Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Digital Forensics and Incident Response - Second Edition

By : Gerard Johansen

4.6 (5)

Digital Forensics and Incident Response

4.6 (5)

By: Gerard Johansen

Overview of this book

An understanding of how digital forensics integrates with the overall response to cybersecurity incidents is key to securing your organization's infrastructure from attacks. This updated second edition will help you perform cutting-edge digital forensic activities and incident response. After focusing on the fundamentals of incident response that are critical to any information security team, you’ll move on to exploring the incident response framework. From understanding its importance to creating a swift and effective response to security incidents, the book will guide you with the help of useful examples. You’ll later get up to speed with digital forensic techniques, from acquiring evidence and examining volatile memory through to hard drive examination and network-based evidence. As you progress, you’ll discover the role that threat intelligence plays in the incident response process. You’ll also learn how to prepare an incident response report that documents the findings of your analysis. Finally, in addition to various incident response activities, the book will address malware analysis, and demonstrate how you can proactively use your digital forensic skills in threat hunting. By the end of this book, you’ll have learned how to efficiently investigate and report unwanted security breaches and incidents in your organization.

Preface

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Section 1: Foundations of Incident Response and Digital Forensics

Section 1: Foundations of Incident Response and Digital Forensics

Free Chapter

Understanding Incident Response

Understanding Incident Response

The incident response process

The incident response framework

The incident response plan

The incident response playbook

Testing the incident response framework

Summary

Questions

Further reading

Managing Cyber Incidents

Managing Cyber Incidents

Engaging the incident response team

Incorporating crisis communications

Investigating incidents

Incorporating containment strategies

Getting back to normal – eradication and recovery

Summary

Questions

Further reading

Fundamentals of Digital Forensics

Fundamentals of Digital Forensics

Legal aspects

Digital forensics fundamentals

Summary

Questions

Further reading

Section 2: Evidence Acquisition

Section 2: Evidence Acquisition

Collecting Network Evidence

Collecting Network Evidence

An overview of network evidence

Firewalls and proxy logs

NetFlow

Packet captures

Wireshark

Evidence collection

Summary

Questions

Further reading

Acquiring Host-Based Evidence

Acquiring Host-Based Evidence

Preparation

Order of Volatility

Evidence acquisition

Acquiring volatile memory

Acquiring non-volatile evidence

Summary

Questions

Further reading

Forensic Imaging

Forensic Imaging

Understanding forensic imaging

Imaging tools

Preparing a stage drive

Using write blockers

Imaging techniques

Summary

Questions

Further reading

Section 3: Analyzing Evidence

Section 3: Analyzing Evidence

Analyzing Network Evidence

Analyzing Network Evidence

Network evidence overview

Analyzing firewall and proxy logs

Analyzing NetFlow

Analyzing packet captures

Summary

Questions

Further reading

Analyzing System Memory

Analyzing System Memory

Memory analysis overview

Memory analysis methodology

Memory analysis with Redline

Memory analysis with Volatility

Memory analysis with strings

Summary

Questions

Further reading

Analyzing System Storage

Analyzing System Storage

Forensic platforms

Autopsy

MFT analysis

Registry analysis

Summary

Questions

Further reading

Analyzing Log Files

Analyzing Log Files

Logging and log management

Working with event management systems

Understanding Windows logs

Analyzing Windows event logs

Summary

Questions

Further reading

Writing the Incident Report

Writing the Incident Report

Documentation overview

Incident tracking

Written reports

Summary

Questions

Further reading

Section 4: Specialist Topics

Section 4: Specialist Topics

Malware Analysis for Incident Response

Malware Analysis for Incident Response

Malware classifications

Malware analysis overview

Analyzing malware

Dynamic analysis

Summary

Questions

Further reading

Leveraging Threat Intelligence

Leveraging Threat Intelligence

Understanding threat intelligence

Threat intelligence methodology

Threat intelligence sources

Threat intelligence platforms

Using threat intelligence

Summary

Questions

Further reading

Hunting for Threats

Hunting for Threats

The threat hunting maturity model

Threat hunt cycle

MITRE ATT&CK

Threat hunt planning

Threat hunt reporting

Summary

Questions

Further reading

Assessment

Assessment

Chapter 1: Understanding Incident Response

Chapter 2: Managing Cyber Incidents

Chapter 3: Fundamentals of Digital Forensics

Chapter 4: Collecting Network Evidence

Chapter 5: Acquiring Host-Based Evidence

Chapter 6: Forensic Imaging

Chapter 7: Analyzing Network Evidence

Chapter 8: Analyzing System Memory

Chapter 9: Analyzing System Storage

Chapter 10: Analyzing Log Files

Chapter 11: Writing the Incident Report

Chapter 12: Malware Analysis for Incident Response

Chapter 13: Leveraging Threat Intelligence

Chapter 14: Hunting for Threats

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Appendix

Appendix

Customer Reviews

4.6 (5)

5 star

60%

4 star

40%

3 star

0%

2 star

0%

1 star

0%

Memory analysis overview

When discussing analyzing the memory of a system, there are two terms that are used interchangeably. The terms RAM and memory are used to describe the portion of the computer's internal systems where the operating system places data utilized by applications and the system hardware while that application or hardware is in use. What makes RAM or memory different from storage is the volatile nature of the data. Often, if the system is shut down, the data will be lost.

One change in operating systems that has had a direct impact on memory analysis is the advent of the 64-bit OS. The use of a 64-bit register allows the OS to reference a total of 17,179,869,184 GB of memory. When compared to the 32-bit OS, this is several million more times the amount of data previously available. As a result, there is a good deal of data contained within RAM at the time...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Digital Forensics and Incident Response

Search

Your notes and bookmarks