Book Image

Digital Forensics and Incident Response - Second Edition

By : Gerard Johansen
Book Image

Digital Forensics and Incident Response - Second Edition

By: Gerard Johansen

Overview of this book

An understanding of how digital forensics integrates with the overall response to cybersecurity incidents is key to securing your organization's infrastructure from attacks. This updated second edition will help you perform cutting-edge digital forensic activities and incident response. After focusing on the fundamentals of incident response that are critical to any information security team, you’ll move on to exploring the incident response framework. From understanding its importance to creating a swift and effective response to security incidents, the book will guide you with the help of useful examples. You’ll later get up to speed with digital forensic techniques, from acquiring evidence and examining volatile memory through to hard drive examination and network-based evidence. As you progress, you’ll discover the role that threat intelligence plays in the incident response process. You’ll also learn how to prepare an incident response report that documents the findings of your analysis. Finally, in addition to various incident response activities, the book will address malware analysis, and demonstrate how you can proactively use your digital forensic skills in threat hunting. By the end of this book, you’ll have learned how to efficiently investigate and report unwanted security breaches and incidents in your organization.

Related Content you might be interested in

Current Title:

Small book image
Digital Forensics and Incident Response - Second Edition
Gerard Johansen
Jan, 2020 | 448 pages
No titles found
Table of Contents (22 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
1
Section 1: Foundations of Incident Response and Digital Forensics
Section 1: Foundations of Incident Response and Digital Forensics
Free Chapter
2
Understanding Incident Response
Understanding Incident Response
The incident response process
The incident response framework
The incident response plan
The incident response playbook
Testing the incident response framework
Summary
Questions
Further reading
3
Managing Cyber Incidents
Managing Cyber Incidents
Engaging the incident response team
Incorporating crisis communications
Investigating incidents
Incorporating containment strategies
Getting back to normal – eradication and recovery
Summary
Questions
Further reading
4
Fundamentals of Digital Forensics
Fundamentals of Digital Forensics
Legal aspects
Digital forensics fundamentals
Summary
Questions
Further reading
5
Section 2: Evidence Acquisition
Section 2: Evidence Acquisition
6
Collecting Network Evidence
Collecting Network Evidence
An overview of network evidence
Firewalls and proxy logs
NetFlow
Packet captures
Wireshark
Evidence collection
Summary
Questions
Further reading
7
Acquiring Host-Based Evidence
Acquiring Host-Based Evidence
Preparation
Order of Volatility
Evidence acquisition
Acquiring volatile memory
Acquiring non-volatile evidence
Summary
Questions
Further reading
8
Forensic Imaging
Forensic Imaging
Understanding forensic imaging
Imaging tools
Preparing a stage drive
Using write blockers
Imaging techniques
Summary
Questions
Further reading
9
Section 3: Analyzing Evidence
Section 3: Analyzing Evidence
10
Analyzing Network Evidence
Analyzing Network Evidence
Network evidence overview
Analyzing firewall and proxy logs
Analyzing NetFlow
Analyzing packet captures
Summary
Questions
Further reading
11
Analyzing System Memory
Analyzing System Memory
Memory analysis overview
Memory analysis methodology
Memory analysis with Redline
Memory analysis with Volatility
Memory analysis with strings
Summary
Questions
Further reading
12
Analyzing System Storage
Analyzing System Storage
Forensic platforms
Autopsy
MFT analysis
Registry analysis
Summary
Questions
Further reading
13
Analyzing Log Files
Analyzing Log Files
Logging and log management
Working with event management systems
Understanding Windows logs
Analyzing Windows event logs
Summary
Questions
Further reading
14
Writing the Incident Report
Writing the Incident Report
Documentation overview
Incident tracking
Written reports
Summary
Questions
Further reading
15
Section 4: Specialist Topics
Section 4: Specialist Topics
16
Malware Analysis for Incident Response
Malware Analysis for Incident Response
Malware classifications
Malware analysis overview
Analyzing malware
Dynamic analysis
Summary
Questions
Further reading
17
Leveraging Threat Intelligence
Leveraging Threat Intelligence
Understanding threat intelligence
Threat intelligence methodology
Threat intelligence sources
Threat intelligence platforms
Using threat intelligence
Summary
Questions
Further reading
18
Hunting for Threats
Hunting for Threats
The threat hunting maturity model
Threat hunt cycle
MITRE ATT&CK
Threat hunt planning
Threat hunt reporting
Summary
Questions
Further reading
19
Assessment
Assessment
Chapter 1: Understanding Incident Response
Chapter 2: Managing Cyber Incidents
Chapter 3: Fundamentals of Digital Forensics
Chapter 4: Collecting Network Evidence
Chapter 5: Acquiring Host-Based Evidence
Chapter 6: Forensic Imaging
Chapter 7: Analyzing Network Evidence
Chapter 8: Analyzing System Memory
Chapter 9: Analyzing System Storage
Chapter 10: Analyzing Log Files
Chapter 11: Writing the Incident Report
Chapter 12: Malware Analysis for Incident Response
Chapter 13: Leveraging Threat Intelligence
Chapter 14: Hunting for Threats
20
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think
Appendix
Appendix

To get the most out of this book

Readers should be familiar with the Windows OS and have the ability to download and run applications as well as to use the Windows command line. Familiarity with the Linux command line is also helpful. An understanding of the basic network protocols and various types of network traffic is required as well. It's not required, but it is helpful to have access to a virtualization software platform and a Windows OS in which to run specific tools. Finally, incident response and digital forensics is a growing field. You will get the most out of this book by continuing to research and try new tools and techniques.

Download the color images

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "Once in Command Prompt, navigate to the folder containing the RawCap.exe file."

A block of code is set as follows:

meta:
 description = "Stuxnet Sample - file ~WTR4141.tmp"
 author = "Florian Roth"
 reference = "Internal Research"
 date = "2016-07-09"

Any command-line input or output is written as follows:

dfir@ubuntu:~$ tcpdump -h

Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: "Click on File and then on Capture Memory."

Warnings or important notes appear like this.
Tips and tricks appear like this.
Previous Section
Next Section