blank"> </span>ou<span class="_e blank"> </span>cifradas,<span class="_e blank"> </span>p or<span class="_e blank"> </span>exemplo),<span class="_10 blank"> </span>documentadas<span class="_24 blank"> </span>e<span class="_24 blank"> </span>devidamente<span class="_d blank"> </span>preserv<span class="_2 blank"></span>adas.<span class="_21 blank"> </span>Em<span class="_e blank"> </span>seguida,<span class="_e blank"> </span>as</div><div class="t m0 x11 h5 y4c ff5 fs2 fc0 sc0 ls0 ws1b">evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="_6 blank"> </span>encontrad<span class="_9 blank"></span>as<span class="_d blank"> </span>p o dem<span class="_d blank"> </span>ser<span class="_d blank"> </span>correlacionadas,<span class="_d blank"> </span>p ermitindo<span class="_6 blank"> </span>a<span class="_d blank"> </span>reconstru¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_d blank"> </span>dos<span class="_d blank"> </span>even<span class="_2 blank"></span>tos<span class="_d blank"> </span>re-</div><div class="t m0 x11 h5 y4d ff5 fs2 fc0 sc0 ls0 ws44">lacionados ao ato il<span class="_a blank"></span>´<span class="_c blank"></span>\u0131cito.<span class="_25 blank"> </span>Muitas v<span class="_9 blank"></span>ezes a an´<span class="_16 blank"></span>alise das evid\u02c6<span class="_19 blank"></span>encias (correla¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao e reconstru¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao)</div><div class="t m0 x11 h5 y4e ff5 fs2 fc0 sc0 ls0 ws45">resulta na descoberta de nov<span class="_2 blank"></span>as informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes, formando um ciclo no pro<span class="_17 blank"> </span>cesso de an´<span class="_16 blank"></span>alise forense</div><div class="t m0 x14 h9 y4f ffb fs5 fc0 sc0 ls4">1<span class="ffc fs6 ls0 ws46 v2">Devido ao carater substancialmen<span class="_9 blank"></span>te t<span class="_9 blank"></span>´<span class="_7 blank"></span>ecnico deste trabalho,<span class="_6 blank"> </span>a linguagem adotada foi destitu<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131da de carac-</span></div><div class="t m0 x11 ha y50 ffc fs6 fc0 sc0 ls0 ws47">ter<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131sticas ju<span class="_9 blank"></span>r<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131dicas.<span class="_f blank"> </span>Nesse sentido, o termo \u201cevid<span class="_9 blank"></span>\u02c6<span class="_7 blank"></span>encia\u201d p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>de ser in<span class="_9 blank"></span>terpretado, sob o enfo<span class="_17 blank"> </span>que criminal<span class="_a blank"></span>´<span class="_26 blank"></span>\u0131stico, tanto</div><div class="t m0 x11 ha y51 ffc fs6 fc0 sc0 ls0 ws48">como<span class="_1a blank"> </span>vest<span class="_a blank"></span>´<span class="_26 blank"></span>\u0131gio quanto ind<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131cio,<span class="_1a blank"> </span>condicionado<span class="_1c blank"> </span>ao contexto em<span class="_1c blank"> </span>que o<span class="_1a blank"> </span>termo ´<span class="_c blank"></span>e utilizado.</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf3" class="pf w0 h0" data-page-no="3"><div class="pc pc3 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y52 w1 hb" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg3.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 ws49">2. <span class="ff5 ws4a">Mo dus<span class="_f blank"> </span>op erandi<span class="_27 blank"> </span>3</span></div><div class="t m0 x11 h5 y2a ff5 fs2 fc0 sc0 ls0 ws4b">[5].<span class="_28 blank"> </span>Devido<span class="_24 blank"> </span>a<span class="_24 blank"> </span>sua<span class="_e blank"> </span>imp ort\u02c6<span class="_19 blank"></span>ancia,<span class="_e blank"> </span>o<span class="_24 blank"> </span><span class="ff7 ws4c">fr<span class="_9 blank"></span>amework <span class="ff5 ws30">geral<span class="_24 blank"> </span>do<span class="_24 blank"> </span>pro cesso<span class="_e blank"> </span>de<span class="_24 blank"> </span>an´<span class="_19 blank"></span>alise<span class="_24 blank"> </span>forense<span class="_24 blank"> </span>´<span class="_8 blank"></span>e<span class="_24 blank"> </span>discutido</span></span></div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 ws4d">detalhadamen<span class="_9 blank"></span>te na se¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao 5.</div><div class="t m0 x12 h5 y2c ff5 fs2 fc0 sc0 ls0 ws1b">A<span class="_6 blank"> </span>forense<span class="_f blank"> </span>computacional<span class="_f blank"> </span>´<span class="_8 blank"></span>e<span class="_f blank"> </span>uma<span class="_6 blank"> </span>´<span class="_19 blank"></span>area<span class="_6 blank"> </span>de<span class="_6 blank"> </span>p esquisa<span class="_f blank"> </span>relativ<span class="_2 blank"></span>amente<span class="_f blank"> </span>recen<span class="_9 blank"></span>te,<span class="_6 blank"> </span>en<span class="_9 blank"></span>tretan<span class="_9 blank"></span>to,<span class="_1c blank"> </span>´<span class="_8 blank"></span>e<span class="_6 blank"> </span>cres-</div><div class="t m0 x11 h5 y2d ff5 fs2 fc0 sc0 ls0 ws4e">cen<span class="_9 blank"></span>te a necessidade de desen<span class="_2 blank"></span>volvimen<span class="_2 blank"></span>to nesse camp<span class="_17 blank"> </span>o,<span class="_1a blank"> </span>uma v<span class="_9 blank"></span>ez que a utiliza¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de computadores</div><div class="t m0 x11 h5 y2e ff5 fs2 fc0 sc0 ls0 ws4f">em atividades criminosas tem se tornado uma pr´<span class="_16 blank"></span>atica com<span class="_9 blank"></span>um.<span class="_e blank"> </span>Os computadores atingiram cri-</div><div class="t m0 x11 h5 y2f ff5 fs2 fc0 sc0 ls0 ws50">mes tradicionais, como extors\u02dc<span class="_19 blank"></span>ao,<span class="_10 blank"> </span>roubo e tr´<span class="_19 blank"></span>a\ufb01co de drogas, e tamb<span class="_2 blank"></span>´<span class="_8 blank"></span>em originaram uma no<span class="_9 blank"></span>v<span class="_2 blank"></span>a</div><div class="t m0 x11 h5 y30 ff5 fs2 fc0 sc0 ls0 ws51">classe de crimes, conhecidos como \u201ccrimes da In<span class="_9 blank"></span>ternet\u201d, como ataques de nega¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de servi¸<span class="_20 blank"></span>co,</div><div class="t m0 x11 h5 y31 ff5 fs2 fc0 sc0 ls0 ws52">in<span class="_9 blank"></span>v<span class="_2 blank"></span>as\u02dc<span class="_19 blank"></span>ao de sistemas e dissemina¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de v<span class="_b blank"></span>´<span class="_c blank"></span>\u0131rus de computad<span class="_9 blank"></span>or.</div><div class="t m0 x12 h5 y32 ff5 fs2 fc0 sc0 ls0 ws53">O<span class="_1c blank"> </span>escop o<span class="_f blank"> </span>deste<span class="_f blank"> </span>trabalho<span class="_1c blank"> </span>restringe-se<span class="_1c blank"> </span>`<span class="_19 blank"></span>a<span class="_f blank"> </span>inv<span class="_2 blank"></span>estiga¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_1c blank"> </span>uma<span class="_f blank"> </span>categoria<span class="_1c blank"> </span>de<span class="_f blank"> </span>crime<span class="_f blank"> </span>onde<span class="_1c blank"> </span>o<span class="_f blank"> </span>com-</div><div class="t m0 x11 h5 y33 ff5 fs2 fc0 sc0 ls0 ws54">putador<span class="_18 blank"> </span>´<span class="_8 blank"></span>e o alvo, com<span class="_2 blank"></span>umente denominada<span class="_1a blank"> </span>de in<span class="_9 blank"></span>trus\u02dc<span class="_16 blank"></span>ao de sistemas.<span class="_e blank"> </span>Com o adven<span class="_2 blank"></span>to da Internet,</div><div class="t m0 x11 h5 y34 ff5 fs2 fc0 sc0 ls0 ws55">ataques remotos a sistemas computacionais tornaram<span class="_9 blank"></span>-se mais com<span class="_9 blank"></span>uns,<span class="_10 blank"> </span>tirando v<span class="_2 blank"></span>an<span class="_9 blank"></span>tagem da</div><div class="t m0 x11 h5 y35 ff5 fs2 fc0 sc0 ls0 ws56">crescen<span class="_9 blank"></span>te complexidade e vulnerabilidade dos servi¸<span class="_8 blank"></span>cos de rede [14].<span class="_10 blank"> </span>O aumen<span class="_9 blank"></span>to na so\ufb01stica¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao</div><div class="t m0 x11 h5 y36 ff5 fs2 fc0 sc0 ls0 ws57">e frequ<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia com que esses ataques t<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>em o<span class="_17 blank"> </span>corrido represen<span class="_9 blank"></span>ta um desa\ufb01o crescen<span class="_2 blank"></span>te para os en-</div><div class="t m0 x11 h5 y37 ff5 fs2 fc0 sc0 ls0 ws58">carregados<span class="_f blank"> </span>de<span class="_f blank"> </span>in<span class="_9 blank"></span>v<span class="_9 blank"></span>estigar<span class="_f blank"> </span>e<span class="_f blank"> </span>resp onder<span class="_f blank"> </span>a<span class="_f blank"> </span>esses<span class="_f blank"> </span>inciden<span class="_9 blank"></span>tes.</div><div class="t m0 x12 h5 y38 ff5 fs2 fc0 sc0 ls0 ws59">Este trabalho apresen<span class="_9 blank"></span>ta uma discuss\u02dc<span class="_16 blank"></span>ao detalhada sobre a in<span class="_9 blank"></span>v<span class="_9 blank"></span>estiga¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao forense de intrus\u02dc<span class="_16 blank"></span>oes</div><div class="t m0 x11 h5 y39 ff5 fs2 fc0 sc0 ls0 ws1b">em<span class="_d blank"> </span>sistemas<span class="_6 blank"> </span>computacionais.<span class="_1d blank"> </span>Em<span class="_9 blank"></span>bora<span class="_d blank"> </span>o<span class="_d blank"> </span>enfo que<span class="_d blank"> </span>principal<span class="_d blank"> </span>seja<span class="_d blank"> </span>dado<span class="_d blank"> </span>`<span class="_19 blank"></span>a<span class="_d blank"> </span>an´<span class="_19 blank"></span>alise<span class="_d blank"> </span>de<span class="_6 blank"> </span>inv<span class="_2 blank"></span>as\u02dc<span class="_16 blank"></span>oes<span class="_d blank"> </span>em</div><div class="t m0 x11 h5 y3a ff5 fs2 fc0 sc0 ls0 ws5a">am<span class="_9 blank"></span>bien<span class="_9 blank"></span>tes Lin<span class="_9 blank"></span>ux, m<span class="_9 blank"></span>uitos dos conceitos e t<span class="_9 blank"></span>´<span class="_19 blank"></span>ecnicas apresentados nest<span class="_9 blank"></span>e trabalho p<span class="_17 blank"> </span>odem ser aplica-</div><div class="t m0 x11 h5 y3b ff5 fs2 fc0 sc0 ls0 ws5b">dos `<span class="_19 blank"></span>a in<span class="_9 blank"></span>v<span class="_9 blank"></span>estiga¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao forense de outros tip<span class="_17 blank"> </span>os de crimes e extendidos a outras plataf<span class="_9 blank"></span>ormas, como o</div><div class="t m0 x11 h5 y3c ff5 fs2 fc0 sc0 ls0 ws1b">Windo<span class="_9 blank"></span>ws<span class="_18 blank"> </span>e<span class="_1a blank"> </span>outros<span class="_18 blank"> </span>sistemas<span class="_1a blank"> </span>da<span class="_1a blank"> </span>fam<span class="_a blank"></span>´<span class="_c blank"></span>\u0131lia<span class="_18 blank"> </span>UNIX<span class="_1a blank"> </span>(Solaris<span class="_18 blank"> </span>e<span class="_1a blank"> </span>BSD,<span class="_1a blank"> </span>p or<span class="_18 blank"> </span>exemplo).<span class="_e blank"> </span>O<span class="_18 blank"> </span>ob<span class="_22 blank"> </span>jetiv<span class="_9 blank"></span>o<span class="_18 blank"> </span>principal</div><div class="t m0 x11 h5 y3d ff5 fs2 fc0 sc0 ls0 ws3f">deste<span class="_6 blank"> </span>trabalho<span class="_f blank"> </span>´<span class="_8 blank"></span>e<span class="_6 blank"> </span>fornecer<span class="_6 blank"> </span>uma<span class="_6 blank"> </span>descri¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_6 blank"> </span>detalhada<span class="_d blank"> </span>sobre<span class="_6 blank"> </span>onde,<span class="_6 blank"> </span>como<span class="_6 blank"> </span>e<span class="_d blank"> </span>o<span class="_6 blank"> </span>qu\u02c6<span class="_19 blank"></span>e<span class="_6 blank"> </span>pro curar<span class="_d blank"> </span>em<span class="_6 blank"> </span>um</div><div class="t m0 x11 h5 y3e ff5 fs2 fc0 sc0 ls0 ws5c">sistema computacional in<span class="_2 blank"></span>v<span class="_2 blank"></span>adido.<span class="_28 blank"> </span>Para tal, s\u02dc<span class="_19 blank"></span>ao apresen<span class="_9 blank"></span>tadas div<span class="_9 blank"></span>ersas t<span class="_9 blank"></span>´<span class="_19 blank"></span>ecnicas,<span class="_10 blank"> </span>ferramen<span class="_2 blank"></span>tas e</div><div class="t m0 x11 h5 y3f ff5 fs2 fc0 sc0 ls0 ws5d">pro cedimen<span class="_9 blank"></span>tos,<span class="_1c blank"> </span>com<span class="_f blank"> </span>exemplos<span class="_f blank"> </span>pr´<span class="_19 blank"></span>aticos<span class="_f blank"> </span>que<span class="_f blank"> </span>facilitam<span class="_f blank"> </span>a<span class="_6 blank"> </span>compreens\u02dc<span class="_16 blank"></span>ao.</div><div class="t m0 x12 h5 y40 ff5 fs2 fc0 sc0 ls0 ws5e">A<span class="_10 blank"> </span>organiza¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_10 blank"> </span>deste<span class="_10 blank"> </span>trabalho ´<span class="_8 blank"></span>e<span class="_10 blank"> </span>apresen<span class="_9 blank"></span>tada como<span class="_10 blank"> </span>segue.<span class="_25 blank"> </span>A<span class="_10 blank"> </span>se¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_10 blank"> </span>2<span class="_10 blank"> </span>discute<span class="_10 blank"> </span>brev<span class="_9 blank"></span>emen<span class="_9 blank"></span>te</div><div class="t m0 x11 h5 y41 ff5 fs2 fc0 sc0 ls0 ws5f">os ob<span class="_17 blank"> </span>jetivos e m<span class="_2 blank"></span>´<span class="_8 blank"></span>eto<span class="_17 blank"> </span>dos de op<span class="_17 blank"> </span>era¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao dos inv<span class="_2 blank"></span>asores.<span class="_1d blank"> </span>Na se¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao 3 s\u02dc<span class="_19 blank"></span>ao apresentad<span class="_9 blank"></span>as as principais</div><div class="t m0 x11 h5 y42 ff5 fs2 fc0 sc0 ls0 ws60">fon<span class="_9 blank"></span>tes de informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de um sistema computacional, evidenciando, em cada uma,<span class="_24 blank"> </span>os m<span class="_9 blank"></span>´<span class="_8 blank"></span>eto<span class="_17 blank"> </span>dos</div><div class="t m0 x11 h5 y43 ff5 fs2 fc0 sc0 ls0 ws61">de extra¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao das informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes e as evid\u02c6<span class="_19 blank"></span>encias digitais mais com<span class="_9 blank"></span>umen<span class="_9 blank"></span>te encon<span class="_2 blank"></span>tradas.<span class="_5 blank"> </span>Algumas</div><div class="t m0 x11 h5 y53 ff5 fs2 fc0 sc0 ls0 ws62">quest\u02dc<span class="_19 blank"></span>oes<span class="_6 blank"> </span>sobre<span class="_d blank"> </span>o<span class="_6 blank"> </span>correlacionamen<span class="_9 blank"></span>to<span class="_6 blank"> </span>de<span class="_d blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="_6 blank"> </span>s\u02dc<span class="_19 blank"></span>ao<span class="_d blank"> </span>ab ordadas<span class="_6 blank"> </span>na<span class="_d blank"> </span>se¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_6 blank"> </span>4<span class="_d blank"> </span>e<span class="_6 blank"> </span>o<span class="_d blank"> </span><span class="ff7 ws63">fr<span class="_2 blank"></span>amework <span class="ff5 wsd">do</span></span></div><div class="t m0 x11 h5 y54 ff5 fs2 fc0 sc0 ls0 ws28">pro cesso<span class="_1a blank"> </span>de<span class="_1a blank"> </span>in<span class="_9 blank"></span>v<span class="_9 blank"></span>estiga¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1a blank"> </span>forense<span class="_18 blank"> </span>´<span class="_8 blank"></span>e<span class="_1a blank"> </span>discutido<span class="_1a blank"> </span>na<span class="_1a blank"> </span>se¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1a blank"> </span>5.<span class="_e blank"> </span>A<span class="_1a blank"> </span>se¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1a blank"> </span>6<span class="_1a blank"> </span>ab orda<span class="_1a blank"> </span>a<span class="_1a blank"> </span>quest\u02dc<span class="_19 blank"></span>ao<span class="_1a blank"> </span>do<span class="_1a blank"> </span>conjunt<span class="_9 blank"></span>o</div><div class="t m0 x11 h5 y55 ff5 fs2 fc0 sc0 ls0 ws1b">de<span class="_f blank"> </span>ferramen<span class="_9 blank"></span>tas<span class="_f blank"> </span>do<span class="_f blank"> </span>in<span class="_9 blank"></span>v<span class="_9 blank"></span>estigador<span class="_f blank"> </span>e,<span class="_f blank"> </span>p or<span class="_f blank"> </span>\ufb01m,<span class="_f blank"> </span>algumas<span class="_f blank"> </span>conclus\u02dc<span class="_19 blank"></span>oes<span class="_f blank"> </span>s\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>apresen<span class="_9 blank"></span>tadas<span class="_f blank"> </span>na<span class="_f blank"> </span>se¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>7.</div><div class="t m0 x11 h6 y56 ff6 fs3 fc0 sc0 ls5">2<span class="ffd ls0 ws64">Mo<span class="_b blank"></span>dus op<span class="_b blank"></span>er<span class="_2 blank"></span>andi</span></div><div class="t m0 x11 h5 y57 ff5 fs2 fc0 sc0 ls0 ws65">No<span class="_9 blank"></span>v<span class="_2 blank"></span>as formas de in<span class="_9 blank"></span>v<span class="_2 blank"></span>adir e in<span class="_9 blank"></span>terferir com computadores s\u02dc<span class="_16 blank"></span>ao desen<span class="_9 blank"></span>v<span class="_9 blank"></span>olvidas a cada dia.<span class="_1d blank"> </span>Com o</div><div class="t m0 x11 h5 y58 ff5 fs2 fc0 sc0 ls0 ws66">m<span class="_a blank"></span>´<span class="_c blank"></span>\u0131nimo de conhecimen<span class="_9 blank"></span>to de redes de computado<span class="_9 blank"></span>res, praticamen<span class="_9 blank"></span>te qualquer um p<span class="_17 blank"> </span>ode obter gra-</div><div class="t m0 x11 h5 y59 ff5 fs2 fc0 sc0 ls0 ws67">tuitamen<span class="_9 blank"></span>te<span class="_18 blank"> </span>na<span class="_18 blank"> </span>Internet<span class="_1b blank"> </span>e<span class="_1a blank"> </span>utilizar<span class="_18 blank"> </span>ferramen<span class="_9 blank"></span>tas<span class="_18 blank"> </span>para<span class="_1a blank"> </span>in<span class="_9 blank"></span>v<span class="_2 blank"></span>adir<span class="_18 blank"> </span>um<span class="_18 blank"> </span>sistema<span class="_18 blank"> </span>computacional<span class="_18 blank"> </span>e<span class="_1a blank"> </span>pro<span class="_9 blank"></span>v<span class="_9 blank"></span>o car</div><div class="t m0 x11 h5 y5a ff5 fs2 fc0 sc0 ls0 ws68">to<span class="_17 blank"> </span>do tipo de estrago.<span class="_5 blank"> </span>O n<span class="_17 blank"> </span>´<span class="_16 blank"></span>umero de ataques externos a uma organ<span class="_9 blank"></span>iza¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao tem crescido consi-</div><div class="t m0 x11 h5 y5b ff5 fs2 fc0 sc0 ls0 ws45">dera<span class="_9 blank"></span>v<span class="_9 blank"></span>elmen<span class="_9 blank"></span>te, equiparando-se `<span class="_16 blank"></span>a quantid<span class="_9 blank"></span>ade de ataques cometidos por indiv<span class="_b blank"></span>´<span class="_c blank"></span>\u0131duos de den<span class="_2 blank"></span>tro da</div><div class="t m0 x11 h5 y5c ff5 fs2 fc0 sc0 ls0 ws69">pr´<span class="_19 blank"></span>opria organiza¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao [5].<span class="_e blank"> </span>A intru<span class="_9 blank"></span>s\u02dc<span class="_19 blank"></span>ao de sistemas tem sido considerada um risco `<span class="_16 blank"></span>a seguran¸<span class="_20 blank"></span>ca naci-</div><div class="t m0 x11 h5 y5d ff5 fs2 fc0 sc0 ls0 ws6a">onal<span class="_1a blank"> </span>em<span class="_1c blank"> </span>m<span class="_2 blank"></span>uitos<span class="_1c blank"> </span>pa<span class="_a blank"></span>´<span class="_c blank"></span>\u0131ses,<span class="_1a blank"> </span>de<span class="_1c blank"> </span>modo<span class="_1c blank"> </span>que<span class="_1a blank"> </span>a<span class="_1a blank"> </span>compreens\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>acerca<span class="_1a blank"> </span>dos<span class="_1a blank"> </span>ob<span class="_22 blank"> </span>jetiv<span class="_2 blank"></span>os<span class="_1c blank"> </span>e<span class="_1a blank"> </span>m´<span class="_19 blank"></span>eto dos<span class="_1a blank"> </span>empregados</div><div class="t m0 x11 h5 y5e ff5 fs2 fc0 sc0 ls0 ws6b">nesses inciden<span class="_9 blank"></span>tes tem se tornado alv<span class="_2 blank"></span>o de muitos estudos [5, 1<span class="_9 blank"></span>4].</div><div class="t m0 x12 h5 y5f ff7 fs2 fc0 sc0 ls0 ws6c">Mo<span class="_2 blank"></span>dus<span class="_23 blank"> </span>op<span class="_9 blank"></span>er<span class="_2 blank"></span>andi <span class="ff5 ws28">´<span class="_8 blank"></span>e<span class="_10 blank"> </span>um<span class="_23 blank"> </span>termo<span class="_23 blank"> </span>em<span class="_10 blank"> </span>latin<span class="_23 blank"> </span>que<span class="_23 blank"> </span>signi\ufb01ca<span class="_10 blank"> </span>\u201cm´<span class="_19 blank"></span>eto do<span class="_23 blank"> </span>de<span class="_23 blank"> </span>op era¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao\u201d.<span class="_3 blank"> </span>En<span class="_9 blank"></span>tender<span class="_10 blank"> </span>a</span></div><div class="t m0 x11 h5 y60 ff5 fs2 fc0 sc0 ls0 ws1b">motiv<span class="_2 blank"></span>a¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>ao<span class="_6 blank"> </span>e<span class="_24 blank"> </span>o<span class="_d blank"> </span>comp ortamento<span class="_6 blank"> </span>de<span class="_24 blank"> </span>um<span class="_d blank"> </span>in<span class="_9 blank"></span>truso<span class="_6 blank"> </span>´<span class="_8 blank"></span>e<span class="_d blank"> </span>um<span class="_24 blank"> </span>p on<span class="_9 blank"></span>to<span class="_d blank"> </span>c<span class="_9 blank"></span>ha<span class="_9 blank"></span>v<span class="_9 blank"></span>e<span class="_d blank"> </span>para<span class="_d blank"> </span>orientar<span class="_6 blank"> </span>a<span class="_24 blank"> </span>in<span class="_9 blank"></span>v<span class="_9 blank"></span>estiga¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,</div><div class="t m0 x11 h5 y61 ff5 fs2 fc0 sc0 ls0 ws6d">p<span class="_17 blank"> </span>ois essa compreens\u02dc<span class="_16 blank"></span>ao fornece pistas sobre onde e o qu<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>e procurar duran<span class="_9 blank"></span>te a an´<span class="_19 blank"></span>alise forense [5].</div><div class="t m0 x11 h5 y62 ff5 fs2 fc0 sc0 ls0 ws6e">Quan<span class="_9 blank"></span>to<span class="_24 blank"> </span>maior<span class="_24 blank"> </span>a<span class="_24 blank"> </span>consci\u02c6<span class="_19 blank"></span>encia<span class="_24 blank"> </span>acerca<span class="_e blank"> </span>dos<span class="_24 blank"> </span>ob jetiv<span class="_9 blank"></span>os<span class="_24 blank"> </span>e<span class="_24 blank"> </span><span class="ff7 ws6f">mo<span class="_2 blank"></span>dus<span class="_10 blank"> </span>op<span class="_2 blank"></span>er<span class="_2 blank"></span>andi <span class="ff5 ws70">de um atacan<span class="_9 blank"></span>te,<span class="_e blank"> </span>maior o</span></span></div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf4" class="pf w0 h0" data-page-no="4"><div class="pc pc4 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y52 w1 hb" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg4.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 ws49">2. <span class="ff5 ws4a">Mo dus<span class="_f blank"> </span>op erandi<span class="_27 blank"> </span>4</span></div><div class="t m0 x11 h5 y2a ff5 fs2 fc0 sc0 ls0 ws58">preparo<span class="_f blank"> </span>do<span class="_f blank"> </span>in<span class="_9 blank"></span>v<span class="_9 blank"></span>estigador<span class="_1c blank"> </span>para<span class="_f blank"> </span>analisar<span class="_f blank"> </span>e<span class="_6 blank"> </span>resp onder<span class="_1c blank"> </span>a<span class="_6 blank"> </span>um<span class="_f blank"> </span>inciden<span class="_2 blank"></span>te<span class="_f blank"> </span>[14].</div><div class="t m0 x12 h5 y2b ff5 fs2 fc0 sc0 ls0 ws1d">A<span class="_6 blank"> </span>in<span class="_9 blank"></span>v<span class="_2 blank"></span>as\u02dc<span class="_19 blank"></span>ao<span class="_6 blank"> </span>de<span class="_d blank"> </span>sistemas<span class="_6 blank"> </span>computacionais<span class="_6 blank"> </span>o corre<span class="_6 blank"> </span>com<span class="_6 blank"> </span>\ufb01nalidades<span class="_6 blank"> </span>diversas,<span class="_f blank"> </span>p o dendo<span class="_d blank"> </span>ser<span class="_6 blank"> </span>desta-</div><div class="t m0 x11 h5 y2c ff5 fs2 fc0 sc0 ls0 ws71">cadas as seguin<span class="_9 blank"></span>tes:</div><div class="t m0 x1 h5 y63 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws72">obten¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes (roub<span class="_17 blank"> </span>o de segredos,<span class="_23 blank"> </span>n<span class="_17 blank"> </span>´<span class="_16 blank"></span>umeros de cart\u02dc<span class="_16 blank"></span>oes de cr<span class="_9 blank"></span>´<span class="_8 blank"></span>edito,<span class="_10 blank"> </span>senhas e</span></div><div class="t m0 x0 h5 y64 ff5 fs2 fc0 sc0 ls0 ws73">outros dados relev<span class="_2 blank"></span>an<span class="_9 blank"></span>tes ao in<span class="_9 blank"></span>truso);</div><div class="t m0 x1 h5 y65 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws74">promo<span class="_9 blank"></span>v<span class="_9 blank"></span>er algum estrago (\u201cpic<span class="_9 blank"></span>ha¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao\u201d de <span class="ff7 ws75">sites</span><span class="ws76">, destrui¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao de informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes e paralisa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao do</span></span></div><div class="t m0 x0 h5 y66 ff5 fs2 fc0 sc0 ls0 ws1b">sistema,<span class="_f blank"> </span>p or<span class="_f blank"> </span>exemplo);</div><div class="t m0 x1 h5 y67 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws1d">utiliza¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_6 blank"> </span>dos<span class="_6 blank"> </span>recursos<span class="_f blank"> </span>do<span class="_6 blank"> </span>sistema<span class="_f blank"> </span>(rep osit´<span class="_19 blank"></span>orio<span class="_6 blank"> </span>de<span class="_6 blank"> </span>dados,<span class="_f blank"> </span>dissemina¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_6 blank"> </span>ataques<span class="_6 blank"> </span>distri-</span></div><div class="t m0 x0 h5 y68 ff5 fs2 fc0 sc0 ls0 ws1b">bu<span class="_a blank"></span>´<span class="_c blank"></span>\u0131dos,<span class="_f blank"> </span>pro<span class="_9 blank"></span>vimen<span class="_9 blank"></span>to<span class="_1c blank"> </span>de<span class="_6 blank"> </span>servi¸<span class="_8 blank"></span>cos,<span class="_f blank"> </span>p or<span class="_6 blank"> </span>exemplo);</div><div class="t m0 x12 h5 y69 ff5 fs2 fc0 sc0 ls0 ws77">Dep endendo<span class="_e blank"> </span>da<span class="_10 blank"> </span>\ufb01nalidade<span class="_e blank"> </span>e<span class="_10 blank"> </span>da<span class="_e blank"> </span>habilidade,<span class="_23 blank"> </span>o<span class="_e blank"> </span><span class="ff7 ws78">mo<span class="_9 blank"></span>dus op<span class="_2 blank"></span>er<span class="_9 blank"></span>andi <span class="ff5 ws79">de um in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor po<span class="_17 blank"> </span>de sofrer</span></span></div><div class="t m0 x11 h5 y6a ff5 fs2 fc0 sc0 ls0 ws1b">algumas<span class="_1a blank"> </span>v<span class="_2 blank"></span>aria¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes.<span class="_e blank"> </span>Entretan<span class="_2 blank"></span>to,<span class="_1c blank"> </span>os<span class="_1a blank"> </span>passos<span class="_1c blank"> </span>tomados<span class="_1a blank"> </span>p elo<span class="_1a blank"> </span>atacant<span class="_9 blank"></span>e<span class="_1c blank"> </span>para<span class="_1a blank"> </span>comprometer<span class="_1a blank"> </span>um<span class="_1a blank"> </span>sistema</div><div class="t m0 x11 h5 y6b ff5 fs2 fc0 sc0 ls0 ws1b">computacional<span class="_1c blank"> </span>p o dem<span class="_f blank"> </span>ser<span class="_6 blank"> </span>generalizados<span class="_1c blank"> </span>como<span class="_f blank"> </span>segue<span class="_f blank"> </span>[5,<span class="_6 blank"> </span>14]:</div><div class="t m0 x1 h5 y6c ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws41">iden<span class="_9 blank"></span>ti\ufb01ca¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao do alvo;</span></div><div class="t m0 x1 h5 y6d ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws7a">busca de vulnerabilidades no alv<span class="_2 blank"></span>o (<span class="ff7 ws75">pr<span class="_2 blank"></span>obing<span class="ff5 wsd">);</span></span></span></div><div class="t m0 x1 h5 y6e ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws3e">comprometimen<span class="_9 blank"></span>to inicial;</span></div><div class="t m0 x1 h5 y6f ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws7b">aumen<span class="_9 blank"></span>to de privil<span class="_2 blank"></span>´<span class="_8 blank"></span>egio;</span></div><div class="t m0 x1 h5 y70 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws7c">tornar-se \u201cin<span class="_9 blank"></span>vis<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el\u201d (<span class="ff7 ws75">ste<span class="_2 blank"></span>alth<span class="ff5 wsd">);</span></span></span></div><div class="t m0 x1 h5 y71 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws3e">reconhecimen<span class="_9 blank"></span>to do sistema (<span class="ff7 ws75">r<span class="_2 blank"></span>e<span class="_2 blank"></span>c<span class="_2 blank"></span>onnaissanc<span class="_2 blank"></span>e<span class="ff5 wsd">);</span></span></span></div><div class="t m0 x1 h5 y72 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws7d">instala¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de <span class="ff7 ws7e">b<span class="_9 blank"></span>ack do<span class="_2 blank"></span>ors<span class="ff5">;</span></span></span></div><div class="t m0 x1 h5 y73 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws1d">limp eza<span class="_f blank"> </span>dos<span class="_f blank"> </span>rastros;</span></div><div class="t m0 x1 h5 y74 ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws1b">retorno<span class="_f blank"> </span>p or<span class="_f blank"> </span>uma<span class="_f blank"> </span><span class="ff7 ws7f">b<span class="_2 blank"></span>ack do<span class="_2 blank"></span>or<span class="ff5 ws80">, inv<span class="_2 blank"></span>ent´<span class="_16 blank"></span>ario e comprometimen<span class="_9 blank"></span>to de m´<span class="_19 blank"></span>aquinas vizinhas;</span></span></span></div><div class="t m0 x12 h5 y75 ff5 fs2 fc0 sc0 ls0 ws81">A<span class="_f blank"> </span>primeira<span class="_f blank"> </span>atitude<span class="_f blank"> </span>do<span class="_f blank"> </span>atacan<span class="_9 blank"></span>te<span class="_1c blank"> </span>´<span class="_8 blank"></span>e<span class="_f blank"> </span>a<span class="_f blank"> </span>escolha<span class="_f blank"> </span>de<span class="_f blank"> </span>um<span class="_f blank"> </span>alvo<span class="_1c blank"> </span>em<span class="_f blank"> </span>p otencial.<span class="_10 blank"> </span>Ap´<span class="_16 blank"></span>os<span class="_f blank"> </span>a<span class="_6 blank"> </span>lo caliza¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_6 blank"> </span>o</div><div class="t m0 x11 h5 y76 ff5 fs2 fc0 sc0 ls0 ws82">atacan<span class="_9 blank"></span>te come¸<span class="_8 blank"></span>ca a reunir informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes sobre o sistema alv<span class="_9 blank"></span>o a \ufb01m de iden<span class="_2 blank"></span>ti\ufb01car vulnerabilidades</div><div class="t m0 x11 h5 y77 ff5 fs2 fc0 sc0 ls0 ws1d">no<span class="_e blank"> </span>sistema<span class="_10 blank"> </span>op eracional<span class="_e blank"> </span>ou<span class="_10 blank"> </span>servi¸<span class="_8 blank"></span>cos<span class="_10 blank"> </span>de<span class="_e blank"> </span>rede<span class="_10 blank"> </span>disp on<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>eis.<span class="_1e blank"> </span>Se<span class="_e blank"> </span>o<span class="_e blank"> </span>inv<span class="_2 blank"></span>asor<span class="_e blank"> </span>ainda<span class="_10 blank"> </span>n\u02dc<span class="_16 blank"></span>ao<span class="_10 blank"> </span>p ossui<span class="_e blank"> </span>uma</div><div class="t m0 x11 h5 y78 ff5 fs2 fc0 sc0 ls0 ws83">com<span class="_9 blank"></span>bina¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_6 blank"> </span>de<span class="_6 blank"> </span>usu´<span class="_19 blank"></span>ario<span class="_f blank"> </span>e<span class="_6 blank"> </span>senha<span class="_f blank"> </span>v´<span class="_19 blank"></span>alida<span class="_6 blank"> </span>para<span class="_6 blank"> </span>o<span class="_f blank"> </span>sistema<span class="_6 blank"> </span>alv<span class="_9 blank"></span>o,<span class="_f blank"> </span>ele<span class="_6 blank"> </span>utiliza<span class="_f blank"> </span>m´<span class="_19 blank"></span>eto dos<span class="_6 blank"> </span>como<span class="_f blank"> </span><span class="ff7 ws84">sni\ufb03ng </span>e</div><div class="t m0 x11 h5 y79 ff5 fs2 fc0 sc0 ls0 ws3f">adivinha¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_f blank"> </span>senhas,<span class="_f blank"> </span>engenharia<span class="_f blank"> </span>so cial<span class="_f blank"> </span>ou<span class="_f blank"> </span><span class="ff7 ws85">sc<span class="_9 blank"></span>anning <span class="ff5 ws1d">para<span class="_1c blank"> </span>encontrar<span class="_1c blank"> </span>um<span class="_f blank"> </span>p onto<span class="_1c blank"> </span>de<span class="_f blank"> </span>entrada<span class="_9 blank"></span>.</span></span></div><div class="t m0 x12 h5 y7a ff5 fs2 fc0 sc0 ls0 ws1b">Uma<span class="_10 blank"> </span>v<span class="_9 blank"></span>ez<span class="_e blank"> </span>encontrado<span class="_e blank"> </span>um<span class="_10 blank"> </span>p on<span class="_9 blank"></span>to<span class="_10 blank"> </span>de<span class="_10 blank"> </span>en<span class="_9 blank"></span>trada<span class="_e blank"> </span>(conta<span class="_e blank"> </span>de<span class="_10 blank"> </span>usu´<span class="_19 blank"></span>ario<span class="_10 blank"> </span>ou<span class="_e blank"> </span>vulnerabilidade<span class="_10 blank"> </span>em<span class="_10 blank"> </span>um</div><div class="t m0 x11 h5 y7b ff5 fs2 fc0 sc0 ls0 ws1b">servi¸<span class="_8 blank"></span>co,<span class="_24 blank"> </span>p or<span class="_24 blank"> </span>exemplo)<span class="_d blank"> </span>o<span class="_24 blank"> </span>in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor<span class="_d blank"> </span>realiza<span class="_d blank"> </span>o<span class="_24 blank"> </span>comprometimen<span class="_9 blank"></span>to<span class="_6 blank"> </span>inicial<span class="_24 blank"> </span>do<span class="_d blank"> </span>sistema.<span class="_29 blank"> </span>Essa<span class="_d blank"> </span>primeira</div><div class="t m0 x11 h5 y7c ff5 fs2 fc0 sc0 ls0 ws86">in<span class="_9 blank"></span>trus\u02dc<span class="_16 blank"></span>ao geralmente pro<span class="_2 blank"></span>voca muito \u201cbarul<span class="_9 blank"></span>ho\u201d, esp<span class="_17 blank"> </span>ecialmen<span class="_9 blank"></span>te se o sistema alv<span class="_2 blank"></span>o estiver devida-</div><div class="t m0 x11 h5 y7d ff5 fs2 fc0 sc0 ls0 ws87">men<span class="_9 blank"></span>te<span class="_f blank"> </span>guarnecido,<span class="_6 blank"> </span>e<span class="_f blank"> </span>costuma<span class="_6 blank"> </span>o correr<span class="_f blank"> </span>quando<span class="_6 blank"> </span>ningu<span class="_9 blank"></span>´<span class="_8 blank"></span>em<span class="_f blank"> </span>est´<span class="_19 blank"></span>a<span class="_f blank"> </span>presente<span class="_1c blank"> </span>para<span class="_6 blank"> </span>\u201couvir\u201d<span class="_f blank"> </span>[14].<span class="_23 blank"> </span>T<span class="_2 blank"></span>en<span class="_9 blank"></span>ta-</div><div class="t m0 x11 h5 y7e ff5 fs2 fc0 sc0 ls0 ws88">tiv<span class="_2 blank"></span>as de adivinhar senhas criam um n´<span class="_16 blank"></span>umero incomum de reg<span class="_9 blank"></span>istros de <span class="ff7 ws89">lo<span class="_2 blank"></span>gon <span class="ff5 ws8a">falhos, comprome-</span></span></div><div class="t m0 x11 h5 y7f ff5 fs2 fc0 sc0 ls0 ws8b">timen<span class="_9 blank"></span>to de aplicativ<span class="_9 blank"></span>os atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es de <span class="ff7 ws8c">bu\ufb00er over\ufb02ow </span><span class="ws8d">geralmente \ufb01cam regist<span class="_9 blank"></span>rados nos arquiv<span class="_9 blank"></span>os de</span></div><div class="t m0 x11 h5 y80 ff5 fs2 fc0 sc0 ls0 ws8e">log ou geram <span class="ff7 ws8f">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e \ufb01les<span class="ff5 ws90">, e mensagens de advert<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encia s\u02dc<span class="_19 blank"></span>ao pro<span class="_17 blank"> </span>duzidas em decorr<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encia das v´<span class="_19 blank"></span>arias</span></span></div><div class="t m0 x11 h5 y81 ff5 fs2 fc0 sc0 ls0 ws91">ten<span class="_9 blank"></span>tativ<span class="_2 blank"></span>as de se in<span class="_9 blank"></span>v<span class="_2 blank"></span>adir o sistema [14].</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf5" class="pf w0 h0" data-page-no="5"><div class="pc pc5 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y82 w2 hc" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg5.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 ws49">2. <span class="ff5 ws4a">Mo dus<span class="_f blank"> </span>op erandi<span class="_27 blank"> </span>5</span></div><div class="t m0 x12 h5 y2a ff5 fs2 fc0 sc0 ls0 ws92">Dep ois<span class="_18 blank"> </span>que<span class="_1a blank"> </span>o<span class="_1a blank"> </span>atacan<span class="_9 blank"></span>te<span class="_18 blank"> </span>ganha<span class="_1a blank"> </span>acesso<span class="_18 blank"> </span>ao<span class="_1a blank"> </span>sistema,<span class="_1a blank"> </span>ele<span class="_1a blank"> </span>busca<span class="_18 blank"> </span>p or<span class="_1a blank"> </span>privil<span class="_9 blank"></span>´<span class="_19 blank"></span>egios<span class="_1a blank"> </span>irrestritos<span class="_1a blank"> </span>(con<span class="_9 blank"></span>ta<span class="_18 blank"> </span>de</div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 ws93">administrador ou <span class="ff7 ws75">r<span class="_2 blank"></span>o<span class="_2 blank"></span>ot<span class="ff5 ws94">) \u2013 assumindo que o comprometimen<span class="_2 blank"></span>to inicial j´<span class="_19 blank"></span>a n\u02dc<span class="_19 blank"></span>ao lhe forneceu acesso</span></span></div><div class="t m0 x11 h5 y2c ff5 fs2 fc0 sc0 ls0 ws95">`<span class="_19 blank"></span>a con<span class="_9 blank"></span>ta de <span class="ff7 ws75">r<span class="_2 blank"></span>o<span class="_2 blank"></span>ot<span class="ff5 ws1d">.<span class="_25 blank"> </span>O<span class="_e blank"> </span>inv<span class="_2 blank"></span>asor<span class="_e blank"> </span>transfere<span class="_10 blank"> </span>programas<span class="_e blank"> </span>maliciosos<span class="_10 blank"> </span>(conhecidos<span class="_e blank"> </span>p or<span class="_10 blank"> </span><span class="ff7 ws75">exploits</span><span class="ws96">) para o</span></span></span></div><div class="t m0 x11 h5 y2d ff5 fs2 fc0 sc0 ls0 ws1b">sistema<span class="_24 blank"> </span>e<span class="_24 blank"> </span>ten<span class="_9 blank"></span>ta<span class="_24 blank"> </span>explorar<span class="_24 blank"> </span>vulnerabilidades<span class="_d blank"> </span>que<span class="_24 blank"> </span>p ossam<span class="_24 blank"> </span>fornecer<span class="_24 blank"> </span>o<span class="_24 blank"> </span>acesso<span class="_24 blank"> </span>de<span class="_24 blank"> </span><span class="ff7 ws75">r<span class="_2 blank"></span>o<span class="_9 blank"></span>ot<span class="ff5 ws97">.<span class="_5 blank"> </span>Com acesso</span></span></div><div class="t m0 x11 h5 y2e ff5 fs2 fc0 sc0 ls0 ws98">ilimitado,<span class="_f blank"> </span>o<span class="_6 blank"> </span>atacante<span class="_f blank"> </span>pro cura<span class="_6 blank"> </span>remo<span class="_9 blank"></span>v<span class="_9 blank"></span>er<span class="_f blank"> </span>tra¸<span class="_20 blank"></span>cos<span class="_6 blank"> </span>de<span class="_6 blank"> </span>sua<span class="_6 blank"> </span>presen¸<span class="_8 blank"></span>ca,<span class="_6 blank"> </span>tornando-se<span class="_6 blank"> </span>\u201cin<span class="_9 blank"></span>vis<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el\u201d,<span class="_6 blank"> </span>atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es</div><div class="t m0 x11 h5 y2f ff5 fs2 fc0 sc0 ls0 ws99">da instala¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de <span class="ff7 ws9a">r<span class="_9 blank"></span>o<span class="_2 blank"></span>otkits <span class="ff5 ls6">e</span><span class="ws9b">tr<span class="_2 blank"></span>ojan horses<span class="ff5">.</span></span></span></div><div class="t m0 x12 h5 y30 ff5 fs2 fc0 sc0 ls0 ws9c">Quando o in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor obt<span class="_9 blank"></span>´<span class="_8 blank"></span>em acesso de <span class="ff7 ws9d">r<span class="_2 blank"></span>o<span class="_2 blank"></span>ot <span class="ff5 ws9e">e garante sua \u201cin<span class="_2 blank"></span>visibilidade\u201d,<span class="_2a blank"> </span>ele executa uma</span></span></div><div class="t m0 x11 h5 y31 ff5 fs2 fc0 sc0 ls0 ws1d">v<span class="_9 blank"></span>erdadeira<span class="_18 blank"> </span>v<span class="_9 blank"></span>arredura<span class="_18 blank"> </span>no<span class="_1a blank"> </span>sistema<span class="_1a blank"> </span>[14].<span class="_e blank"> </span>O<span class="_1a blank"> </span>atacan<span class="_9 blank"></span>te<span class="_1a blank"> </span>pro cura<span class="_18 blank"> </span>sab er<span class="_1a blank"> </span>o<span class="_1a blank"> </span>quan<span class="_9 blank"></span>to<span class="_1a blank"> </span>sua<span class="_1a blank"> </span>presen¸<span class="_8 blank"></span>ca<span class="_1a blank"> </span>p erturba</div><div class="t m0 x11 h5 y32 ff5 fs2 fc0 sc0 ls0 ws1b">o<span class="_f blank"> </span>sistema<span class="_f blank"> </span>inv<span class="_b blank"></span>adido<span class="_6 blank"> </span>e,<span class="_f blank"> </span>p or<span class="_f blank"> </span>conseguint<span class="_9 blank"></span>e,<span class="_f blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_6 blank"> </span>descob erta<span class="_f blank"> </span>(analisando<span class="_f blank"> </span>a<span class="_f blank"> </span>con\ufb01gura¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_f blank"> </span>log).</div><div class="t m0 x11 h5 y33 ff5 fs2 fc0 sc0 ls0 ws9f">Em seguida, ele inv<span class="_2 blank"></span>estiga as medidas de seguran¸<span class="_20 blank"></span>ca implemen<span class="_9 blank"></span>tadas no sistema in<span class="_2 blank"></span>v<span class="_2 blank"></span>adido \u2013 em</div><div class="t m0 x11 h5 y34 ff5 fs2 fc0 sc0 ls0 ws92">alguns<span class="_1c blank"> </span>casos,<span class="_f blank"> </span>o<span class="_1c blank"> </span>atacante<span class="_1c blank"> </span>at<span class="_9 blank"></span>´<span class="_8 blank"></span>e<span class="_1c blank"> </span>corrige<span class="_1c blank"> </span>vulnerabilidades<span class="_1c blank"> </span>existen<span class="_9 blank"></span>tes<span class="_1c blank"> </span>para<span class="_f blank"> </span>imp edir<span class="_1c blank"> </span>que<span class="_f blank"> </span>outro<span class="_1c blank"> </span>inv<span class="_2 blank"></span>asor</div><div class="t m0 x11 h5 y35 ff5 fs2 fc0 sc0 ls0 wsa0">fa¸<span class="_8 blank"></span>ca<span class="_6 blank"> </span>uso do sistema.</div><div class="t m0 x12 h5 y36 ff5 fs2 fc0 sc0 ls0 wsa1">Ap´<span class="_19 blank"></span>os compreender as con\ufb01gura¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes do sistema, o atacante i<span class="_9 blank"></span>nstala <span class="ff7 wsa2">b<span class="_2 blank"></span>ack<span class="_6 blank"> </span>do<span class="_9 blank"></span>ors <span class="ff5 wsa3">para facilitar</span></span></div><div class="t m0 x11 h5 y37 ff5 fs2 fc0 sc0 ls0 ws1b">seu<span class="_1a blank"> </span>retorno<span class="_1a blank"> </span>e<span class="_1a blank"> </span>apaga<span class="_1c blank"> </span>os<span class="_18 blank"> </span>rastros<span class="_1c blank"> </span>deixados<span class="_18 blank"> </span>p or<span class="_1a blank"> </span>sua<span class="_1c blank"> </span>presen¸<span class="_8 blank"></span>ca<span class="_1a blank"> </span>no<span class="_1c blank"> </span>si<span class="_9 blank"></span>stema.<span class="_e blank"> </span>Utilizando<span class="_1a blank"> </span>uma<span class="_1a blank"> </span><span class="ff7 wsa4">b<span class="_2 blank"></span>ack do<span class="_9 blank"></span>or<span class="ff5">,</span></span></div><div class="t m0 x11 h5 y38 ff5 fs2 fc0 sc0 ls0 wsa5">o in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor retorna de maneira mais discreta que o comprometim<span class="_9 blank"></span>en<span class="_9 blank"></span>to inicial e faz um in<span class="_9 blank"></span>v<span class="_9 blank"></span>en<span class="_9 blank"></span>t´<span class="_19 blank"></span>ario</div><div class="t m0 x11 h5 y39 ff5 fs2 fc0 sc0 ls0 ws1b">acerca<span class="_f blank"> </span>das<span class="_f blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_6 blank"> </span>existen<span class="_9 blank"></span>tes<span class="_1c blank"> </span>na<span class="_6 blank"> </span>m´<span class="_19 blank"></span>aquina<span class="_1c blank"> </span>inv<span class="_2 blank"></span>adida<span class="_1c blank"> </span>e<span class="_f blank"> </span>dos<span class="_f blank"> </span>p otenciais<span class="_f blank"> </span>alvos<span class="_1c blank"> </span>da<span class="_f blank"> </span>vizinhan¸<span class="_20 blank"></span>ca.</div><div class="t m0 x12 h5 y3a ff5 fs2 fc0 sc0 ls0 wsa6">A habilidade do in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor em executar o <span class="ff7 wsa7">mo<span class="_2 blank"></span>dus<span class="_f blank"> </span>op<span class="_2 blank"></span>er<span class="_9 blank"></span>andi <span class="ff5 ws1d">descrito<span class="_1a blank"> </span>anteriormen<span class="_2 blank"></span>te<span class="_1c blank"> </span>p o de<span class="_1c blank"> </span>ser<span class="_1a blank"> </span>fun-</span></span></div><div class="t m0 x11 h5 y3b ff5 fs2 fc0 sc0 ls0 ws1b">damen<span class="_9 blank"></span>tal<span class="_1c blank"> </span>para<span class="_1a blank"> </span>o<span class="_1c blank"> </span>pro cesso<span class="_1c blank"> </span>de<span class="_1c blank"> </span>an´<span class="_19 blank"></span>alise<span class="_1c blank"> </span>forense,<span class="_1c blank"> </span>pois<span class="_1c blank"> </span>a<span class="_1c blank"> </span>quan<span class="_9 blank"></span>tidade<span class="_1c blank"> </span>de<span class="_1a blank"> </span>evid\u02c6<span class="_19 blank"></span>encias<span class="_1c blank"> </span>deixadas<span class="_1c blank"> </span>dep ende</div><div class="t m0 x11 h5 y3c ff5 fs2 fc0 sc0 ls0 ws1d">diretamen<span class="_9 blank"></span>te<span class="_d blank"> </span>do<span class="_d blank"> </span>n<span class="_a blank"></span>´<span class="_c blank"></span>\u0131vel<span class="_6 blank"> </span>de<span class="_24 blank"> </span>conhecimen<span class="_9 blank"></span>to<span class="_d blank"> </span>do<span class="_d blank"> </span>atacan<span class="_9 blank"></span>te<span class="_d blank"> </span>[14].<span class="_29 blank"> </span>P<span class="_9 blank"></span>ara<span class="_d blank"> </span>ilustrar<span class="_d blank"> </span>essa<span class="_d blank"> </span>rela¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_d blank"> </span>´<span class="_8 blank"></span>e<span class="_d blank"> </span>p oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131vel</div><div class="t m0 x11 h5 y3d ff5 fs2 fc0 sc0 ls0 wsa8">classi\ufb01car a habilidade do in<span class="_2 blank"></span>v<span class="_2 blank"></span>asor em quatro classes, de acordo com [14]:<span class="_10 blank"> </span><span class="ff7 ws75">Clueless</span><span class="ls7">,</span><span class="ff7 wsa9">Script Kid-</span></div><div class="t m0 x11 h5 y3e ff7 fs2 fc0 sc0 ls0 ws75">die<span class="ff5 ls8">,</span><span class="wsaa">Guru <span class="ff5 ls9">e</span></span>Wizar<span class="_2 blank"></span>d<span class="ff5 wsab">.<span class="_e blank"> </span>A tab<span class="_17 blank"> </span>ela 1 apresen<span class="_9 blank"></span>ta a rela¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao entre a ha<span class="_9 blank"></span>bilidade do in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor e a quan<span class="_2 blank"></span>tidade</span></div><div class="t m0 x11 h5 y3f ff5 fs2 fc0 sc0 ls0 ws52">de evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias deixadas.</div><div class="c x11 y83 w3 hd"><div class="t m1 x13 he y84 ffe fs7 fc0 sc0 ls0 ws23">Pode tentar cobrir rastros com</div><div class="t m1 x13 hf y85 ffe fs7 fc0 sc0 ls0 ws23">o uso de<span class="_f blank"> </span><span class="fff wsac">rootkits </span> prontos, mas com</div><div class="t m1 x13 he y86 ffe fs7 fc0 sc0 ls0 ws23">sucesso limitado. Pode ser detectado</div><div class="t m1 x13 he y87 ffe fs7 fc0 sc0 ls0 ws23">com esforço mínimo</div><div class="t m1 x15 he y88 ffe fs7 fc0 sc0 ls0 ws23">Equivalente a um administrador experiente.</div><div class="t m1 x15 he y89 ffe fs7 fc0 sc0 ls0 ws23">Hábil em programação. Checa a existência de</div><div class="t m1 x15 he y8a ffe fs7 fc0 sc0 ls0 ws23">programas de segurança e esquemas de log </div><div class="t m1 x15 he y8b ffe fs7 fc0 sc0 ls0 ws23">seguros, evitando alvos protegidos</div><div class="t m1 x15 he y8c ffe fs7 fc0 sc0 ls0 ws23">Possui um g rande conhecimento do</div><div class="t m1 x15 he y8d ffe fs7 fc0 sc0 ls0 ws23">funcionamento interno de um sistema.</div><div class="t m1 x15 hf y8e ffe fs7 fc0 sc0 ls0 ws23">Capaz de manipular<span class="_1a blank"> </span><span class="fff"> hardware<span class="_6 blank"> </span></span><span class="lsa">e</span><span class="fff">software</span></div><div class="t m1 x13 he y8c ffe fs7 fc0 sc0 ls0 ws23">Praticamente não deixa evidências úteis.</div><div class="t m1 x13 he y8d ffe fs7 fc0 sc0 ls0 ws23">Pode comprometer totalmente o sistema</div><div class="t m1 x13 he y8f ffe fs7 fc0 sc0 ls0 ws23">Todas as atividades são bastante</div><div class="t m1 x13 he y90 ffe fs7 fc0 sc0 ls0">aparentes</div><div class="t m1 x15 he y91 ffe fs7 fc0 sc0 ls0 ws23">na Internet e executá\u2212los seguindo instruções</div><div class="t m1 x15 he y92 ffe fs7 fc0 sc0 ls0 ws23">detalhadas. Não escrevem programas</div><div class="t m1 x15 he y93 ffe fs7 fc0 sc0 ls0 ws23">Nenhuma habilidade</div><div class="t m1 x16 hf y8c fff fs7 fc0 sc0 ls0">Wizard</div><div class="t m1 x17 hf y93 fff fs7 fc0 sc0 ls0">Clueless</div><div class="t m1 x18 hf y94 fff fs7 fc0 sc0 ls0 ws23">Script Kiddie</div><div class="t m1 x19 hf y95 fff fs7 fc0 sc0 ls0">Guru</div><div class="t m1 x1a h10 y96 ff10 fs7 fc0 sc0 ls0 ws23">Habilidades<span class="_2b blank"> </span>Evidências<span class="_2c blank"></span>Nível de habilidade</div><div class="t m1 x13 he y95 ffe fs7 fc0 sc0 ls0 ws23">Cuidadosamente apaga evidências em</div><div class="t m1 x13 he y97 ffe fs7 fc0 sc0 ls0 ws23">arquivos de log. Não deixa traços óbvios</div><div class="t m1 x13 hf y98 ffe fs7 fc0 sc0 lsa">e<span class="fff ls0 ws23">back doors<span class="_2d blank"> </span><span class="ffe">para um acesso futuro</span></span></div><div class="t m1 x13 hf y99 ffe fs7 fc0 sc0 ls0 ws23">de sua presença. Pode instalar <span class="_1b blank"> </span><span class="fff">trojan horses</span></div><div class="t m1 x15 hf y94 ffe fs7 fc0 sc0 ls0 ws23">Capaz de encontrar<span class="_23 blank"> </span><span class="fff wsad">exploits </span>prontos</div></div><div class="t m0 x12 h5 y9a ff5 fs2 fc0 sc0 ls0 wsae">T<span class="_b blank"></span>ab<span class="_17 blank"> </span>ela 1:<span class="_10 blank"> </span>Rela¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao entre a habil<span class="_9 blank"></span>idade do in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor e a quan<span class="_9 blank"></span>tidade de evid<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encias deixadas.</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf6" class="pf w0 h0" data-page-no="6"><div class="pc pc6 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y9b w1 h11" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg6.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 wsaf">3.<span class="_1e blank"> </span>Evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias digitais<span class="_2e blank"> </span><span class="ff5">6</span></div><div class="t m0 x11 h6 y2a ff6 fs3 fc0 sc0 ls0 wsb0">3<span class="_13 blank"> </span>Evid<span class="_2 blank"></span>\u02c6<span class="_2f blank"></span>encias digitais</div><div class="t m0 x11 h5 y9c ff5 fs2 fc0 sc0 ls0 wsb1">Um<span class="_d blank"> </span>dos<span class="_d blank"> </span>princ<span class="_b blank"></span>´<span class="_c blank"></span>\u0131pios<span class="_d blank"> </span>fundamen<span class="_9 blank"></span>tais<span class="_d blank"> </span>da<span class="_d blank"> </span>forense<span class="_6 blank"> </span>´<span class="_8 blank"></span>e<span class="_d blank"> </span>o<span class="_24 blank"> </span>Princ<span class="_a blank"></span>´<span class="_c blank"></span>\u0131pio<span class="_d blank"> </span>da<span class="_d blank"> </span>T<span class="_2 blank"></span>ro ca<span class="_d blank"> </span>de<span class="_d blank"> </span>Lo card<span class="_24 blank"> </span>[5].<span class="_1d blank"> </span>De<span class="_24 blank"> </span>acordo</div><div class="t m0 x11 h5 y9d ff5 fs2 fc0 sc0 ls0 wsb2">com esse princ<span class="_a blank"></span>´<span class="_c blank"></span>\u0131pio,<span class="_2a blank"> </span>qualquer um,<span class="_30 blank"> </span>ou qualquer coisa,<span class="_2a blank"> </span>que ent<span class="_9 blank"></span>ra em um lo<span class="_17 blank"> </span>cal de crime lev<span class="_2 blank"></span>a</div><div class="t m0 x11 h5 y9e ff5 fs2 fc0 sc0 ls0 wsb3">consigo<span class="_6 blank"> </span>algo<span class="_d blank"> </span>do<span class="_6 blank"> </span>lo cal<span class="_d blank"> </span>e<span class="_6 blank"> </span>deixa<span class="_d blank"> </span>alguma<span class="_6 blank"> </span>coisa<span class="_d blank"> </span>para<span class="_6 blank"> </span>tr´<span class="_19 blank"></span>as<span class="_d blank"> </span>quando<span class="_6 blank"> </span>parte<span class="_6 blank"> </span>[5].<span class="_31 blank"> </span>No<span class="_6 blank"> </span>mundo<span class="_f blank"> </span>virtual<span class="_d blank"> </span>dos</div><div class="t m0 x11 h5 y9f ff5 fs2 fc0 sc0 ls0 wsb4">computadores, o Princ<span class="_a blank"></span>´<span class="_c blank"></span>\u0131pio da T<span class="_b blank"></span>ro<span class="_17 blank"> </span>ca de Lo<span class="_17 blank"> </span>card ainda<span class="_18 blank"> </span>´<span class="_8 blank"></span>e v´<span class="_19 blank"></span>alido (ou p<span class="_17 blank"> </span>elo menos parte dele):<span class="_24 blank"> </span>onde</div><div class="t m0 x11 h5 ya0 ff5 fs2 fc0 sc0 ls0 wsb5">quer que o in<span class="_9 blank"></span>truso v´<span class="_16 blank"></span>a ele deixa rastros [27].<span class="_31 blank"> </span>T<span class="_b blank"></span>ais rastros p<span class="_17 blank"> </span>odem ser extremamen<span class="_9 blank"></span>te dif<span class="_a blank"></span>´<span class="_c blank"></span>\u0131ceis ou</div><div class="t m0 x11 h5 ya1 ff5 fs2 fc0 sc0 ls0 ws4b">praticamen<span class="_9 blank"></span>te<span class="_1c blank"> </span>imposs<span class="_b blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>eis<span class="_1c blank"> </span>de<span class="_1c blank"> </span>serem<span class="_1c blank"> </span>iden<span class="_9 blank"></span>ti\ufb01cados<span class="_1c blank"> </span>e<span class="_1c blank"> </span>seguidos,<span class="_1c blank"> </span>mas<span class="_1c blank"> </span>eles<span class="_1c blank"> </span>existem<span class="_1c blank"> </span>[27].<span class="_24 blank"> </span>Nesses<span class="_f blank"> </span>casos</div><div class="t m0 x11 h5 ya2 ff5 fs2 fc0 sc0 ls0 ws1b">o<span class="_1c blank"> </span>processo<span class="_1c blank"> </span>de<span class="_1c blank"> </span>an´<span class="_19 blank"></span>alise<span class="_1c blank"> </span>forense<span class="_1c blank"> </span>po de<span class="_1c blank"> </span>tornar-se<span class="_1c blank"> </span>extremamen<span class="_9 blank"></span>te<span class="_1c blank"> </span>complexo<span class="_1a blank"> </span>e<span class="_1c blank"> </span>demorado,<span class="_1c blank"> </span>necessitando</div><div class="t m0 x11 h5 ya3 ff5 fs2 fc0 sc0 ls0 ws52">do desen<span class="_9 blank"></span>v<span class="_9 blank"></span>olvimen<span class="_9 blank"></span>to de no<span class="_2 blank"></span>v<span class="_9 blank"></span>as tecnologias para a procura de evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias.</div><div class="t m0 x12 h5 ya4 ff5 fs2 fc0 sc0 ls0 wsb6">O termo evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia digital refer<span class="_9 blank"></span>e-se a to<span class="_17 blank"> </span>da e qualquer informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao digital capaz de determinar</div><div class="t m0 x11 h5 ya5 ff5 fs2 fc0 sc0 ls0 ws34">que<span class="_1c blank"> </span>uma<span class="_1c blank"> </span>in<span class="_9 blank"></span>trus\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>o correu<span class="_1c blank"> </span>ou<span class="_1c blank"> </span>que<span class="_1c blank"> </span>prov<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>e<span class="_1c blank"> </span>alguma<span class="_1c blank"> </span>liga¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>en<span class="_9 blank"></span>tre<span class="_1c blank"> </span>a<span class="_1c blank"> </span>in<span class="_9 blank"></span>trus\u02dc<span class="_16 blank"></span>ao<span class="_f blank"> </span>e<span class="_1c blank"> </span>as<span class="_1c blank"> </span>v<span class="_b blank"></span>´<span class="_c blank"></span>\u0131timas<span class="_1c blank"> </span>ou<span class="_1c blank"> </span>en<span class="_9 blank"></span>tre<span class="_1c blank"> </span>a</div><div class="t m0 x11 h8 ya6 ff5 fs2 fc0 sc0 ls0 ws41">in<span class="_9 blank"></span>trus\u02dc<span class="_16 blank"></span>ao e o<span class="_6 blank"> </span>atacan<span class="_9 blank"></span>te<span class="ff9 fs4 lsb v1">2</span>.</div><div class="t m0 x12 h5 ya7 ff5 fs2 fc0 sc0 ls0 wsb7">A evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia digital n\u02dc<span class="_16 blank"></span>ao deixa de ser um tip<span class="_17 blank"> </span>o de evid<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encia f<span class="_a blank"></span>´<span class="_c blank"></span>\u0131sica, embora seja menos tang<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el</div><div class="t m0 x11 h5 ya8 ff5 fs2 fc0 sc0 ls0 ws92">[5].<span class="_25 blank"> </span>Ela<span class="_e blank"> </span>´<span class="_8 blank"></span>e<span class="_10 blank"> </span>comp osta<span class="_10 blank"> </span>de<span class="_23 blank"> </span>camp os<span class="_10 blank"> </span>magn<span class="_9 blank"></span>´<span class="_8 blank"></span>eticos<span class="_10 blank"> </span>e<span class="_10 blank"> </span>pulsos<span class="_10 blank"> </span>eletr\u02c6<span class="_16 blank"></span>onicos<span class="_10 blank"> </span>que<span class="_10 blank"> </span>p o dem<span class="_23 blank"> </span>ser<span class="_10 blank"> </span>coletados<span class="_10 blank"> </span>e</div><div class="t m0 x11 h5 ya9 ff5 fs2 fc0 sc0 ls0 ws1d">analisados<span class="_1a blank"> </span>atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es<span class="_18 blank"> </span>de<span class="_1a blank"> </span>t´<span class="_19 blank"></span>ecnicas<span class="_1a blank"> </span>e<span class="_1a blank"> </span>ferramentas<span class="_18 blank"> </span>apropriadas.<span class="_24 blank"> </span>Entretan<span class="_2 blank"></span>to,<span class="_1c blank"> </span>a<span class="_18 blank"> </span>evid\u02c6<span class="_19 blank"></span>encia<span class="_1a blank"> </span>digital<span class="_1a blank"> </span>p ossui</div><div class="t m0 x11 h5 yaa ff5 fs2 fc0 sc0 ls0 wsb8">algumas caracter<span class="_a blank"></span>´<span class="_c blank"></span>\u0131sticas pr´<span class="_16 blank"></span>oprias:</div><div class="t m0 x1 h5 yab ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws1b">ela<span class="_23 blank"> </span>p o de<span class="_23 blank"> </span>ser<span class="_2a blank"> </span>duplicada<span class="_23 blank"> </span>com<span class="_23 blank"> </span>exatid\u02dc<span class="_19 blank"></span>ao,<span class="_30 blank"> </span>p ermitindo<span class="_23 blank"> </span>a<span class="_2a blank"> </span>preserv<span class="_2 blank"></span>a¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_2a blank"> </span>da<span class="_23 blank"> </span>evid\u02c6<span class="_19 blank"></span>encia<span class="_2a blank"> </span>original</span></div><div class="t m0 x0 h5 yac ff5 fs2 fc0 sc0 ls0 wsb9">duran<span class="_9 blank"></span>te a an´<span class="_16 blank"></span>alise;</div><div class="t m0 x1 h5 yad ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws32">com<span class="_1c blank"> </span>os<span class="_1c blank"> </span>m<span class="_9 blank"></span>´<span class="_8 blank"></span>etodos<span class="_1c blank"> </span>apropriados<span class="_1c blank"> </span>´<span class="_19 blank"></span>e<span class="_1c blank"> </span>relativ<span class="_2 blank"></span>amente<span class="_1c blank"> </span>f´<span class="_16 blank"></span>acil<span class="_1c blank"> </span>determinar<span class="_1c blank"> </span>se<span class="_1c blank"> </span>uma<span class="_1c blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia<span class="_1c blank"> </span>digital<span class="_1c blank"> </span>foi</span></div><div class="t m0 x0 h5 yae ff5 fs2 fc0 sc0 ls0 wsba">mo di\ufb01cada;</div><div class="t m0 x1 h5 yaf ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws1b">p or<span class="_18 blank"> </span>outro<span class="_1b blank"> </span>lado,<span class="_18 blank"> </span>a<span class="_18 blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia<span class="_1b blank"> </span>digital<span class="_1b blank"> </span>´<span class="_8 blank"></span>e<span class="_18 blank"> </span>extremamen<span class="_2 blank"></span>te<span class="_18 blank"> </span>vol´<span class="_16 blank"></span>atil,<span class="_18 blank"> </span>p o dendo<span class="_18 blank"> </span>ser<span class="_1b blank"> </span>facilmente<span class="_1b blank"> </span>alterada</span></div><div class="t m0 x0 h5 yb0 ff5 fs2 fc0 sc0 ls0 ws98">duran<span class="_9 blank"></span>te<span class="_1c blank"> </span>o<span class="_6 blank"> </span>pro cesso<span class="_f blank"> </span>de<span class="_f blank"> </span>an´<span class="_19 blank"></span>alise;</div><div class="t m0 x12 h5 yb1 ff5 fs2 fc0 sc0 ls0 wsbb">A busca de evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias em um sistema computa<span class="_9 blank"></span>cional constitui-se de uma v<span class="_2 blank"></span>arredura min<span class="_2 blank"></span>u-</div><div class="t m0 x11 h5 yb2 ff5 fs2 fc0 sc0 ls0 wsbc">ciosa nas informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes que nele residam, sejam dados em arquiv<span class="_9 blank"></span>os ou em mem´<span class="_19 blank"></span>oria, \u201cdeletados\u201d</div><div class="t m0 x11 h5 yb3 ff5 fs2 fc0 sc0 ls0 ws1b">ou<span class="_f blank"> </span>n\u02dc<span class="_19 blank"></span>ao,<span class="_f blank"> </span>cifrados<span class="_f blank"> </span>ou<span class="_f blank"> </span>p ossiv<span class="_9 blank"></span>elmen<span class="_9 blank"></span>te<span class="_f blank"> </span>dani\ufb01cados.</div><div class="t m0 x12 h5 yb4 ff5 fs2 fc0 sc0 ls0 wsbd">Dan F<span class="_b blank"></span>armer e Wietse V<span class="_b blank"></span>enema introduziram um conceito denominado de ordem de v<span class="_2 blank"></span>ola-</div><div class="t m0 x11 h5 yb5 ff5 fs2 fc0 sc0 ls0 wsbe">tilidade [10].<span class="_29 blank"> </span>T<span class="_2 blank"></span>al conceito deter<span class="_9 blank"></span>mina que o temp<span class="_17 blank"> </span>o de vida de u<span class="_9 blank"></span>ma evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia digital v<span class="_2 blank"></span>aria de</div><div class="t m0 x11 h5 yb6 ff5 fs2 fc0 sc0 ls0 wsbf">acordo como o lo<span class="_17 blank"> </span>cal onde ela est´<span class="_16 blank"></span>a armazenada.<span class="_12 blank"> </span>As principai<span class="_9 blank"></span>s fon<span class="_9 blank"></span>tes de informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de um</div><div class="t m0 x11 h5 yb7 ff5 fs2 fc0 sc0 ls0 wsc0">sistema computacional s\u02dc<span class="_16 blank"></span>ao apresenta<span class="_9 blank"></span>das,<span class="_10 blank"> </span>na ordem descenden<span class="_9 blank"></span>te de v<span class="_9 blank"></span>olatilidade, como segue</div><div class="t m0 x11 h5 yb8 ff5 fs2 fc0 sc0 ls0 wsc1">[3, 10, 14]:</div><div class="t m0 x1 h5 yb9 ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws1d">disp ositiv<span class="_9 blank"></span>os<span class="_1c blank"> </span>de<span class="_6 blank"> </span>armazenagem<span class="_1c blank"> </span>da<span class="_f blank"> </span>CPU<span class="_6 blank"> </span>(registradores<span class="_1c blank"> </span>e<span class="_f blank"> </span><span class="ff7 ws75">c<span class="_9 blank"></span>aches<span class="ff5 wsd">);</span></span></span></div><div class="t m0 x1 h5 yba ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws1b">mem´<span class="_19 blank"></span>oria<span class="_f blank"> </span>de<span class="_f blank"> </span>p erif<span class="_9 blank"></span>´<span class="_8 blank"></span>ericos<span class="_1c blank"> </span>(mem´<span class="_19 blank"></span>oria<span class="_f blank"> </span>de<span class="_f blank"> </span>v<span class="_b blank"></span>´<span class="_c blank"></span>\u0131deo,<span class="_1c blank"> </span>p or<span class="_6 blank"> </span>exemplo);</span></div><div class="t m0 x1 h5 ybb ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 wsc2">mem´<span class="_19 blank"></span>oria principal do sistema;</span></div><div class="t m0 x1 h5 ybc ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 wsc3">tr´<span class="_19 blank"></span>afego de rede (pacotes em tr\u02c6<span class="_16 blank"></span>ansito na rede);</span></div><div class="t m0 x1 h5 ybd ffa fs2 fc0 sc0 ls3">\u2022<span class="ff5 ls0 ws1b">estado<span class="_24 blank"> </span>do<span class="_e blank"> </span>sistema<span class="_e blank"> </span>op eracional<span class="_e blank"> </span>(como,<span class="_10 blank"> </span>p or<span class="_e blank"> </span>exemplo,<span class="_10 blank"> </span>estado<span class="_24 blank"> </span>das<span class="_e blank"> </span>conex\u02dc<span class="_19 blank"></span>oes<span class="_e blank"> </span>de<span class="_e blank"> </span>rede<span class="_e blank"> </span>e<span class="_e blank"> </span>dos</span></div><div class="t m0 x0 h5 ybe ff5 fs2 fc0 sc0 ls0 ws98">pro cessos<span class="_f blank"> </span>em<span class="_f blank"> </span>execu¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_f blank"> </span>usu´<span class="_19 blank"></span>arios<span class="_f blank"> </span>logados<span class="_f blank"> </span>e<span class="_f blank"> </span>con\ufb01gura¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_1c blank"> </span>do<span class="_6 blank"> </span>sistema);</div><div class="t m0 x14 h9 ybf ffb fs5 fc0 sc0 ls4">2<span class="ffc fs6 ls0 wsc4 v2">Essa de\ufb01ni¸<span class="_c blank"></span>c\u02dc<span class="_20 blank"></span>ao foi<span class="_f blank"> </span>adaptada para o contexto de in<span class="_2 blank"></span>trus\u02dc<span class="_7 blank"></span>ao de sistemas a partir da de\ufb01ni¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>ao apresentada em</span></div><div class="t m0 x11 ha yc0 ffc fs6 fc0 sc0 ls0 wsc5">[5].</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf7" class="pf w0 h0" data-page-no="7"><div class="pc pc7 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 yc1 w1 h12" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg7.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 wsaf">3.<span class="_1e blank"> </span>Evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias digitais<span class="_2e blank"> </span><span class="ff5">7</span></div><div class="t m0 x1 h5 y2a ffa fs2 fc0 sc0 ls2">\u2022<span class="ff5 ls0 ws1d">disp ositiv<span class="_9 blank"></span>os<span class="_1c blank"> </span>de<span class="_6 blank"> </span>armazenagem<span class="_1c blank"> </span>secund´<span class="_19 blank"></span>aria</span></div><div class="t m0 x12 h5 yc2 ff5 fs2 fc0 sc0 ls0 wsc6">Quan<span class="_9 blank"></span>to maior a v<span class="_9 blank"></span>olatilidade de uma informa<span class="_9 blank"></span>¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao, mais dif<span class="_a blank"></span>´<span class="_c blank"></span>\u0131cil se torna sua extra¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao e menos</div><div class="t m0 x11 h5 yc3 ff5 fs2 fc0 sc0 ls0 wsc7">temp<span class="_17 blank"> </span>o h´<span class="_16 blank"></span>a para captur´<span class="_19 blank"></span>a-la.<span class="_25 blank"> </span>O simples ato de observ<span class="_2 blank"></span>ar informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_23 blank"> </span>altamen<span class="_9 blank"></span>te v<span class="_9 blank"></span>ol´<span class="_16 blank"></span>ateis p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>de</div><div class="t m0 x11 h5 y63 ff5 fs2 fc0 sc0 ls0 ws1b">alter´<span class="_16 blank"></span>a-las,<span class="_1c blank"> </span>de<span class="_18 blank"> </span>mo do<span class="_18 blank"> </span>que<span class="_18 blank"> </span>´<span class="_8 blank"></span>e<span class="_18 blank"> </span>p ouco<span class="_1a blank"> </span>pro<span class="_9 blank"></span>v´<span class="_19 blank"></span>av<span class="_9 blank"></span>el<span class="_1a blank"> </span>que<span class="_18 blank"> </span>algu´<span class="_19 blank"></span>em<span class="_1a blank"> </span>p ossa<span class="_18 blank"> </span>utilizar<span class="_1a blank"> </span>o<span class="_18 blank"> </span>conte´<span class="_16 blank"></span>udo<span class="_1a blank"> </span>dos<span class="_18 blank"> </span>registradores</div><div class="t m0 x11 h5 y64 ff5 fs2 fc0 sc0 ls0 ws1b">da<span class="_10 blank"> </span>CPU,<span class="_10 blank"> </span>por<span class="_10 blank"> </span>exemplo<span class="_10 blank"> </span>[14].<span class="_25 blank"> </span>En<span class="_9 blank"></span>tretan<span class="_9 blank"></span>to,<span class="_23 blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_10 blank"> </span>vol´<span class="_16 blank"></span>ateis<span class="_10 blank"> </span>como<span class="_10 blank"> </span>o<span class="_10 blank"> </span>con<span class="_9 blank"></span>te´<span class="_16 blank"></span>udo<span class="_10 blank"> </span>da<span class="_10 blank"> </span>mem´<span class="_19 blank"></span>oria</div><div class="t m0 x11 h5 yc4 ff5 fs2 fc0 sc0 ls0 ws1d">principal<span class="_1a blank"> </span>do<span class="_1c blank"> </span>sistema,<span class="_1c blank"> </span>o<span class="_1c blank"> </span>tr´<span class="_16 blank"></span>afego<span class="_1c blank"> </span>de<span class="_1c blank"> </span>rede<span class="_1a blank"> </span>e<span class="_1c blank"> </span>o<span class="_1c blank"> </span>estado<span class="_1a blank"> </span>do<span class="_1c blank"> </span>sistema<span class="_1c blank"> </span>operacional<span class="_1c blank"> </span>p o dem<span class="_1c blank"> </span>ser<span class="_1a blank"> </span>capturadas</div><div class="t m0 x11 h5 yc5 ff5 fs2 fc0 sc0 ls0 ws1b">com<span class="_f blank"> </span>relativ<span class="_2 blank"></span>a<span class="_f blank"> </span>facilidade<span class="_f blank"> </span>e<span class="_f blank"> </span>p o dem<span class="_f blank"> </span>con<span class="_9 blank"></span>ter<span class="_f blank"> </span>pistas<span class="_f blank"> </span>v<span class="_2 blank"></span>aliosas<span class="_f blank"> </span>a<span class="_f blank"> </span>resp eito<span class="_f blank"> </span>de<span class="_f blank"> </span>intrus\u02dc<span class="_16 blank"></span>oes<span class="_f blank"> </span>em<span class="_f blank"> </span>andamen<span class="_9 blank"></span>to.</div><div class="t m0 x12 h5 yc6 ff5 fs2 fc0 sc0 ls0 ws1b">O<span class="_1b blank"> </span>detalhamen<span class="_9 blank"></span>to<span class="_1b blank"> </span>de<span class="_18 blank"> </span>cada<span class="_1b blank"> </span>fon<span class="_9 blank"></span>te<span class="_1b blank"> </span>de<span class="_18 blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_18 blank"> </span>b em<span class="_18 blank"> </span>como<span class="_1b blank"> </span>das<span class="_18 blank"> </span>poss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131veis<span class="_1b blank"> </span>evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias<span class="_1b blank"> </span>encon<span class="_9 blank"></span>tradas</div><div class="t m0 x11 h8 yc7 ff5 fs2 fc0 sc0 ls0 wsc8">em<span class="_18 blank"> </span>cada<span class="_18 blank"> </span>uma<span class="_18 blank"> </span>e<span class="_18 blank"> </span>das<span class="_1a blank"> </span>t<span class="_9 blank"></span>´<span class="_8 blank"></span>ecnicas<span class="_18 blank"> </span>utilizadas<span class="_18 blank"> </span>para<span class="_18 blank"> </span>extra¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_18 blank"> </span>das<span class="_1a blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes,<span class="_18 blank"> </span>´<span class="_8 blank"></span>e<span class="_18 blank"> </span>apresen<span class="_9 blank"></span>tado<span class="_18 blank"> </span>com<span class="_18 blank"> </span>segue <span class="ff9 fs4 lsb v1">3</span>.</div><div class="t m0 x11 h13 yc8 ff11 fs8 fc0 sc0 ls0 wsc9">3.1<span class="_32 blank"> </span>Disp ositiv<span class="_2 blank"></span>os<span class="_10 blank"> </span>de<span class="_23 blank"> </span>armazenagem<span class="_10 blank"> </span>da<span class="_10 blank"> </span>CPU</div><div class="t m0 x11 h5 yc9 ff5 fs2 fc0 sc0 ls0 wsca">As informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes contidas nos registr<span class="_9 blank"></span>adores da CPU s\u02dc<span class="_19 blank"></span>ao de m<span class="_a blank"></span>´<span class="_c blank"></span>\u0131nima utilidade e sua captura<span class="_6 blank"> </span>´<span class="_8 blank"></span>e</div><div class="t m0 x11 h5 yca ff5 fs2 fc0 sc0 ls0 wscb">impratic´<span class="_16 blank"></span>avel [14].<span class="_28 blank"> </span>As <span class="ff7 wscc">c<span class="_2 blank"></span>aches <span class="ff5 ws1b">p o dem<span class="_e blank"> </span>conter<span class="_d blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_e blank"> </span>que<span class="_e blank"> </span>ainda<span class="_24 blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_e blank"> </span>foram<span class="_e blank"> </span>atualizadas<span class="_24 blank"> </span>na</span></span></div><div class="t m0 x11 h5 ycb ff5 fs2 fc0 sc0 ls0 ws1b">m<span class="_9 blank"></span>´<span class="_8 blank"></span>emoria<span class="_1c blank"> </span>principal<span class="_f blank"> </span>do<span class="_f blank"> </span>sistema,<span class="_f blank"> </span>entretan<span class="_2 blank"></span>to<span class="_f blank"> </span>sua<span class="_f blank"> </span>captura<span class="_f blank"> </span>tamb<span class="_2 blank"></span>´<span class="_8 blank"></span>em<span class="_f blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_f blank"> </span>impratic´<span class="_19 blank"></span>av<span class="_9 blank"></span>el<span class="_f blank"> </span>[14].</div><div class="t m0 x11 h13 ycc ff11 fs8 fc0 sc0 ls0 wscd">3.2<span class="_32 blank"> </span>Mem´<span class="_33 blank"></span>oria<span class="_10 blank"> </span>de<span class="_10 blank"> </span>p erif<span class="_9 blank"></span>´<span class="_34 blank"></span>ericos</div><div class="t m0 x11 h5 ycd ff5 fs2 fc0 sc0 ls0 ws1d">Muitos<span class="_24 blank"> </span>disp ositiv<span class="_9 blank"></span>os<span class="_d blank"> </span>como<span class="_e blank"> </span><span class="ff7 ws75">mo<span class="_2 blank"></span>dems<span class="ff5 lsc">,</span>p<span class="_2 blank"></span>agers<span class="ff5 wsce">,<span class="_e blank"> </span>aparelhos de fax e impressoras, cont<span class="_9 blank"></span>\u02c6<span class="_19 blank"></span>em mem´<span class="_19 blank"></span>orias</span></span></div><div class="t m0 x11 h5 yce ff5 fs2 fc0 sc0 ls0 ws1b">que<span class="_d blank"> </span>p o dem<span class="_d blank"> </span>ser<span class="_24 blank"> </span>acessadas<span class="_d blank"> </span>e<span class="_d blank"> </span>salv<span class="_2 blank"></span>as<span class="_24 blank"> </span>[13].<span class="_1d blank"> </span>Nelas<span class="_24 blank"> </span>p o dem<span class="_d blank"> </span>estar<span class="_d blank"> </span>armazenadas<span class="_d blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_d blank"> </span>que<span class="_24 blank"> </span>n\u02dc<span class="_19 blank"></span>ao</div><div class="t m0 x11 h5 ycf ff5 fs2 fc0 sc0 ls0 wscf">mais residem no sistema analisado, como documentos e men<span class="_9 blank"></span>sagens de texto ou n<span class="_17 blank"> </span>´<span class="_16 blank"></span>umeros de fax</div><div class="t m0 x11 h5 yd0 ff5 fs2 fc0 sc0 ls0 wsd0">e telefone.</div><div class="t m0 x12 h5 yd1 ff5 fs2 fc0 sc0 ls0 wsd1">A mem´<span class="_19 blank"></span>oria de v<span class="_a blank"></span>´<span class="_c blank"></span>\u0131deo tam<span class="_9 blank"></span>b<span class="_9 blank"></span>´<span class="_8 blank"></span>em po<span class="_17 blank"> </span>de prov<span class="_2 blank"></span>er informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>´<span class="_16 blank"></span>util<span class="_18 blank"> </span>no caso do in<span class="_9 blank"></span>v<span class="_2 blank"></span>asor estar utilizando</div><div class="t m0 x11 h5 yd2 ff5 fs2 fc0 sc0 ls0 wsd2">um<span class="_1c blank"> </span>console<span class="_f blank"> </span>ou<span class="_1c blank"> </span>terminal<span class="_f blank"> </span>gr´<span class="_19 blank"></span>a\ufb01co,<span class="_1c blank"> </span>de<span class="_f blank"> </span>mo do<span class="_f blank"> </span>que<span class="_1c blank"> </span>a<span class="_f blank"> </span>tela<span class="_1c blank"> </span>corrente<span class="_1c blank"> </span>p o de<span class="_1c blank"> </span>ser<span class="_f blank"> </span>capturada<span class="_1c blank"> </span>e<span class="_f blank"> </span>repro duzida</div><div class="t m0 x11 h5 yd3 ff5 fs2 fc0 sc0 ls0 wsd3">[14].<span class="_e blank"> </span>Al´<span class="_19 blank"></span>em do<span class="_f blank"> </span>uso<span class="_f blank"> </span>de fotogra\ufb01as, o<span class="_f blank"> </span>comando <span class="ff12 wsd4">xwd</span><span class="ws1d">,<span class="_f blank"> </span>do<span class="_f blank"> </span>sistema<span class="_1c blank"> </span>X<span class="_f blank"> </span>Windows,<span class="_1c blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_f blank"> </span>usado<span class="_1c blank"> </span>para</span></div><div class="t m0 x11 h5 yd4 ff5 fs2 fc0 sc0 ls0 wsd5">capturar<span class="_d blank"> </span>uma<span class="_d blank"> </span>janela<span class="_d blank"> </span>particular<span class="_d blank"> </span>ou<span class="_24 blank"> </span>to da<span class="_d blank"> </span>a<span class="_d blank"> </span>tela.<span class="_29 blank"> </span>O<span class="_d blank"> </span>comando<span class="_d blank"> </span><span class="ff12 wsd6">xwd </span><span class="wsd7">necessita de acesso de <span class="ff7 wsd8">r<span class="_2 blank"></span>o<span class="_2 blank"></span>ot <span class="ff5">e</span></span></span></div><div class="t m0 x11 h5 yd5 ff5 fs2 fc0 sc0 ls0 wsd9">dev<span class="_9 blank"></span>e ser executado a partir de outro terminal virtual ou remo<span class="_9 blank"></span>tamen<span class="_9 blank"></span>te para n\u02dc<span class="_19 blank"></span>ao alterar a tela</div><div class="t m0 x11 h5 yd6 ff5 fs2 fc0 sc0 ls0 wsda">que se deseja capturar:</div><div class="t m0 x11 h14 yd7 ff12 fs2 fc0 sc0 ls0 wsdb"># xwd -display localhost:0 -root > s<span class="_9 blank"></span>creen.xwd</div><div class="t m0 x12 h5 yd8 ff5 fs2 fc0 sc0 ls0 wsdc">A op¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao <span class="ff12 wsdd">-display<span class="_2a blank"> </span>localhost:0 </span><span class="ws1d">serve<span class="_f blank"> </span>para<span class="_6 blank"> </span>iden<span class="_9 blank"></span>ti\ufb01car<span class="_f blank"> </span>a<span class="_6 blank"> </span>m´<span class="_19 blank"></span>aquina<span class="_6 blank"> </span>e<span class="_6 blank"> </span>o<span class="_6 blank"> </span>n ´<span class="_16 blank"></span>umero<span class="_f blank"> </span>do<span class="_6 blank"> </span>terminal</span></div><div class="t m0 x11 h5 yd9 ff5 fs2 fc0 sc0 ls0 wsde">gr´<span class="_19 blank"></span>a\ufb01co de onde se deseja capturar a<span class="_1c blank"> </span>tela (no formato <span class="ff7 wsdf">nome ou ender<span class="_2 blank"></span>e¸<span class="_8 blank"></span>co IP<span class="ff5 wsd">:</span><span class="wse0">n ´<span class="_16 blank"></span>umer<span class="_2 blank"></span>o<span class="_1c blank"> </span>do<span class="_1c blank"> </span>teminal<span class="ff5 wsd">).</span></span></span></div><div class="t m0 x11 h5 yda ff5 fs2 fc0 sc0 ls0 wse1">E a op¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao <span class="ff12 wse2">-root </span><span class="wse3">esp eci\ufb01ca<span class="_1c blank"> </span>que<span class="_1c blank"> </span>to da<span class="_f blank"> </span>a<span class="_1c blank"> </span>tela<span class="_f blank"> </span>deve<span class="_1c blank"> </span>ser<span class="_1c blank"> </span>capturada.<span class="_e blank"> </span>O<span class="_f blank"> </span>comando<span class="_1c blank"> </span><span class="ff12 wse4">xwd </span><span class="wse5">gera sua sa<span class="_a blank"></span>´<span class="_c blank"></span>\u0131da</span></span></div><div class="t m0 x11 h5 ydb ff5 fs2 fc0 sc0 ls0 ws1d">em<span class="_f blank"> </span>um<span class="_f blank"> </span>formato<span class="_f blank"> </span>esp ecial<span class="_f blank"> </span>que<span class="_6 blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_f blank"> </span>salvo<span class="_1c blank"> </span>em<span class="_f blank"> </span>um<span class="_6 blank"> </span>arquiv<span class="_9 blank"></span>o.<span class="_10 blank"> </span>Esse<span class="_1c blank"> </span>arquivo<span class="_1c blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_6 blank"> </span>visualizado</div><div class="t m0 x11 h5 ydc ff5 fs2 fc0 sc0 ls0 wse6">atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es do utilit´<span class="_16 blank"></span>ario <span class="ff12 wsd4">xwud</span>:</div><div class="t m0 x11 h14 ydd ff12 fs2 fc0 sc0 ls0 wse7"># xwud -in screen.xwd</div><div class="t m0 x14 h9 yde ffb fs5 fc0 sc0 ls4">3<span class="ffc fs6 ls0 wse8 v2">As<span class="_1c blank"> </span>t´<span class="_7 blank"></span>ecnicas<span class="_f blank"> </span>apresentadas<span class="_1c blank"> </span>nesta<span class="_1c blank"> </span>se¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>ao<span class="_f blank"> </span>ap enas<span class="_f blank"> </span>ilustram<span class="_f blank"> </span>como<span class="_f blank"> </span>determinadas<span class="_1c blank"> </span>informa¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>oes<span class="_f blank"> </span>p o dem<span class="_f blank"> </span>ser<span class="_f blank"> </span>obtidas</span></div><div class="t m0 x11 ha ydf ffc fs6 fc0 sc0 ls0 wse9">na<span class="_1c blank"> </span>m´<span class="_20 blank"></span>aquina<span class="_1c blank"> </span>analisada,<span class="_1a blank"> </span>n\u02dc<span class="_7 blank"></span>ao<span class="_1c blank"> </span>ha<span class="_9 blank"></span>v<span class="_9 blank"></span>endo<span class="_1c blank"> </span>preocupa¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>ao<span class="_1c blank"> </span>com<span class="_1a blank"> </span>o<span class="_1c blank"> </span>destino<span class="_1c blank"> </span>da<span class="_1a blank"> </span>sa<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131da<span class="_1a blank"> </span>dos<span class="_1c blank"> </span>comandos<span class="_1c blank"> </span>apresen<span class="_2 blank"></span>tados.<span class="_e blank"> </span>Maiores</div><div class="t m0 x11 ha ye0 ffc fs6 fc0 sc0 ls0 wsea">detalhes sobre o processo de coleta de informa¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>oes s\u02dc<span class="_20 blank"></span>ao discutidos na se¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>ao 5.<span class="_1d blank"> </span>As ferramentas ut<span class="_9 blank"></span>ilizadas nas</div><div class="t m0 x11 ha ye1 ffc fs6 fc0 sc0 ls0 wseb">div<span class="_9 blank"></span>ersas explana¸<span class="_c blank"></span>c\u02dc<span class="_20 blank"></span>oes e apresentadas nos exemplos s\u02dc<span class="_20 blank"></span>ao compat<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131v<span class="_9 blank"></span>eis com a plataforma Lin<span class="_9 blank"></span>ux (plataforma adotada</div><div class="t m0 x11 ha ye2 ffc fs6 fc0 sc0 ls0 wsec">para esta pesquisa cient<span class="_a blank"></span>´<span class="_26 blank"></span>\u0131\ufb01ca).<span class="_2a blank"> </span>Algumas ferramentas dest<span class="_9 blank"></span>inadas a outras plataformas, como DOS e Windows,</div><div class="t m0 x11 ha ye3 ffc fs6 fc0 sc0 ls0 wsed">s\u02dc<span class="_20 blank"></span>ao apresentadas na se¸<span class="_c blank"></span>c\u02dc<span class="_20 blank"></span>ao 6.<span class="_11 blank"> </span>Com rela¸<span class="_c blank"></span>c\u02dc<span class="_7 blank"></span>ao aos exemplos,<span class="_e blank"> </span>o caracter \u201c<span class="ff13 wsee">\</span><span class="wsef">\u201d ´<span class="_c blank"></span>e utilizado<span class="_24 blank"> </span>para<span class="_24 blank"> </span>indicar<span class="_24 blank"> </span>que<span class="_24 blank"> </span>uma</span></div><div class="t m0 x11 ha ye4 ffc fs6 fc0 sc0 ls0 wsf0">determinada linha con<span class="_9 blank"></span>tin<span class="_9 blank"></span>ua na linha seguin<span class="_9 blank"></span>te.</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf8" class="pf w0 h0" data-page-no="8"><div class="pc pc8 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y52 w1 hb" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg8.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 wsaf">3.<span class="_1e blank"> </span>Evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias digitais<span class="_2e blank"> </span><span class="ff5">8</span></div><div class="t m0 x12 h5 y2a ff5 fs2 fc0 sc0 ls0 wsf1">A op¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>ao <span class="ff12 wsf2">-in </span><span class="wsf3">serv<span class="_2 blank"></span>e para esp<span class="_17 blank"> </span>eci\ufb01car o arquiv<span class="_9 blank"></span>o con<span class="_9 blank"></span>tendo a sa<span class="_a blank"></span>´<span class="_c blank"></span>\u0131da do comando <span class="ff12 wsd4">xwd<span class="_9 blank"></span><span class="ff5 wsf4">. V´<span class="_19 blank"></span>arios</span></span></span></div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 wsf5">utilit´<span class="_16 blank"></span>arios, como <span class="ff12 wsd4">fbm</span><span class="lsd">,</span><span class="ff12 wsf6">pbmplus </span><span class="lse">e</span><span class="ff12 wsd4">ImageMagick</span><span class="ws1b">,<span class="_f blank"> </span>p o dem<span class="_f blank"> </span>ser<span class="_6 blank"> </span>utilizados<span class="_f blank"> </span>para<span class="_6 blank"> </span>con<span class="_9 blank"></span>v<span class="_9 blank"></span>erter<span class="_f blank"> </span>o<span class="_f blank"> </span>formato</span></div><div class="t m0 x11 h5 y2c ff5 fs2 fc0 sc0 ls0 ws73">XWD para outros mais com<span class="_9 blank"></span>uns, como TIFF e GIF [14].</div><div class="t m0 x11 h13 ye5 ff11 fs8 fc0 sc0 ls0 wsf7">3.3<span class="_32 blank"> </span>Mem´<span class="_33 blank"></span>oria principal do sistema</div><div class="t m0 x11 h5 ye6 ff5 fs2 fc0 sc0 ls0 wsf8">A mem´<span class="_16 blank"></span>oria principal con<span class="_9 blank"></span>t<span class="_9 blank"></span>´<span class="_8 blank"></span>em todo tip<span class="_17 blank"> </span>o de informa¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>ao v<span class="_2 blank"></span>ol´<span class="_19 blank"></span>atil, como, p<span class="_17 blank"> </span>or exemplo, informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes</div><div class="t m0 x11 h5 ye7 ff5 fs2 fc0 sc0 ls0 ws98">dos<span class="_1c blank"> </span>pro cessos<span class="_1c blank"> </span>que<span class="_1c blank"> </span>est\u02dc<span class="_16 blank"></span>ao<span class="_1c blank"> </span>em<span class="_1c blank"> </span>execu¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao,<span class="_1c blank"> </span>dados<span class="_1c blank"> </span>que<span class="_1c blank"> </span>est\u02dc<span class="_19 blank"></span>ao<span class="_1c blank"> </span>sendo<span class="_1c blank"> </span>manipulados<span class="_1c blank"> </span>e<span class="_1c blank"> </span>m<span class="_9 blank"></span>uitas<span class="_1c blank"> </span>v<span class="_9 blank"></span>ezes<span class="_1c blank"> </span>ainda</div><div class="t m0 x11 h5 ye8 ff5 fs2 fc0 sc0 ls0 wsf9">n\u02dc<span class="_19 blank"></span>ao foram salv<span class="_9 blank"></span>os no disco e informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes do sistema op<span class="_17 blank"> </span>eracional [24, 26].<span class="_25 blank"> </span>T<span class="_b blank"></span>ais informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes</div><div class="t m0 x11 h5 ye9 ff5 fs2 fc0 sc0 ls0 ws1b">p o dem<span class="_1c blank"> </span>ser<span class="_1c blank"> </span>facilmente<span class="_1c blank"> </span>capturadas<span class="_1c blank"> </span>p or<span class="_1c blank"> </span>meio<span class="_1c blank"> </span>de<span class="_1c blank"> </span><span class="ff7 wsfa">dumps </span><span class="ws1d">da<span class="_f blank"> </span>mem´<span class="_19 blank"></span>oria,<span class="_1c blank"> </span>p ela<span class="_1c blank"> </span>gera¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>de<span class="_1c blank"> </span><span class="ff7 wsfb">c<span class="_2 blank"></span>or<span class="_9 blank"></span>e \ufb01les <span class="ff5 wsd">ou</span></span></span></div><div class="t m0 x11 h5 yea ff5 fs2 fc0 sc0 ls0 ws1b">p ela<span class="_f blank"> </span>in<span class="_9 blank"></span>terface<span class="_f blank"> </span>pro<span class="_9 blank"></span>vida<span class="_f blank"> </span>p elo<span class="_f blank"> </span>diret´<span class="_19 blank"></span>orio<span class="_1c blank"> </span><span class="ff12 wsfc">/proc </span><span class="wsd">[14].</span></div><div class="t m0 x12 h5 yeb ff5 fs2 fc0 sc0 ls0 wsfd">Ao<span class="_6 blank"> </span>fazer<span class="_6 blank"> </span>a<span class="_6 blank"> </span>captura<span class="_6 blank"> </span>das<span class="_6 blank"> </span>infoma¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_6 blank"> </span>da<span class="_d blank"> </span>mem´<span class="_19 blank"></span>oria<span class="_6 blank"> </span>(pro cesso<span class="_6 blank"> </span>c<span class="_9 blank"></span>hamado<span class="_6 blank"> </span>de<span class="_6 blank"> </span><span class="ff7 wsfe">dump </span><span class="wsff">da mem´<span class="_19 blank"></span>oria),</span></div><div class="t m0 x11 h5 yec ff5 fs2 fc0 sc0 ls0 ws100">uma p<span class="_17 blank"> </span>or¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao da mesma ser´<span class="_19 blank"></span>a alterada [15].<span class="_3 blank"> </span>Quando o utilit´<span class="_16 blank"></span>ario usado para fazer o <span class="ff7 ws101">dump </span><span class="wsd">´<span class="_19 blank"></span>e</span></div><div class="t m0 x11 h5 yed ff5 fs2 fc0 sc0 ls0 ws4a">executado,<span class="_e blank"> </span>o<span class="_e blank"> </span>sistema<span class="_e blank"> </span>op eracional<span class="_e blank"> </span>alo ca<span class="_24 blank"> </span>uma<span class="_e blank"> </span>´<span class="_19 blank"></span>area<span class="_e blank"> </span>da<span class="_e blank"> </span>mem´<span class="_19 blank"></span>oria<span class="_24 blank"> </span>para<span class="_e blank"> </span>o<span class="_e blank"> </span>pro cesso<span class="_e blank"> </span>em<span class="_e blank"> </span>execu¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao.</div><div class="t m0 x11 h5 yee ff5 fs2 fc0 sc0 ls0 ws1b">P<span class="_9 blank"></span>ortan<span class="_9 blank"></span>to<span class="_18 blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_1b blank"> </span>´<span class="_8 blank"></span>e<span class="_1a blank"> </span>p oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el<span class="_18 blank"> </span>ver<span class="_9 blank"></span>i\ufb01car<span class="_18 blank"> </span>se<span class="_1a blank"> </span>as<span class="_18 blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_18 blank"> </span>capturadas<span class="_18 blank"> </span>s\u02dc<span class="_19 blank"></span>ao<span class="_18 blank"> </span>exatamente<span class="_18 blank"> </span>iguais<span class="_18 blank"> </span>`<span class="_19 blank"></span>as<span class="_18 blank"> </span>originais</div><div class="t m0 x11 h5 yef ff5 fs2 fc0 sc0 ls0 wsd">[14].</div><div class="t m0 x12 h5 yf0 ff5 fs2 fc0 sc0 lsf">O<span class="ff7 ls0 ws102">dump </span><span class="ls0 ws1b">da<span class="_f blank"> </span>mem´<span class="_19 blank"></span>oria<span class="_f blank"> </span>p o de<span class="_f blank"> </span>ser<span class="_f blank"> </span>feito<span class="_f blank"> </span>atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es<span class="_f blank"> </span>do<span class="_f blank"> </span>comando<span class="_f blank"> </span><span class="ff12 wsd4">dd</span>:</span></div><div class="t m0 x11 h14 yf1 ff12 fs2 fc0 sc0 ls0 wsdb"># dd bs=1024 < /dev/mem > mem.dump</div><div class="t m0 x11 h14 yf2 ff12 fs2 fc0 sc0 ls0 wsdb"># dd bs=1024 < /dev/kmem > kmem.dump</div><div class="t m0 x1b h5 yf3 ff5 fs2 fc0 sc0 ls0">´</div><div class="t m0 x12 h5 yf4 ff5 fs2 fc0 sc0 ls0 ws4b">E<span class="_d blank"> </span>imp ortan<span class="_9 blank"></span>te<span class="_6 blank"> </span>lembrar<span class="_6 blank"> </span>que<span class="_d blank"> </span>tudo<span class="_d blank"> </span>no<span class="_d blank"> </span>sistema<span class="_6 blank"> </span>op eracional<span class="_d blank"> </span>UNIX<span class="_6 blank"> </span>´<span class="_8 blank"></span>e<span class="_d blank"> </span>tratado<span class="_6 blank"> </span>como<span class="_d blank"> </span>arquivo,<span class="_6 blank"> </span>de</div><div class="t m0 x11 h5 yf5 ff5 fs2 fc0 sc0 ls0 ws103">mo do<span class="_e blank"> </span>que<span class="_e blank"> </span>a<span class="_10 blank"> </span>mem´<span class="_16 blank"></span>oria<span class="_e blank"> </span>principal<span class="_10 blank"> </span>do<span class="_24 blank"> </span>computador<span class="_e blank"> </span>e<span class="_10 blank"> </span>a<span class="_e blank"> </span>mem´<span class="_19 blank"></span>oria<span class="_e blank"> </span>virtual<span class="_e blank"> </span>do<span class="_e blank"> </span><span class="ff7 ws104">kernel </span><span class="ws105">s\u02dc<span class="_19 blank"></span>ao acess<span class="_b blank"></span>´<span class="_c blank"></span>\u0131v<span class="_2 blank"></span>eis</span></div><div class="t m0 x11 h5 yf6 ff5 fs2 fc0 sc0 ls0 ws1d">atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es<span class="_1c blank"> </span>dos<span class="_f blank"> </span>arquivos<span class="_1c blank"> </span>de<span class="_f blank"> </span>disp ositivo<span class="_1c blank"> </span>(<span class="ff7 ws75">devic<span class="_2 blank"></span>eo</span></div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pf9" class="pf w0 h0" data-page-no="9"><div class="pc pc9 w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 yf7 w1 h15" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bg9.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 wsaf">3.<span class="_1e blank"> </span>Evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias digitais<span class="_2e blank"> </span><span class="ff5">9</span></div><div class="t m0 x11 h5 y2a ff5 fs2 fc0 sc0 ls0 ws106">pro<span class="_17 blank"> </span>cesso tiv<span class="_2 blank"></span>er p<span class="_17 blank"> </span>ermiss\u02dc<span class="_19 blank"></span>ao de escrita no diret´<span class="_19 blank"></span>orio onde se encon<span class="_2 blank"></span>tra o arquivo execut´<span class="_16 blank"></span>av<span class="_9 blank"></span>el relativ<span class="_9 blank"></span>o</div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 ws107">ao pro<span class="_17 blank"> </span>cesso, se o processo n\u02dc<span class="_19 blank"></span>ao rede\ufb01niu a a¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao a ser tomada ao receber o sinal e se o tamanho</div><div class="t m0 x11 h5 y2c ff5 fs2 fc0 sc0 ls0 ws108">do <span class="ff7 ws109">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_6 blank"> </span>\ufb01le <span class="ff5 ws10a">n\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>exceder<span class="_f blank"> </span>o<span class="_6 blank"> </span>limite<span class="_1c blank"> </span>m´<span class="_19 blank"></span>aximo<span class="_6 blank"> </span>imp osto<span class="_1c blank"> </span>para<span class="_f blank"> </span>o<span class="_6 blank"> </span>usu´<span class="_16 blank"></span>ario<span class="_f blank"> </span>dono<span class="_6 blank"> </span>do<span class="_1c blank"> </span>pro cesso<span class="_f blank"> </span>[12].</span></span></div><div class="t m0 x12 h5 y2d ff5 fs2 fc0 sc0 ls0 ws10b">A an´<span class="_19 blank"></span>alise de um <span class="ff7 ws10c">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_24 blank"> </span>\ufb01le <span class="ff5 ws1b">p o de<span class="_d blank"> </span>revelar,<span class="_d blank"> </span>den<span class="_9 blank"></span>tre<span class="_d blank"> </span>outras<span class="_d blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_8 blank"></span>oes,<span class="_d blank"> </span>as<span class="_d blank"> </span>rotinas<span class="_d blank"> </span>que<span class="_d blank"> </span>esta<span class="_9 blank"></span>v<span class="_2 blank"></span>am</span></span></div><div class="t m0 x11 h5 y2e ff5 fs2 fc0 sc0 ls0 ws10d">sendo<span class="_1c blank"> </span>executadas,<span class="_1c blank"> </span>os<span class="_f blank"> </span>v<span class="_2 blank"></span>alores<span class="_1c blank"> </span>dos<span class="_f blank"> </span>registradores,<span class="_1c blank"> </span>o<span class="_1c blank"> </span>conte´<span class="_16 blank"></span>udo<span class="_1c blank"> </span>do<span class="_f blank"> </span>espa¸<span class="_8 blank"></span>co<span class="_f blank"> </span>de<span class="_1c blank"> </span>endere¸<span class="_20 blank"></span>camento<span class="_1c blank"> </span>virtual</div><div class="t m0 x11 h5 y2f ff5 fs2 fc0 sc0 ls0 ws10e">do pro<span class="_17 blank"> </span>cesso e a estrutura do usu´<span class="_16 blank"></span>ario [12, 16].<span class="_31 blank"> </span>Ataques de <span class="ff7 ws10f">bu\ufb00er over\ufb02ow </span><span class="ws110">geralmen<span class="_9 blank"></span>te causam</span></div><div class="t m0 x11 h5 y30 ff5 fs2 fc0 sc0 ls0 ws111">a gera¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao de <span class="ff7 ws112">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_23 blank"> </span>\ufb01les <span class="ff5 ws113">e alguns </span><span class="ws114">exploits <span class="ff5 ws115">usados por atacantes geram propositadamen<span class="_9 blank"></span>te <span class="ff7 ws75">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e</span></span></span></span></div><div class="t m0 x11 h5 y31 ff7 fs2 fc0 sc0 ls0 ws116">dumps <span class="ff5 ws117">de programas que manipulam senhas, de modo que tais senhas p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>dem ser resgatadas do</span></div><div class="t m0 x11 h5 y32 ff5 fs2 fc0 sc0 ls0 ws2f">arquiv<span class="_9 blank"></span>o gerado [14, 27].</div><div class="t m0 x12 h5 y33 ff5 fs2 fc0 sc0 ls0 ws118">O comando <span class="ff12 ws119">file </span><span class="ws1b">p o de<span class="_1c blank"> </span>ser<span class="_f blank"> </span>usado<span class="_1c blank"> </span>para<span class="_f blank"> </span>determinar<span class="_1c blank"> </span>o<span class="_f blank"> </span>programa<span class="_f blank"> </span>relacionado<span class="_1c blank"> </span>ao<span class="_1c blank"> </span><span class="ff7 ws11a">c<span class="_9 blank"></span>or<span class="_2 blank"></span>e \ufb01le<span class="ff5 ws1d">,<span class="_1c blank"> </span>b em</span></span></span></div><div class="t m0 x11 h5 y34 ff5 fs2 fc0 sc0 ls0 ws11b">como o sinal que causou sua gera¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao [14]:</div><div class="t m0 x11 h14 yf8 ff12 fs2 fc0 sc0 ls0 wse7"># file core</div><div class="t m0 x11 h14 yf9 ff12 fs2 fc0 sc0 ls0 ws11c">core: ELF 32-bit LSB core file of \u2019teste\u2019 (signal 11), Intel 8<span class="_2 blank"></span>0386</div><div class="t m0 x12 h5 yfa ff5 fs2 fc0 sc0 ls0 ws11d">No exemplo an<span class="_9 blank"></span>terior, o <span class="ff7 ws11e">c<span class="_9 blank"></span>or<span class="_2 blank"></span>e dump <span class="ff5 ws11f">originou-se do programa <span class="ff12 ws120">teste </span><span class="ws121">que teve sua ex<span class="_9 blank"></span>ecu¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao</span></span></span></div><div class="t m0 x11 h5 yfb ff5 fs2 fc0 sc0 ls0 ws1b">in<span class="_9 blank"></span>terrompida<span class="_1c blank"> </span>pelo<span class="_1c blank"> </span>sinal<span class="_1c blank"> </span>11<span class="_1c blank"> </span>(SIGSEGV),<span class="_1a blank"> </span>indicando<span class="_1c blank"> </span>uma<span class="_1c blank"> </span>p oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el<span class="_1c blank"> </span>falha<span class="_1c blank"> </span>de<span class="_1a blank"> </span>segmenta¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao.<span class="_e blank"> </span>Pode-se</div><div class="t m0 x11 h5 yfc ff5 fs2 fc0 sc0 ls0 ws122">usar o comando <span class="ff12 ws123">strings </span><span class="ws124">para iden<span class="_2 blank"></span>ti\ufb01car os arquivos que o programa est<span class="_9 blank"></span>a<span class="_9 blank"></span>v<span class="_2 blank"></span>a referenciando, ou</span></div><div class="t m0 x11 h5 yfd ff5 fs2 fc0 sc0 ls0 ws125">ainda fazer uma an´<span class="_16 blank"></span>alise mais profunda com a a<span class="_22 blank"> </span>juda de program<span class="_9 blank"></span>as de depura¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao, como <span class="ff12 ws126">adb </span><span class="wsd">ou</span></div><div class="t m0 x11 h5 yfe ff12 fs2 fc0 sc0 ls0 ws127">gdb <span class="ff5 ws2f">[12, 14]:</span></div><div class="t m0 x11 h14 yff ff12 fs2 fc0 sc0 ls0 ws128"># strings -a core | more</div><div class="t m0 x11 h14 y100 ff12 fs2 fc0 sc0 ls0 wse7"># gdb -c core</div><div class="t m0 x12 h5 y101 ff5 fs2 fc0 sc0 ls0 ws129">Os <span class="ff7 ws12a">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_6 blank"> </span>\ufb01les <span class="ff5 ws1b">p o dem<span class="_f blank"> </span>revelar<span class="_1c blank"> </span>algumas<span class="_f blank"> </span>evid\u02c6<span class="_19 blank"></span>encias<span class="_f blank"> </span>como,<span class="_f blank"> </span>p or<span class="_f blank"> </span>exemplo:</span></span></div><div class="t m0 x1b h5 y102 ff14 fs9 fc0 sc0 ls10">\u2022<span class="ff5 fs2 ls0 ws12b">o programa origem do <span class="ff7 ws12c">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_24 blank"> </span>\ufb01le <span class="ff5 ws12d">´<span class="_8 blank"></span>e<span class="_6 blank"> </span>susp eito<span class="_6 blank"> </span>(p o dendo<span class="_6 blank"> </span>ser<span class="_6 blank"> </span>um<span class="_d blank"> </span>programa<span class="_6 blank"> </span>desconhecido;<span class="_d blank"> </span>um</span></span></span></div><div class="t m0 x0 h5 y103 ff5 fs2 fc0 sc0 ls0 ws70">comando conhecido, mas que n\u02dc<span class="_19 blank"></span>ao deveri<span class="_9 blank"></span>a ter sido terminado;<span class="_e blank"> </span>um programa com nome</div><div class="t m0 x0 h5 y104 ff5 fs2 fc0 sc0 ls0 ws12e">que faz alus\u02dc<span class="_19 blank"></span>ao a um c´<span class="_19 blank"></span>odigo hostil,<span class="_24 blank"> </span>como <span class="ff7 ws12f">sni\ufb00er </span><span class="ws130">ou <span class="ff7 ws75">cr<span class="_2 blank"></span>acker<span class="ff5 ws131">;<span class="_24 blank"> </span>ou ainda um programa que</span></span></span></div><div class="t m0 x0 h5 y105 ff5 fs2 fc0 sc0 ls0 ws132">manipula<span class="_1c blank"> </span>algum<span class="_f blank"> </span>tip o<span class="_f blank"> </span>de<span class="_6 blank"> </span>senha);</div><div class="t m0 x1b h5 y106 ff14 fs9 fc0 sc0 ls11">\u2022<span class="ff5 fs2 ls0 ws81">o<span class="_f blank"> </span>sinal<span class="_f blank"> </span>recebido<span class="_f blank"> </span>p elo<span class="_f blank"> </span>pro cesso<span class="_1c blank"> </span>´<span class="_8 blank"></span>e<span class="_f blank"> </span>susp eito<span class="_1c blank"> </span>(o<span class="_6 blank"> </span>sinal<span class="_f blank"> </span>p o de<span class="_f blank"> </span>indicar<span class="_1c blank"> </span>um<span class="_f blank"> </span><span class="ff7 ws133">bug </span><span class="ws134">no programa);</span></span></div><div class="t m0 x1b h5 y107 ff14 fs9 fc0 sc0 ls10">\u2022<span class="ff5 fs2 ls0 ws135">o programa origem do <span class="ff7 ws136">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e<span class="_24 blank"> </span>\ufb01le <span class="ff5 ws137">faz refer\u02c6<span class="_19 blank"></span>encia a arquiv<span class="_9 blank"></span>os susp<span class="_17 blank"> </span>eitos (arquiv<span class="_2 blank"></span>os com nomes</span></span></span></div><div class="t m0 x0 h5 y108 ff5 fs2 fc0 sc0 ls0 ws138">susp eitos<span class="_1c blank"> </span>ou<span class="_f blank"> </span>em<span class="_f blank"> </span>diret´<span class="_19 blank"></span>orios<span class="_f blank"> </span>susp eitos,<span class="_f blank"> </span>ou<span class="_f blank"> </span>arquiv<span class="_9 blank"></span>os<span class="_1c blank"> </span>que<span class="_f blank"> </span>o<span class="_f blank"> </span>programa<span class="_f blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_f blank"> </span>dev<span class="_9 blank"></span>eria<span class="_1c blank"> </span>estar<span class="_f blank"> </span>aces-</div><div class="t m0 x0 h5 y109 ff5 fs2 fc0 sc0 ls0 ws1b">sando,<span class="_f blank"> </span>p or<span class="_f blank"> </span>exemplo);</div><div class="t m0 x12 h5 y10a ff5 fs2 fc0 sc0 ls0 ws139">Al<span class="_9 blank"></span>´<span class="_8 blank"></span>em dos <span class="ff7 ws13a">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e \ufb01les<span class="ff5 ws13b">, existe outra fonte de in<span class="_9 blank"></span>forma¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao bastan<span class="_9 blank"></span>te semelhan<span class="_9 blank"></span>te, denominada de</span></span></div><div class="t m0 x11 h5 y10b ff7 fs2 fc0 sc0 ls0 ws13c">cr<span class="_2 blank"></span>ash dump<span class="ff5 ws13d">, que cont<span class="_2 blank"></span>´<span class="_8 blank"></span>em uma imagem da mem´<span class="_16 blank"></span>oria do sistema no momento e<span class="_9 blank"></span>m que uma falha</span></div><div class="t m0 x11 h5 y10c ff5 fs2 fc0 sc0 ls0 ws13e">inesp erada<span class="_6 blank"> </span>acontece<span class="_f blank"> </span>(denominada<span class="_d blank"> </span>de<span class="_6 blank"> </span><span class="ff7 ws75">cr<span class="_9 blank"></span>ash<span class="ff5 ws13f">)<span class="_6 blank"> </span>[16,<span class="_d blank"> </span>27].<span class="_31 blank"> </span>Quando um<span class="_d blank"> </span>sistema<span class="_6 blank"> </span>UNIX<span class="_d blank"> </span>falha,<span class="_d blank"> </span>isto ´<span class="_8 blank"></span>e,</span></span></div><div class="t m0 x11 h5 y10d ff5 fs2 fc0 sc0 ls0 ws140">o corre<span class="_d blank"> </span>um<span class="_6 blank"> </span><span class="ff7 ws141">cr<span class="_9 blank"></span>ash <span class="ff5 ws1b">do<span class="_6 blank"> </span>sistema,<span class="_24 blank"> </span>ele<span class="_d blank"> </span>p o de<span class="_d blank"> </span>criar<span class="_d blank"> </span>um<span class="_d blank"> </span>arquiv<span class="_9 blank"></span>o<span class="_6 blank"> </span>denominado<span class="_d blank"> </span><span class="ff7 ws142">cr<span class="_2 blank"></span>ash dump<span class="ff5 ws143">,<span class="_24 blank"> </span>para<span class="_d blank"> </span>a judar</span></span></span></span></div><div class="t m0 x11 h8 y10e ff5 fs2 fc0 sc0 ls0 ws144">os esp<span class="_17 blank"> </span>ecialistas a determinar a cau<span class="_9 blank"></span>sa da falha [27].<span class="_e blank"> </span>Esse arquiv<span class="_9 blank"></span>o, gerado p<span class="_17 blank"> </span>ela fun¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao <span class="ff12 ws145">panic() <span class="ff9 fs4 ls12 v1">4</span></span>,</div><div class="t m0 x11 h5 y10f ff5 fs2 fc0 sc0 ls0 ws146">con<span class="_9 blank"></span>t<span class="_9 blank"></span>´<span class="_8 blank"></span>em informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes sobre o programa que causou a falha, al<span class="_9 blank"></span>´<span class="_8 blank"></span>em de outros dados que esta<span class="_2 blank"></span>v<span class="_2 blank"></span>am na</div><div class="t m0 x11 h5 y110 ff5 fs2 fc0 sc0 ls0 ws1b">mem´<span class="_19 blank"></span>oria,<span class="_1a blank"> </span>como<span class="_1c blank"> </span>senhas<span class="_18 blank"> </span>p or<span class="_1c blank"> </span>exemplo<span class="_1a blank"> </span>[27].<span class="_24 blank"> </span>Alguns<span class="_1c blank"> </span>atacan<span class="_2 blank"></span>tes<span class="_1c blank"> </span>desen<span class="_2 blank"></span>volv<span class="_2 blank"></span>em<span class="_1c blank"> </span>programas<span class="_18 blank"> </span>que<span class="_1c blank"> </span>causam</div><div class="t m0 x11 h5 y111 ff5 fs2 fc0 sc0 ls0 ws147">um <span class="ff7 ws148">cr<span class="_2 blank"></span>ash <span class="ff5 ws149">do sistema e examinam o </span><span class="ws14a">cr<span class="_2 blank"></span>ash<span class="_6 blank"> </span>dump <span class="ff5 ws30">resultante<span class="_1c blank"> </span>`<span class="_19 blank"></span>a<span class="_f blank"> </span>pro cura<span class="_f blank"> </span>de<span class="_f blank"> </span>senhas.</span></span></span></div><div class="t m0 x14 h9 y112 ffb fs5 fc0 sc0 ls4">4<span class="ffc fs6 ls0 ws14b v2">A fun¸<span class="_c blank"></span>c\u02dc<span class="_20 blank"></span>ao <span class="ff15 ws14c">panic() <span class="ffc ws14d">n\u02dc<span class="_7 blank"></span>ao<span class="_1c blank"> </span>po de<span class="_1c blank"> </span>ser<span class="_1a blank"> </span>inv<span class="_2 blank"></span>o cada<span class="_1c blank"> </span>por<span class="_1c blank"> </span>um<span class="_1a blank"> </span>aplicativ<span class="_9 blank"></span>o<span class="_1a blank"> </span>[27 ].</span></span></span></div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div> <div id="pfa" class="pf w0 h0" data-page-no="a"><div class="pc pca w0 h0"><img fetchpriority="low" loading="lazy" class="bi x11 y113 w1 h16" alt="" src="https://files.passeidireto.com/702f41f1-06ab-4fc6-b562-045c68a9c36f/bga.png"><div class="t m0 x11 h5 y29 ff8 fs2 fc0 sc0 ls0 wsaf">3.<span class="_1e blank"> </span>Evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias digitais<span class="_35 blank"> </span><span class="ff5 wsd">10</span></div><div class="t m0 x12 h5 y2a ff5 fs2 fc0 sc0 ls13">O<span class="ff7 ls0 ws14e">cr<span class="_2 blank"></span>ash<span class="_e blank"> </span>dump <span class="ff5 ws14f">´<span class="_8 blank"></span>e uma esp<span class="_9 blank"></span>´<span class="_8 blank"></span>ecie de \u201ccaixa preta\u201d do sistema \u2013 todo tip<span class="_17 blank"> </span>o de informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao que</span></span></div><div class="t m0 x11 h5 y2b ff5 fs2 fc0 sc0 ls0 ws150">esta<span class="_9 blank"></span>v<span class="_2 blank"></span>a na mem´<span class="_19 blank"></span>oria no momen<span class="_9 blank"></span>to da falha ser´<span class="_16 blank"></span>a salv<span class="_2 blank"></span>a nele.<span class="_10 blank"> </span>Assim como no caso dos <span class="ff7 ws151">c<span class="_2 blank"></span>or<span class="_2 blank"></span>e \ufb01les<span class="ff5 ws152">, os</span></span></div><div class="t m0 x11 h5 y2c ff5 fs2 fc0 sc0 ls0 ws153">comandos <span class="ff12 ws154">strings </span><span class="ls14">e</span><span class="ff12 ws155">adb </span><span class="ws1b">po dem<span class="_1a blank"> </span>ser<span class="_1a blank"> </span>usados<span class="_1a blank"> </span>para<span class="_1a blank"> </span>acessar<span class="_18 blank"> </span>as<span class="_1a blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_1a blank"> </span>cont<span class="_9 blank"></span>idas<span class="_1a blank"> </span>no<span class="_18 blank"> </span><span class="ff7 ws156">cr<span class="_9 blank"></span>ash dump</span></span></div><div class="t m0 x11 h5 y2d ff5 fs2 fc0 sc0 ls0 ws1b">[27].<span class="_1d blank"> </span>Den<span class="_9 blank"></span>tre<span class="_d blank"> </span>essas<span class="_d blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_d blank"> </span>p o dem<span class="_d blank"> </span>estar<span class="_24 blank"> </span>mensagens<span class="_d blank"> </span>de<span class="_d blank"> </span>log<span class="_d blank"> </span>que<span class="_d blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_24 blank"> </span>puderam<span class="_d blank"> </span>ser<span class="_d blank"> </span>gra<span class="_9 blank"></span>v<span class="_2 blank"></span>adas</div><div class="t m0 x11 h5 y2e ff5 fs2 fc0 sc0 ls0 ws58">nos<span class="_6 blank"> </span>resp ectivos<span class="_6 blank"> </span>arquiv<span class="_9 blank"></span>os<span class="_d blank"> </span>em<span class="_d blank"> </span>decorr<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encia<span class="_6 blank"> </span>do<span class="_d blank"> </span><span class="ff7 ws157">cr<span class="_2 blank"></span>ash <span class="ff5 ws158">do sistema.<span class="_31 blank"> </span>Quando uma mensagem de log</span></span></div><div class="t m0 x11 h5 y2f ff5 fs2 fc0 sc0 ls0 ws159">´<span class="_8 blank"></span>e<span class="_f blank"> </span>gerada,<span class="_f blank"> </span>ela<span class="_1c blank"> </span>´<span class="_8 blank"></span>e<span class="_f blank"> </span>colo cada<span class="_f blank"> </span>no<span class="_6 blank"> </span><span class="ff7 ws15a">bu\ufb00er </span><span class="ws15b">de mensagens da mem´<span class="_16 blank"></span>oria antes de ser gra<span class="_2 blank"></span>v<span class="_2 blank"></span>ada no disco, de</span></div><div class="t m0 x11 h5 y30 ff5 fs2 fc0 sc0 ls0 ws15c">mo<span class="_17 blank"> </span>do que a falha do sistema i<span class="_9 blank"></span>mp<span class="_17 blank"> </span>ede que a mensagem seja salv<span class="_2 blank"></span>a em arquiv<span class="_2 blank"></span>o [27].<span class="_2a blank"> </span>Al<span class="_9 blank"></span>´<span class="_8 blank"></span>em disso,</div><div class="t m0 x11 h5 y31 ff5 fs2 fc0 sc0 ls0 ws15d">algumas v<span class="_9 blank"></span>ers\u02dc<span class="_16 blank"></span>oes do sistema UNIX p<span class="_17 blank"> </span>ermitem a execu¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de comandos de \u201cstatus\u201d (como, p<span class="_17 blank"> </span>or</div><div class="t m0 x11 h17 y32 ff5 fs2 fc0 sc0 ls0 ws15e">exemplo, <span class="ff12 wsd4">ps</span><span class="ls15">,</span><span class="ff12 wsd4">netstat</span><span class="ls16">,</span><span class="ff12 ws15f">nfsstat </span><span class="ls17">e</span><span class="ff12 wsd4">arp</span><span class="ws160">) sob<span class="_9 blank"></span>re o <span class="ff7 ws161">cr<span class="_2 blank"></span>ash<span class="_d blank"> </span>dump <span class="ff9 fs4 lsb v1">5</span><span class="ff5 ws1d">,<span class="_6 blank"> </span>de<span class="_6 blank"> </span>mo do<span class="_6 blank"> </span>que<span class="_1c blank"> </span>´<span class="_8 blank"></span>e<span class="_6 blank"> </span>p oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el<span class="_f blank"> </span>resgatar,</span></span></span></div><div class="t m0 x11 h5 y33 ff5 fs2 fc0 sc0 ls0 ws1b">p or<span class="_1c blank"> </span>exemplo,<span class="_f blank"> </span>informa¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>oes<span class="_f blank"> </span>sobre<span class="_f blank"> </span>os<span class="_1c blank"> </span>pro cessos<span class="_f blank"> </span>que<span class="_1c blank"> </span>estav<span class="_2 blank"></span>am<span class="_1c blank"> </span>executando<span class="_1c blank"> </span>no<span class="_f blank"> </span>momen<span class="_9 blank"></span>to<span class="_1c blank"> </span>da<span class="_f blank"> </span>falha<span class="_1c blank"> </span>do</div><div class="t m0 x11 h5 y34 ff5 fs2 fc0 sc0 ls0 ws162">sistema<span class="_f blank"> </span>e<span class="_f blank"> </span>as<span class="_f blank"> </span>conex\u02dc<span class="_19 blank"></span>oes<span class="_f blank"> </span>de<span class="_f blank"> </span>rede<span class="_f blank"> </span>que<span class="_f blank"> </span>foram<span class="_f blank"> </span>estab elecidas<span class="_f blank"> </span>[27]:</div><div class="t m0 x11 h14 yf8 ff12 fs2 fc0 sc0 ls0 ws163"># ps -[op¸<span class="_16 blank"></span>c~<span class="_16 blank"></span>oes] imagem_do_kernel crash_dump</div><div class="t m0 x11 h14 yf9 ff12 fs2 fc0 sc0 ls0 ws164"># netstat -[op¸<span class="_16 blank"></span>c~<span class="_16 blank"></span>oes] imagem_do_kernel crash_dump</div><div class="t m0 x11 h14 y114 ff12 fs2 fc0 sc0 ls0 ws164"># nfsstat -[op¸<span class="_16 blank"></span>c~<span class="_16 blank"></span>oes] imagem_do_kernel crash_dump</div><div class="t m0 x11 h14 y115 ff12 fs2 fc0 sc0 ls0 ws164"># arp -[op¸<span class="_16 blank"></span>c~<span class="_16 blank"></span>oes] imagem_do_kernel crash_dump</div><div class="t m0 x12 h5 yfc ff5 fs2 fc0 sc0 ls0 ws165">Outra<span class="_d blank"> </span>forma<span class="_24 blank"> </span>de<span class="_24 blank"> </span>acessar<span class="_24 blank"> </span>a<span class="_24 blank"> </span>mem´<span class="_19 blank"></span>oria ´<span class="_8 blank"></span>e<span class="_24 blank"> </span>atra<span class="_9 blank"></span>v<span class="_9 blank"></span>´<span class="_8 blank"></span>es<span class="_d blank"> </span>do<span class="_24 blank"> </span>pseudo-arquiv<span class="_9 blank"></span>o<span class="_24 blank"> </span><span class="ff12 wsd4">/proc/kcore</span><span class="ws166">, que repre-</span></div><div class="t m0 x11 h5 yfd ff5 fs2 fc0 sc0 ls0 ws167">sen<span class="_9 blank"></span>ta a mem´<span class="_19 blank"></span>oria f<span class="_b blank"></span>´<span class="_c blank"></span>\u0131sica do sistema no formato de um <span class="ff7 ws168">c<span class="_9 blank"></span>or<span class="_2 blank"></span>e \ufb01le<span class="ff5 ws81">,<span class="_d blank"> </span>p o dendo<span class="_d blank"> </span>ser<span class="_d blank"> </span>examinado<span class="_6 blank"> </span>com<span class="_d blank"> </span>o</span></span></div><div class="t m0 x11 h5 yfe ff5 fs2 fc0 sc0 ls0 ws169">aux<span class="_a blank"></span>´<span class="_c blank"></span>\u0131lio dos comandos <span class="ff12 ws16a">strings </span><span class="ls18">e</span><span class="ff12 wsd4">gdb</span><span class="ws1d">.<span class="_e blank"> </span>Maiores<span class="_1c blank"> </span>detalhes<span class="_1c blank"> </span>sobre<span class="_f blank"> </span>a<span class="_1c blank"> </span>interface<span class="_1c blank"> </span>pro<span class="_9 blank"></span>vida<span class="_1c blank"> </span>p elo<span class="_1c blank"> </span>diret´<span class="_19 blank"></span>orio</span></div><div class="t m0 x11 h5 y116 ff12 fs2 fc0 sc0 ls0 ws16b">/proc <span class="ff5 ws16c">s\u02dc<span class="_19 blank"></span>ao apresen<span class="_9 blank"></span>tados adian<span class="_2 blank"></span>te e<span class="_24 blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes adicionais sobre an´<span class="_16 blank"></span>alise de <span class="ff7 ws16d">cr<span class="_2 blank"></span>ash<span class="_e blank"> </span>dump <span class="ff5 ws1d">p o dem</span></span></span></div><div class="t m0 x11 h5 y117 ff5 fs2 fc0 sc0 ls0 ws16e">ser encon<span class="_9 blank"></span>tradas em [8].</div><div class="t m0 x11 h13 y118 ff11 fs8 fc0 sc0 ls0 ws16f">3.4<span class="_32 blank"> </span>T<span class="_a blank"></span>r´<span class="_33 blank"></span>afego de rede</div><div class="t m0 x11 h5 y119 ff5 fs2 fc0 sc0 ls0 ws170">A captura do tr´<span class="_16 blank"></span>afego de rede p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>de ser comparada `<span class="_16 blank"></span>a grav<span class="_2 blank"></span>a¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao em v<span class="_a blank"></span>´<span class="_c blank"></span>\u0131deo de um crime.<span class="_10 blank"> </span>A partir</div><div class="t m0 x11 h5 y11a ff5 fs2 fc0 sc0 ls0 ws171">dos datagramas capturados,<span class="_1c blank"> </span>´<span class="_19 blank"></span>e p<span class="_17 blank"> </span>oss<span class="_a blank"></span>´<span class="_c blank"></span>\u0131vel recon<span class="_2 blank"></span>truir a com<span class="_9 blank"></span>unica¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao entre o atacan<span class="_2 blank"></span>te e a m´<span class="_19 blank"></span>aquina</div><div class="t m0 x11 h5 y11b ff5 fs2 fc0 sc0 ls0 ws172">alv<span class="_9 blank"></span>o, de mo<span class="_17 blank"> </span>do que uma sequ<span class="_2 blank"></span>\u02c6<span class="_8 blank"></span>encia de even<span class="_2 blank"></span>tos p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>de ser estab<span class="_17 blank"> </span>elecida e comparada co<span class="_9 blank"></span>m as outras</div><div class="t m0 x11 h5 y11c ff5 fs2 fc0 sc0 ls0 ws73">evid<span class="_9 blank"></span>\u02c6<span class="_8 blank"></span>encias encon<span class="_2 blank"></span>tradas na m´<span class="_19 blank"></span>aquina inv<span class="_b blank"></span>adida [6].</div><div class="t m0 x12 h5 y11d ff5 fs2 fc0 sc0 ls0 ws1b">Existem<span class="_24 blank"> </span>v´<span class="_19 blank"></span>arios<span class="_e blank"> </span>programas<span class="_24 blank"> </span>que<span class="_e blank"> </span>p o dem<span class="_24 blank"> </span>ser<span class="_e blank"> </span>usados<span class="_24 blank"> </span>para<span class="_e blank"> </span>capturar<span class="_24 blank"> </span>o<span class="_24 blank"> </span>tr´<span class="_19 blank"></span>afego<span class="_e blank"> </span>de<span class="_e blank"> </span>rede,<span class="_e blank"> </span>comu-</div><div class="t m0 x11 h5 y11e ff5 fs2 fc0 sc0 ls0 ws173">men<span class="_9 blank"></span>te denominados de <span class="ff7 ws75">sni\ufb00ers</span><span class="ws174">.<span class="_31 blank"> </span>Al´<span class="_19 blank"></span>em de capturar os datagramas que trafegam na rede (n\u02dc<span class="_16 blank"></span>ao</span></div><div class="t m0 x11 h5 y11f ff5 fs2 fc0 sc0 ls0 ws4b">imp ortando<span class="_f blank"> </span>o<span class="_6 blank"> </span>endere¸<span class="_8 blank"></span>co<span class="_6 blank"> </span>destino<span class="_f blank"> </span>do<span class="_6 blank"> </span>datagrama),<span class="_6 blank"> </span>os<span class="_f blank"> </span><span class="ff7 ws175">sni\ufb00ers </span><span class="ws176">p<span class="_17 blank"> </span>o<span class="_17 blank"> </span>dem decodi\ufb01c´<span class="_19 blank"></span>a-los e exibi-los em</span></div><div class="t m0 x11 h5 y120 ff5 fs2 fc0 sc0 ls0 ws177">um formato mais leg<span class="_a blank"></span>´<span class="_c blank"></span>\u0131v<span class="_9 blank"></span>el, ou ainda executar op<span class="_17 blank"> </span>era¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes mais complexas como recon<span class="_2 blank"></span>tru¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>ao de</div><div class="t m0 x11 h5 y121 ff5 fs2 fc0 sc0 ls0 ws178">sess\u02dc<span class="_19 blank"></span>ao e recup<span class="_17 blank"> </span>era¸<span class="_8 blank"></span>c\u02dc<span class="_19 blank"></span>ao de arquiv<span class="_9 blank"></span>os transferidos p<span class="_17 blank"> </span>ela rede [6].</div><div class="t m0 x12 h17 y122 ff5 fs2 fc0 sc0 ls0 ws179">T<span class="_b blank"></span>alvez o exemplo mais com<span class="_2 blank"></span>um desses programas seja o <span class="ff12 ws17a">tcpdump <span class="ff9 fs4 ls19 v1">6</span></span><span class="ws17b">.<span class="_1e blank"> </span>O <span class="ff12 ws17c">tcpdump </span><span class="ws1d">p o de<span class="_10 blank"> </span>ser</span></span></div><div class="t m0 x11 h5 y123 ff5 fs2 fc0 sc0 ls0 ws4a">usado<span class="_1c blank"> </span>para<span class="_f blank"> </span>capturar<span class="_f blank"> </span>to do<span class="_1c blank"> </span>tip o<span class="_f blank"> </span>de<span class="_f blank"> </span>tr´<span class="_19 blank"></span>afego<span class="_f blank"> </span>de<span class="_f blank"> </span>rede,<span class="_1c blank"> </span>deco di\ufb01car<span class="_f blank"> </span>e<span class="_f blank"> </span>exibir<span class="_1c blank"> </span>os<span class="_f blank"> </span>datagramas<span class="_f blank"> </span>`<span class="_19 blank"></span>a<span class="_f blank"> </span>medida</div><div class="t m0 x11 h5 y124 ff5 fs2 fc0 sc0 ls0 ws17d">que<span class="_d blank"> </span>eles<span class="_24 blank"> </span>s\u02dc<span class="_19 blank"></span>ao<span class="_24 blank"> </span>coletados<span class="_24 blank"> </span>(no<span class="_d blank"> </span>caso<span class="_24 blank"> </span>de<span class="_24 blank"> </span>uma<span class="_24 blank"> </span>an´<span class="_19 blank"></span>alise<span class="_d blank"> </span>em<span class="_24 blank"> </span>temp o<span class="_24 blank"> </span>real)<span class="_d blank"> </span>ou<span class="_24 blank"> </span>armazenar<span class="_24 blank"> </span>os<span class="_24 blank"> </span>datagramas</div><div class="t m0 x11 h5 y125 ff5 fs2 fc0 sc0 ls0 ws1b">em<span class="_d blank"> </span>um<span class="_d blank"> </span>arquiv<span class="_9 blank"></span>o<span class="_6 blank"> </span>bin´<span class="_19 blank"></span>ario,<span class="_24 blank"> </span>p ermitindo<span class="_d blank"> </span>uma<span class="_6 blank"> </span>an´<span class="_19 blank"></span>alise<span class="_d blank"> </span>p osterior<span class="_d blank"> </span>(atrav<span class="_2 blank"></span>´<span class="_8 blank"></span>es<span class="_d blank"> </span>do<span class="_d blank"> </span>pr´<span class="_19 blank"></span>oprio<span class="_d blank"> </span><span class="ff12 ws17e">tcpdump </span><span class="ws17f">ou de</span></div><div class="t m0 x11 h5 y126 ff5 fs2 fc0 sc0 ls0 ws1b">outros<span class="_10 blank"> </span>aplicativ<span class="_9 blank"></span>os).<span class="_12 blank"> </span>A<span class="_10 blank"> </span>segunda<span class="_23 blank"> </span>ab ordagem<span class="_10 blank"> </span>p ermite<span class="_10 blank"> </span>fazer<span class="_23 blank"> </span>uma<span class="_10 blank"> </span>c´<span class="_19 blank"></span>opia<span class="_10 blank"> </span>exata<span class="_23 blank"> </span>das<span class="_10 blank"> </span>informa¸<span class="_20 blank"></span>c\u02dc<span class="_19 blank"></span>oes</div><div class="t m0 x11 h5 y127 ff5 fs2 fc0 sc0 ls0 ws180">que<span class="_24 blank"> </span>trafegam<span class="_d blank"> </span>na<span class="_24 blank"> </span>rede,<span class="_e blank"> </span>sendo<span class="_24 blank"> </span>a<span class="_24 blank"> </span>mais<span class="_24 blank"> </span>indicada<span class="_d blank"> </span>no<span class="_24 blank"> </span>caso<span class="_24 blank"> </span>de<span class="_24 blank"> </span>uma<span class="_24 blank"> </span>an´<span class="_19 blank"></span>alise<span class="_24 blank"> </span>em<span class="_24 blank"> </span>temp o<span class="_d blank"> </span>real<span class="_24 blank"> </span>n\u02dc<span class="_19 blank"></span>ao<span class="_24 blank"> </span>ser</div><div class="t m0 x11 h5 y128 ff5 fs2 fc0 sc0 ls0 ws181">necess´<span class="_19 blank"></span>aria [6].</div><div class="t m0 x14 h9 y129 ffb fs5 fc0 sc0 ls4">5<span class="ffc fs6 ls0 ws182 v2">Geralmen<span class="_9 blank"></span>te, para executar comandos de \u201cstatus\u201d sobre o <span class="ff16 ws183">cr<span class="_2 blank"></span>ash<span class="_1c blank"> </span>dump <span class="ffc ws184">´<span class="_c blank"></span>e necess´<span class="_20 blank"></span>ario o arquiv<span class="_9 blank"></span>o de imagem do</span></span></span></div><div class="t m0 x11 ha y12a ff16 fs6 fc0 sc0 ls0 ws185">kernel <span class="ffc ws186">do sistema [27].</span></div><div class="t m0 x14 h9 y12b ffb fs5 fc0 sc0 ls1a">6<span class="ffc fs6 ls0 ws187 v2">Maiores informa¸<span class="_c blank"></span>c\u02dc<span class="_20 blank"></span>oes sobre o <span class="ff15 ws188">tcpdump <span class="ffc wse8">p o dem<span class="_18 blank"> </span>ser<span class="_18 blank"> </span>encon<span class="_9 blank"></span>tradas<span class="_18 blank"> </span>na<span class="_1b blank"> </span>URL<span class="_18 blank"> </span>http://www.tcpdump.org<span class="_18 blank"> </span>(dispon<span class="_b blank"></span>´<span class="_26 blank"></span>\u0131v<span class="_9 blank"></span>el</span></span></span></div><div class="t m0 x11 ha y12c ffc fs6 fc0 sc0 ls0 ws189">em agosto de 2001).</div></div><div class="pi" data-data='{"ctm":[1.000000,0.000000,0.000000,1.000000,0.000000,0.000000]}'></div></div>
Compartilhar