One critical task that incident response analysts will often have to perform is imaging of digital evidence. As was previously discussed in prior chapters, a great deal of evidence related to an incident can be found within log files, memory, and other areas that can be acquired relatively quickly. In some incidents, such as internal malicious activity such as fraud, industrial espionage, or data leakage, may require a more detailed search for evidence. This evidence includes the Master File Table entries, files, and specific user data that are contained on the hard drive of a suspect system. In the event that incident response analysts encounter such circumstances, they will be required to obtain an image of a suspect drive. As with any aspect of digital forensics, obtaining a usable and court- defensible image relies on the appropriate tools, techniques...
-
Book Overview & Buying
-
Table Of Contents
Digital Forensics and Incident Response
By :
Digital Forensics and Incident Response
By:
Overview of this book
Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom.
By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.
Table of Contents (12 chapters)
Preface
Free Chapter
Incident Response
Forensic Fundamentals
Network Evidence Collection
Acquiring Host-Based Evidence
Understanding Forensic Imaging
Network Evidence Analysis
Analyzing System Memory
Analyzing System Storage
Forensic Reporting
Malware Analysis
