In many ways, this chapter just scratches the surface of what information can be found by leveraging disk forensic tools. Specific tools and techniques are largely dependent on the tool utilized. What is important to understand is that modern operating systems leave traces of their activity all over the disk, from file change evidence in the Master File Table to registry key settings when new user accounts are added.Incident response analysts should have expertise in understanding how modern operating systems store data and how to leverage commercial or freeware tools to find this data. Taken in concert with other pieces of evidence obtained from network sources and in memory, disk evidence may provide more clarity on an incident and aid in determining its root cause. One critical piece that is addressed in the next chapter is how analysts need to record and report their findings. The previous chapters have discussed a good deal of technical work that unless it is documented will...
Digital Forensics and Incident Response
By :
Digital Forensics and Incident Response
By:
Overview of this book
Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom.
By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.
Related Content you might be interested in
Current Title:
Digital Forensics and Incident Response
No titles found
Table of Contents (18 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface
Free Chapter
Incident Response
Forensic Fundamentals
Network Evidence Collection
Acquiring Host-Based Evidence
Understanding Forensic Imaging
Network Evidence Analysis
Analyzing System Memory
Analyzing System Storage
Forensic Reporting
Malware Analysis
Customer Reviews