Practical Windows Forensics

Over the last few years, the wave of the cybercrime has risen rapidly. We witnessed many major attacks on the governmental, military, financial, and media sectors. Tracking all these attacks and crimes requires a deep understanding of operating system operations, how to extract evidential data from digital evidence, and the best usage of the digital forensic tools and techniques. Here's where Linux comes in. There's a special Linux emulation environment in Windows that allows us be come on par with and experience Linux-like features. Regardless of your level of experience in the field of information security in general, Linux for Digital Forensics will fully introduce you to digital forensics. It will provide you with the knowledge needed to assemble different types of evidence properly, and walk you through various stages of the analysis process. We start by discussing the principles of the digital forensics process and move on to learning about the approaches that are used to conduct analysis. We will then study various tools to perform live analysis, and go through different techniques to analyze volatile and non-volatile data. This will be followed by recovering data from hard drives and grasping how to use multiple tools to perform registry and system log analyses. Next, you will be taught to analyze browsers and e-mails as they are crucial aspects of investigations. We will then go on to extract data from a computer's memory and investigate network traffic, which is another important checkpoint. Lastly, you will learn a few ways in which you can present data because every investigator needs a work station where they can analyze forensic data.

Cover; Copyright; Credits; About the Authors; About the Reviewers; www.PacktPub.com; Table of Contents; Preface; Chapter 1: The Foundations and Principles of Digital Forensics; What is digital crime?; Digital forensics; Digital evidence; Digital forensic goals; Analysis approaches; Summary; Chapter 2: Incident Response and Live Analysis; Personal skills; Written communication; Oral communication; Presentation skills; Diplomacy; The ability to follow policies and procedures; Team skills; Integrity; Knowing one's limits; Coping with stress; Problem solving; Time management; Technical skills.

Security fundamentalsSecurity principles; Security vulnerabilities and weaknesses; The Internet; Risks; Network protocols; Network applications and services; Network security issues; Host or system security issues; Malicious code; Programming skills; Incident handling skills; The hardware for IR and Jump Bag; Software; Live versus mortem; Volatile data; Nonvolatile data; Registry data; Remote live response; Summary; Chapter 3: Volatile Data Collection; Memory acquisition; Issues related to memory access; Choosing a tool; DumpIt; FTK Imager; Acquiring memory from a remote computer using iSCSI.

…