Practical Windows Forensics: Leverage the power of digital forensics for Windows systems

ISBN: 1783554096

Author: Mansour, Ayman Shaaban a

Condition: New

Leverage the power of digital forensics for Windows systems Key Features Build your own lab environment to analyze forensic data and practice techniques Develop the key skills needed for performing forensic analysis on Windows-based systems using digital artifacts Become proficient at analyzing forensic data and upgrade your existing knowledge with open source and Linux-based tools Book DescriptionOver the past few years, the cybercrime wave has risen rapidly, with major attacks on government, military, financial, and media sectors. Tracking all these attacks and crimes requires an in-depth understanding of how operating systems work, how to extract data from digital evidence, and how to best use of digital forensic tools and techniques. This book will provide you with a detailed introduction to digital forensics, giving you the knowledge you need to assemble different types of evidence effectively, and walking you through the various stages of the analysis process.This book starts by discussing the principles of the digital forensics process, and moves on to show you the approaches used to conduct analysis. You'll then study various tools to perform live analysis, and cover different techniques to analyze volatile and nonvolatile data. After this, you'll get to grips with data recovery, along with understanding FS analysis and performing registry analysis. Toward the concluding chapters, you'll get hands-on with building a forensic analyst environment, before working through interesting exercises to help reinforce your knowledge.By the end of this book, you'll have developed the skills you need for performing forensic analysis on Windows-based systems. What you will learn Perform live analysis on victim or suspect Windows systems locally or remotely Understand the different natures and acquisition techniques of volatile and nonvolatile data Create a timeline of all the system actions to restore the history of an incident Recover and analyze data from the file allocation table (FAT) and new technology file system (NTFS) Make use of various tools to perform registry analysis Track a system user's browser and e-mail activities to prove or refute hypotheses Discover how to dump and analyze computer memory Who this book is forThis book is for forensic analysts and professionals who want to develop skills in digital forensic analysis for the Windows platform. Prior experience of information security and forensic analysis will be useful. Table of Contents The Foundations and Principles of Digital Forensics Incident Response and Live Analysis Volatile Data Collection Nonvolatile Data Acquisition Timeline Filesystem Analysis and Data Recovery Registry Analysis Event Log Analysis Windows Files Browser and E-mail Investigation Memory Forensics Network Forensics