Book Overview & Buying
Table Of Contents

Digital Forensics and Incident Response

By : Gerard Johansen

4.3 (6)

Buy this Book

Digital Forensics and Incident Response

4.3 (6)

By: Gerard Johansen

Buy this Book

Overview of this book

Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom. By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

Incident Response

The incident response process

The incident response framework

The incident response plan

The incident response playbook

Summary

Forensic Fundamentals

Legal aspects

Digital forensic fundamentals

Summary

Network Evidence Collection

Preparation

Network device evidence

Packet capture

Evidence collection

Summary

Acquiring Host-Based Evidence

Preparation

Evidence volatility

Evidence acquisition

Evidence collection procedures

Non-volatile data

Summary

Understanding Forensic Imaging

Overview of forensic imaging

Preparing a stage drive

Imaging

Summary

Network Evidence Analysis

Analyzing packet captures

Analyzing network log files

Summary

Analyzing System Memory

Memory evidence overview

Memory analysis

Summary

Analyzing System Storage

Forensic platforms

Summary

Forensic Reporting

Documentation overview

Incident tracking

Written reports

Summary

Malware Analysis

Malware overview

Malware analysis overview

Analyzing malware

Dynamic analysis

Summary

Threat Intelligence

Threat intelligence overview

Threat intelligence methodology

Threat intelligence direction

Threat intelligence sources

Threat intelligence platforms

Using threat intelligence

Summary

Forensic Fundamentals

Forensic science can be defined as the application of scientific principles to legal matters. In an incident, CSIRT members may be called upon to perform analysis on digital evidence acquired during the incident, utilizing digital forensics tools, techniques, and knowledge. To make certain that the evidence is processed correctly and can subsequently be admitted into a courtroom, digital forensic examiners need to understand the legal issues along with the fine points of the digital forensic process.

In this chapter, we will examine the legal statutes that impact the CSIRT and digital forensics examiners as well as the rules that govern how evidence is admitted into court. To give context to actions taken, we will also explore the digital forensic process and finally address the infrastructure necessary to incorporate a digital forensics capability within...