000 06448cam a2200529 i 4500
001 ocn874017518
003 GHU
005 20260526085004.0
006 m o d
007 cr cnu---unuuu
008 140320s2014 nyua ob 001 0 eng d
020 _a9780124171749
_c(paperback)
020 _a0124171745
020 _z9780124171572
020 _z0124171575
035 _a(OCoLC)874017518
_z(OCoLC)880898386
_z(OCoLC)966353441
_z(OCoLC)993682488
_z(OCoLC)1018193036
_z(OCoLC)1304986380
037 _aCL0500000434
_bSafari Books Online
040 _aOPELS
_benglish
_erda
_epn
_cOPELS
_dE7B
_dUMI
_dOCLCO
_dDEBBG
_dDEBSZ
_dYDXCP
_dVLB
_dRIV
_dCOO
_dOCLCQ
_dYDX
_dLIV
_dOCLCQ
_dOCLCO
_dOCLCA
_dOCLCQ
_dOCLCF
_dVVB
_dU3W
_dD6H
_dCEF
_dINT
_dOTZ
_dOCLCA
_dOCLCQ
_dAUD
_dAU@
_dOCLCQ
_dOCLCO
_dOCLCQ
049 _aMAIN
050 4 _aHV8079.C65 CAR
_bC3726 2014eb
082 0 4 _a363.25968
_223
100 1 _aCarvey, Harlan A.,
_eauthor.
245 1 0 _aWindows forensic analysis toolkit :
_badvanced analysis techniques for Windows 8 /
_cHarlan Carvey.
250 _aFourth edition.
264 1 _aRockland :
_bSyngress,
_c2014.
300 _a1 online resource.
336 _atext
_btxt
_2rdacontent.
337 _acomputer
_bc
_2rdamedia.
338 _aonline resource
_bcr
_2rdacarrier.
504 _aIncludes bibliographical references and index.
505 0 _aFront Cover; Windows Forensic Analysis Toolkit; Copyright Page; Contents; Preface; Intended Audience; Organization of This Book; DVD Contents; Acknowledgments; About the Author; About the Technical Editor; 1 Analysis Concepts; Introduction; Analysis concepts; Windows versions; Analysis principles; Goals; Tools versus processes; The tool validation myth-odology; Locard's exchange principle; Avoiding speculation; Direct and indirect artifacts; Least frequency of occurrence; Documentation; Convergence; Virtualization; Setting up an analysis system; Summary; 2 Incident Preparation; Introduction.
505 8 _aBeing prepared to respondQuestions; The importance of preparation; Logs; Data collection; Training; Business models; Summary; 3 Volume Shadow Copies; Introduction; What are "volume shadow copies"?; Registry keys; Live systems; ProDiscover; F-Response; Acquired images; VHD method; VMWare method; Automating VSC access; ProDiscover; Windows 8; Summary; Reference; 4 File Analysis; Introduction; MFT; File system tunneling; TriForce; Event logs; Windows Event Log; Recycle bin; Prefetch files; Scheduled tasks; Jump lists; Hibernation files; Application files; Antivirus logs; Skype; Apple products.
505 8 _aImage filesSummary; References; 5 Registry Analysis; Introduction; Registry analysis; Registry nomenclature; The registry as a log file; USB device analysis; System hive; Services; Bluetooth; Software hive; Application analysis; NetworkList; NetworkCards; Scheduled tasks; User hives; WordWheelQuery; Shellbags; MenuOrder; MUICache; UserAssist; Photos; Virtual PC; TypedPaths; Additional sources; RegIdleBackup; Volume shadow copies; Virtualization; Memory; Tools; Summary; References; 6 Malware Detection; Introduction; Malware Characteristics; Initial infection vector; Propagation mechanism.
505 8 _aPersistence mechanismArtifacts; Detecting Malware; Log analysis; Dr. Watson logs; AV scans; AV write ups; Digging deeper; Packed files; Digital signatures; Windows File Protection; Alternate data streams; PE file compile times; Master boot record infectors; Registry analysis; Internet activity; Additional detection mechanisms; Seeded sites; Summary; References; 7 Timeline Analysis; Introduction; Timelines; Data sources; Time formats; Concepts; Benefits; Format; Time; Source; System; User; Description; TLN format; Creating Timelines; File system metadata; Event logs; Windows XP; Windows 7.
505 8 _aPrefetch filesRegistry data; Additional sources; Parsing events into a timeline; Thoughts on visualization; Case Study; Summary; 8 Correlating Artifacts; Introduction; How-Tos; Correlating Windows shortcuts to USB devices; Demonstrate user access to files; IE browser analysis; Detecting system time change; Who ran defrag?; Determine data exfiltration; Finding something "new"; Summary; 9 Reporting; Introduction; Goals; Incident triage; Case Notes; Documenting your analysis; Reporting; Format; Executive summary; Body; Background; Analysis; Conclusions; Writing tips; Peer review; Summary; Index.
520 _aHarlan Carvey has updated Windows Forensic Analysis Toolkit, now in its fourth edition, to cover Windows 8 systems. The primary focus of this edition is on analyzing Windows 8 systems and processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. Harlan Carvey presents real-life experiences from the trenches, making the material realistic and showing the why behind the how. The companion and toolkit materials are hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, Second Edition, which focuses primarily on XP, and Windows Forensic Analysis Toolkit, Third Edition, which focuses primarily on Windows 7. This new fourth edition provides expanded coverage of many topics beyond Windows 8 as well, including new cradle-to-grave case examples, USB device analysis, hacking and intrusion cases, and "how would I do this" from Harlan's personal case files and questions he has received from readers. The fourth edition also includes an all-new chapter on reporting. Complete coverage and examples of Windows 8 systems Contains lessons from the field, case studies, and war stories Companion online toolkit material, including electronic printable checklists, cheat sheets, custom tools, and walk-throughs.
588 0 _aPrint version record.
630 0 0 _aMicrosoft Windows (Computer file)
650 0 _aComputer crimes
_xInvestigation
_xMethodology.
650 0 _aComputer networks
_xSecurity measures.
_0http://id.loc.gov/authorities/subjects/sh94001277.
650 0 _aInternet
_xSecurity measures.
650 0 _aComputer security.
776 0 8 _iPrint version:
_aCarvey, Harlan A.
_tWindows forensic analysis toolkit.
_bFourth edition
_z9780124171572
_w(OCoLC)872701493.
856 4 0 _uhttps://go.oreilly.com/queen-mary-university-of-london/library/view/-/9780124171572/?ar
901 _aexclude
942 _2ddc
_cBOOK
_n0
999 _c291
_d291