Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Digital Forensics and Incident Response - Second Edition

By : Gerard Johansen

4.6 (5)

Digital Forensics and Incident Response

4.6 (5)

By: Gerard Johansen

Overview of this book

An understanding of how digital forensics integrates with the overall response to cybersecurity incidents is key to securing your organization's infrastructure from attacks. This updated second edition will help you perform cutting-edge digital forensic activities and incident response. After focusing on the fundamentals of incident response that are critical to any information security team, you’ll move on to exploring the incident response framework. From understanding its importance to creating a swift and effective response to security incidents, the book will guide you with the help of useful examples. You’ll later get up to speed with digital forensic techniques, from acquiring evidence and examining volatile memory through to hard drive examination and network-based evidence. As you progress, you’ll discover the role that threat intelligence plays in the incident response process. You’ll also learn how to prepare an incident response report that documents the findings of your analysis. Finally, in addition to various incident response activities, the book will address malware analysis, and demonstrate how you can proactively use your digital forensic skills in threat hunting. By the end of this book, you’ll have learned how to efficiently investigate and report unwanted security breaches and incidents in your organization.

Preface

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Section 1: Foundations of Incident Response and Digital Forensics

Section 1: Foundations of Incident Response and Digital Forensics

Free Chapter

Understanding Incident Response

Understanding Incident Response

The incident response process

The incident response framework

The incident response plan

The incident response playbook

Testing the incident response framework

Summary

Questions

Further reading

Managing Cyber Incidents

Managing Cyber Incidents

Engaging the incident response team

Incorporating crisis communications

Investigating incidents

Incorporating containment strategies

Getting back to normal – eradication and recovery

Summary

Questions

Further reading

Fundamentals of Digital Forensics

Fundamentals of Digital Forensics

Legal aspects

Digital forensics fundamentals

Summary

Questions

Further reading

Section 2: Evidence Acquisition

Section 2: Evidence Acquisition

Collecting Network Evidence

Collecting Network Evidence

An overview of network evidence

Firewalls and proxy logs

NetFlow

Packet captures

Wireshark

Evidence collection

Summary

Questions

Further reading

Acquiring Host-Based Evidence

Acquiring Host-Based Evidence

Preparation

Order of Volatility

Evidence acquisition

Acquiring volatile memory

Acquiring non-volatile evidence

Summary

Questions

Further reading

Forensic Imaging

Forensic Imaging

Understanding forensic imaging

Imaging tools

Preparing a stage drive

Using write blockers

Imaging techniques

Summary

Questions

Further reading

Section 3: Analyzing Evidence

Section 3: Analyzing Evidence

Analyzing Network Evidence

Analyzing Network Evidence

Network evidence overview

Analyzing firewall and proxy logs

Analyzing NetFlow

Analyzing packet captures

Summary

Questions

Further reading

Analyzing System Memory

Analyzing System Memory

Memory analysis overview

Memory analysis methodology

Memory analysis with Redline

Memory analysis with Volatility

Memory analysis with strings

Summary

Questions

Further reading

Analyzing System Storage

Analyzing System Storage

Forensic platforms

Autopsy

MFT analysis

Registry analysis

Summary

Questions

Further reading

Analyzing Log Files

Analyzing Log Files

Logging and log management

Working with event management systems

Understanding Windows logs

Analyzing Windows event logs

Summary

Questions

Further reading

Writing the Incident Report

Writing the Incident Report

Documentation overview

Incident tracking

Written reports

Summary

Questions

Further reading

Section 4: Specialist Topics

Section 4: Specialist Topics

Malware Analysis for Incident Response

Malware Analysis for Incident Response

Malware classifications

Malware analysis overview

Analyzing malware

Dynamic analysis

Summary

Questions

Further reading

Leveraging Threat Intelligence

Leveraging Threat Intelligence

Understanding threat intelligence

Threat intelligence methodology

Threat intelligence sources

Threat intelligence platforms

Using threat intelligence

Summary

Questions

Further reading

Hunting for Threats

Hunting for Threats

The threat hunting maturity model

Threat hunt cycle

MITRE ATT&CK

Threat hunt planning

Threat hunt reporting

Summary

Questions

Further reading

Assessment

Assessment

Chapter 1: Understanding Incident Response

Chapter 2: Managing Cyber Incidents

Chapter 3: Fundamentals of Digital Forensics

Chapter 4: Collecting Network Evidence

Chapter 5: Acquiring Host-Based Evidence

Chapter 6: Forensic Imaging

Chapter 7: Analyzing Network Evidence

Chapter 8: Analyzing System Memory

Chapter 9: Analyzing System Storage

Chapter 10: Analyzing Log Files

Chapter 11: Writing the Incident Report

Chapter 12: Malware Analysis for Incident Response

Chapter 13: Leveraging Threat Intelligence

Chapter 14: Hunting for Threats

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Appendix

Appendix

Imaging tools

While there is no court or legal body that certifies digital forensics imaging tools, there are several methods and associated tools that represent best practices when acquiring disk evidence. Let's go over these now:

FTK Imager: FTK Imager is provided as a free software application by Access Data. This GUI-based application allows for the forensically sound acquisition of logical and physical volumes, memory, and other protected files and outputs those images in a variety of formats. In addition, FTK Imager Lite is a self-contained application that can be run on removable media for the acquisition of digital evidence from running systems (this will be covered in detail later in this chapter).
EnCase Imager: Provided by Guidance Software, EnCase Imager is another forensic application that allows responders to acquire digital evidence from a variety of systems...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Digital Forensics and Incident Response

Search

Your notes and bookmarks