Book Image

Digital Forensics and Incident Response

By : Gerard Johansen
Book Image

Digital Forensics and Incident Response

By: Gerard Johansen

Overview of this book

Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom. By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.
Table of Contents (18 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface

Malware overview


Malicious software or malware is an all-encompassing term for any software that has been created to damage, disable or produce an unwanted condition within a computer system. This definition, while functional is also very broad in its categorization of malware. There is malware that is coded specifically to steal credit card numbers from payment systems while other malware is utilized to take control of a system allowing an attacker to remotely control that system. Analysts who observe these specific behaviours, such as how a compromised system sends communications out to the internet after infection, or what actions are taken on an infected system, may be able to determine what type the malware is, and what the end goal of the attacker may be.

In general, when discussing malware, the following are some of the more specific categories:

  • Virus: For a time, the term virus was used as the term for any malicious code that had a determinantal impact on a computer system. As the...