Practical Windows Forensics: Leverage the power of digital forensics for Windows systems

Leverage the power of digital forensics for Windows systemsKey FeaturesBuild your own lab environment to analyze forensic data and practice techniquesDevelop the key skills needed for performing forensic analysis on Windows-based systems using digital artifactsBecome proficient at analyzing forensic data and upgrade your existing knowledge with open source and Linux-based toolsBook DescriptionOver the past few years, the cybercrime wave has risen rapidly, with major attacks on government, military, financial, and media sectors. Tracking all these attacks and crimes requires an in-depth understanding of how operating systems work, how to extract data from digital evidence, and how to best use of digital forensic tools and techniques. This book will provide you with a detailed introduction to digital forensics, giving you the knowledge you need to assemble different types of evidence effectively, and walking you through the various stages of the analysis process.This book starts by discussing the principles of the digital forensics process, and moves on to show you the approaches used to conduct analysis. You'll then study various tools to perform live analysis, and cover different techniques to analyze volatile and nonvolatile data. After this, you'll get to grips with data recovery, along with understanding FS analysis and performing registry analysis. Toward the concluding chapters, you'll get hands-on with building a forensic analyst environment, before working through interesting exercises to help reinforce your knowledge.By the end of this book, you'll have developed the skills you need for performing forensic analysis on Windows-based systems.What you will learnPerform live analysis on victim or suspect Windows systems locally or remotelyUnderstand the different natures and acquisition techniques of volatile and nonvolatile dataCreate a timeline of all the system actions to restore the history of an incidentRecover and analyze data from the file allocation table (FAT) and new technology file system (NTFS)Make use of various tools to perform registry analysisTrack a system user's browser and e-mail activities to prove or refute hypothesesDiscover how to dump and analyze computer memoryWho this book is forThis book is for forensic analysts and professionals who want to develop skills in digital forensic analysis for the Windows platform. Prior experience of information security and forensic analysis will be useful.Table of ContentsThe Foundations and Principles of Digital ForensicsIncident Response and Live AnalysisVolatile Data CollectionNonvolatile Data AcquisitionTimelineFilesystem Analysis and Data RecoveryRegistry AnalysisEvent Log AnalysisWindows FilesBrowser and E-mail InvestigationMemory ForensicsNetwork Forensics Read more