Real Digital Forensics: Computer Security and Incident Response
內容描述
Table of Contents:
Preface.
Acknowledgments.
About the
Authors.
Case
Studies.
I. LIVE
INCIDENT RESPONSE.
1. Windows
Live Response.
2. Unix
Live Response.
II.
NETWORK-BASED FORENSICS.
3.
Collecting Network-Based Evidence.
4.
Analyzing Network-Based Evidence for a Windows Intrusion.
5.
Analyzing Network-Based Evidence for a Unix Intrusion.
III.
ACQUIRING A FORENSIC DUPLICATION.
6. Before
You Jump Right In…
7.
Commercial-Based Forensic Duplications.
8.
Noncommercial-Based Forensic Duplications.
IV. FORENSIC
ANALYSIS TECHNIQUES.
9. Common
Forensic Analysis Techniques.
- Web Browsing
Activity Reconstruction. - E-Mail
Activity Reconstruction. - Microsoft
Windows Registry Reconstruction. - Forensic
Tool Analysis: An Introduction to Using Linux for Analyzing Files of Unknown
Origin. - Forensic
Tool Analysis: A Hands-On Analysis of the Linux File aio. - Forensic
Tool Analysis: Analyzing Files of Unknown Origin (Windows).
V. CREATING A
COMPLETE FORENSIC TOOL KIT. - Building the
Ultimate Response CD. - Making Your
CD-ROM a Bootable Environment.
VI.
MOBILE DEVICE FORENSICS. - Forensic
Duplication and Analysis of Personal Digital Assistants. - Forensic
Duplication of USB and Compact Flash Memory Devices. - Forensic
Analysis of USB and Compact Flash Memory Devices.
VII.
ONELINE-BASED FORENSCIS. - Tracing
E-Mail. - Domain Name
Ownership.
Appendix: An
Introduction to Perl.
Index.