MARC details
| 000 -LEADER |
|---|
| fixed length control field |
06448cam a2200529 i 4500 |
| 001 - CONTROL NUMBER |
|---|
| control field |
ocn874017518 |
| 003 - CONTROL NUMBER IDENTIFIER |
|---|
| control field |
GHU |
| 005 - DATE AND TIME OF LATEST TRANSACTION |
|---|
| control field |
20260526085004.0 |
| 006 - FIXED-LENGTH DATA ELEMENTS--ADDITIONAL MATERIAL CHARACTERISTICS |
|---|
| fixed length control field |
m o d |
| 007 - PHYSICAL DESCRIPTION FIXED FIELD--GENERAL INFORMATION |
|---|
| fixed length control field |
cr cnu---unuuu |
| 008 - FIXED-LENGTH DATA ELEMENTS--GENERAL INFORMATION |
|---|
| fixed length control field |
140320s2014 nyua ob 001 0 eng d |
| 020 ## - INTERNATIONAL STANDARD BOOK NUMBER |
|---|
| International Standard Book Number |
9780124171749 |
| Terms of availability |
(paperback) |
| 020 ## - INTERNATIONAL STANDARD BOOK NUMBER |
|---|
| International Standard Book Number |
0124171745 |
| 020 ## - INTERNATIONAL STANDARD BOOK NUMBER |
|---|
| Canceled/invalid ISBN |
9780124171572 |
| 020 ## - INTERNATIONAL STANDARD BOOK NUMBER |
|---|
| Canceled/invalid ISBN |
0124171575 |
| 035 ## - SYSTEM CONTROL NUMBER |
|---|
| System control number |
(OCoLC)874017518 |
| Canceled/invalid control number |
(OCoLC)880898386 |
| -- |
(OCoLC)966353441 |
| -- |
(OCoLC)993682488 |
| -- |
(OCoLC)1018193036 |
| -- |
(OCoLC)1304986380 |
| 037 ## - SOURCE OF ACQUISITION |
|---|
| Stock number |
CL0500000434 |
| Source of stock number/acquisition |
Safari Books Online |
| 040 ## - CATALOGING SOURCE |
|---|
| Original cataloging agency |
OPELS |
| Language of cataloging |
english |
| Description conventions |
rda |
| -- |
pn |
| Transcribing agency |
OPELS |
| Modifying agency |
E7B |
| -- |
UMI |
| -- |
OCLCO |
| -- |
DEBBG |
| -- |
DEBSZ |
| -- |
YDXCP |
| -- |
VLB |
| -- |
RIV |
| -- |
COO |
| -- |
OCLCQ |
| -- |
YDX |
| -- |
LIV |
| -- |
OCLCQ |
| -- |
OCLCO |
| -- |
OCLCA |
| -- |
OCLCQ |
| -- |
OCLCF |
| -- |
VVB |
| -- |
U3W |
| -- |
D6H |
| -- |
CEF |
| -- |
INT |
| -- |
OTZ |
| -- |
OCLCA |
| -- |
OCLCQ |
| -- |
AUD |
| -- |
AU@ |
| -- |
OCLCQ |
| -- |
OCLCO |
| -- |
OCLCQ |
| 049 ## - LOCAL HOLDINGS (OCLC) |
|---|
| Holding library |
MAIN |
| 050 #4 - LIBRARY OF CONGRESS CALL NUMBER |
|---|
| Classification number |
HV8079.C65 CAR |
| Item number |
C3726 2014eb |
| 082 04 - DEWEY DECIMAL CLASSIFICATION NUMBER |
|---|
| Classification number |
363.25968 |
| Edition information |
23 |
| 100 1# - MAIN ENTRY--PERSONAL NAME |
|---|
| Personal name |
Carvey, Harlan A., |
| Relator term |
author. |
| 245 10 - TITLE STATEMENT |
|---|
| Title |
Windows forensic analysis toolkit : |
| Remainder of title |
advanced analysis techniques for Windows 8 / |
| Statement of responsibility, etc. |
Harlan Carvey. |
| 250 ## - EDITION STATEMENT |
|---|
| Edition statement |
Fourth edition. |
| 264 #1 - PRODUCTION, PUBLICATION, DISTRIBUTION, MANUFACTURE, AND COPYRIGHT NOTICE |
|---|
| Place of production, publication, distribution, manufacture |
Rockland : |
| Name of producer, publisher, distributor, manufacturer |
Syngress, |
| Date of production, publication, distribution, manufacture, or copyright notice |
2014. |
| 300 ## - PHYSICAL DESCRIPTION |
|---|
| Extent |
1 online resource. |
| 336 ## - CONTENT TYPE |
|---|
| Content type term |
text |
| Content type code |
txt |
| Source |
rdacontent. |
| 337 ## - MEDIA TYPE |
|---|
| Media type term |
computer |
| Media type code |
c |
| Source |
rdamedia. |
| 338 ## - CARRIER TYPE |
|---|
| Carrier type term |
online resource |
| Carrier type code |
cr |
| Source |
rdacarrier. |
| 504 ## - BIBLIOGRAPHY, ETC. NOTE |
|---|
| Bibliography, etc. note |
Includes bibliographical references and index. |
| 505 0# - FORMATTED CONTENTS NOTE |
|---|
| Formatted contents note |
Front Cover; Windows Forensic Analysis Toolkit; Copyright Page; Contents; Preface; Intended Audience; Organization of This Book; DVD Contents; Acknowledgments; About the Author; About the Technical Editor; 1 Analysis Concepts; Introduction; Analysis concepts; Windows versions; Analysis principles; Goals; Tools versus processes; The tool validation myth-odology; Locard's exchange principle; Avoiding speculation; Direct and indirect artifacts; Least frequency of occurrence; Documentation; Convergence; Virtualization; Setting up an analysis system; Summary; 2 Incident Preparation; Introduction. |
| 505 8# - FORMATTED CONTENTS NOTE |
|---|
| Formatted contents note |
Being prepared to respondQuestions; The importance of preparation; Logs; Data collection; Training; Business models; Summary; 3 Volume Shadow Copies; Introduction; What are "volume shadow copies"?; Registry keys; Live systems; ProDiscover; F-Response; Acquired images; VHD method; VMWare method; Automating VSC access; ProDiscover; Windows 8; Summary; Reference; 4 File Analysis; Introduction; MFT; File system tunneling; TriForce; Event logs; Windows Event Log; Recycle bin; Prefetch files; Scheduled tasks; Jump lists; Hibernation files; Application files; Antivirus logs; Skype; Apple products. |
| 505 8# - FORMATTED CONTENTS NOTE |
|---|
| Formatted contents note |
Image filesSummary; References; 5 Registry Analysis; Introduction; Registry analysis; Registry nomenclature; The registry as a log file; USB device analysis; System hive; Services; Bluetooth; Software hive; Application analysis; NetworkList; NetworkCards; Scheduled tasks; User hives; WordWheelQuery; Shellbags; MenuOrder; MUICache; UserAssist; Photos; Virtual PC; TypedPaths; Additional sources; RegIdleBackup; Volume shadow copies; Virtualization; Memory; Tools; Summary; References; 6 Malware Detection; Introduction; Malware Characteristics; Initial infection vector; Propagation mechanism. |
| 505 8# - FORMATTED CONTENTS NOTE |
|---|
| Formatted contents note |
Persistence mechanismArtifacts; Detecting Malware; Log analysis; Dr. Watson logs; AV scans; AV write ups; Digging deeper; Packed files; Digital signatures; Windows File Protection; Alternate data streams; PE file compile times; Master boot record infectors; Registry analysis; Internet activity; Additional detection mechanisms; Seeded sites; Summary; References; 7 Timeline Analysis; Introduction; Timelines; Data sources; Time formats; Concepts; Benefits; Format; Time; Source; System; User; Description; TLN format; Creating Timelines; File system metadata; Event logs; Windows XP; Windows 7. |
| 505 8# - FORMATTED CONTENTS NOTE |
|---|
| Formatted contents note |
Prefetch filesRegistry data; Additional sources; Parsing events into a timeline; Thoughts on visualization; Case Study; Summary; 8 Correlating Artifacts; Introduction; How-Tos; Correlating Windows shortcuts to USB devices; Demonstrate user access to files; IE browser analysis; Detecting system time change; Who ran defrag?; Determine data exfiltration; Finding something "new"; Summary; 9 Reporting; Introduction; Goals; Incident triage; Case Notes; Documenting your analysis; Reporting; Format; Executive summary; Body; Background; Analysis; Conclusions; Writing tips; Peer review; Summary; Index. |
| 520 ## - SUMMARY, ETC. |
|---|
| Summary, etc. |
Harlan Carvey has updated Windows Forensic Analysis Toolkit, now in its fourth edition, to cover Windows 8 systems. The primary focus of this edition is on analyzing Windows 8 systems and processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. Harlan Carvey presents real-life experiences from the trenches, making the material realistic and showing the why behind the how. The companion and toolkit materials are hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, Second Edition, which focuses primarily on XP, and Windows Forensic Analysis Toolkit, Third Edition, which focuses primarily on Windows 7. This new fourth edition provides expanded coverage of many topics beyond Windows 8 as well, including new cradle-to-grave case examples, USB device analysis, hacking and intrusion cases, and "how would I do this" from Harlan's personal case files and questions he has received from readers. The fourth edition also includes an all-new chapter on reporting. Complete coverage and examples of Windows 8 systems Contains lessons from the field, case studies, and war stories Companion online toolkit material, including electronic printable checklists, cheat sheets, custom tools, and walk-throughs. |
| 588 0# - SOURCE OF DESCRIPTION NOTE |
|---|
| Source of description note |
Print version record. |
| 630 00 - SUBJECT ADDED ENTRY--UNIFORM TITLE |
|---|
| Uniform title |
Microsoft Windows (Computer file) |
| 650 #0 - SUBJECT ADDED ENTRY--TOPICAL TERM |
|---|
| Topical term or geographic name entry element |
Computer crimes |
| General subdivision |
Investigation |
| -- |
Methodology. |
| 650 #0 - SUBJECT ADDED ENTRY--TOPICAL TERM |
|---|
| Topical term or geographic name entry element |
Computer networks |
| General subdivision |
Security measures. |
| Authority record control number or standard number |
http://id.loc.gov/authorities/subjects/sh94001277. |
| 650 #0 - SUBJECT ADDED ENTRY--TOPICAL TERM |
|---|
| Topical term or geographic name entry element |
Internet |
| General subdivision |
Security measures. |
| 650 #0 - SUBJECT ADDED ENTRY--TOPICAL TERM |
|---|
| Topical term or geographic name entry element |
Computer security. |
| 776 08 - ADDITIONAL PHYSICAL FORM ENTRY |
|---|
| Relationship information |
Print version: |
| Main entry heading |
Carvey, Harlan A. |
| Title |
Windows forensic analysis toolkit. |
| Edition |
Fourth edition |
| International Standard Book Number |
9780124171572 |
| Record control number |
(OCoLC)872701493. |
| 856 40 - ELECTRONIC LOCATION AND ACCESS |
|---|
| Uniform Resource Identifier |
<a href="https://go.oreilly.com/queen-mary-university-of-london/library/view/-/9780124171572/?ar">https://go.oreilly.com/queen-mary-university-of-london/library/view/-/9780124171572/?ar</a> |
| 901 ## - LOCAL DATA ELEMENT A, LDA (RLIN) |
|---|
| a |
exclude |
| 942 ## - ADDED ENTRY ELEMENTS (KOHA) |
|---|
| Source of classification or shelving scheme |
Dewey Decimal Classification |
| Koha item type |
Books |
| Suppress in OPAC |
No |
