Windows forensics : the field guide for conducting corporate computer investigations / Chad Steel.
By: Steel, Chad
.
Material type: 
BookPublisher: Indianapolis, IN : Wiley Pub., 2006Description: xvii, 382 p. : ill. ; 24 cm. + pbk.ISBN: 0470038624; 9780470038628.Subject(s): Microsoft Windows (Computer file) -- Security measures | Computer crimes -- Investigation -- United States -- Methodology | Computer networks -- Security measures | Internet -- Security measures | Computer securityDDC classification: 363.25968 | Item type | Current library | Call number | Copy number | Status | Barcode | |
|---|---|---|---|---|---|---|
| General lending | MTU Bishopstown Library Lending | 363.25968 (Browse shelf(Opens below)) | 1 | Available | 00114472 |
Enhanced descriptions from Syndetics:
The evidence is in--to solve Windows crime, you need Windows tools
An arcane pursuit a decade ago, forensic science today is a household term. And while the computer forensic analyst may not lead as exciting a life as TV′s CSIs do, he or she relies just as heavily on scientific principles and just as surely solves crime.
Whether you are contemplating a career in this growing field or are already an analyst in a Unix/Linux environment, this book prepares you to combat computer crime in the Windows world. Here are the tools to help you recover sabotaged files, track down the source of threatening e-mails, investigate industrial espionage, and expose computer criminals.
∗ Identify evidence of fraud, electronic theft, and employee Internet abuse
∗ Investigate crime related to instant messaging, Lotus Notes(r), and increasingly popular browsers such as Firefox(r)
∗ Learn what it takes to become a computer forensics analyst
∗ Take advantage of sample forms and layouts as well as case studies
∗ Protect the integrity of evidence
∗ Compile a forensic response toolkit
∗ Assess and analyze damage from computer crime and process the crime scene
∗ Develop a structure for effectively conducting investigations
∗ Discover how to locate evidence in the Windows Registry
Includes bibliographical references and index.
Windows forensics -- Processing the digital crime scene -- Windows forensics basics -- Partitions and file systems -- Directory structure and special files -- The registry -- Forensic analysis -- Live system analysis -- Forensic duplication -- File system analysis -- Log file analysis -- Internet usage analysis -- Email investigations.
Table of contents provided by Syndetics
- Chapter 1 Windows Forensics
- The Corporate Computer Forensic Analyst
- Windows Forensics
- People, Processes, and Tools
- Computer Forensics: Today and Tomorrow
- Additional Resources
- Chapter 2 Processing the Digital Crime Scene
- Identify the Scene
- Perform Remote Research
- Secure the Crime Scene
- Document the Scene
- Process the Scene for Physical Evidence
- Process the Scene for Electronic Evidence
- Chain of Custody
- Best Evidence
- Working with Law Enforcement
- Additional Resources
- Chapter 3 Windows Forensic Basics
- History and Versions
- MS-DOS. Windows 1.x, 2.x, and 3.x
- Windows NT and 2000 Windows 95, 98, and ME
- Windows XP and 2003
- Floppy Disks
- Tapes
- CDs and DVDs
- USB Flash Drives
- Hard Disks
- Additional Resources
- Chapter 4 Partitions and File Systems
- Master Boot Record
- Windows File Systems
- FAT
- VFAT
- NTFS
- Compression
- Encryption
- Additional Resources
- Chapter 5 Directory Structure and Special Files
- Windows NT/2000/XP. Directories
- Files
- Windows 9x
- Directories
- Files
- Additional Resources
- Chapter 6 The Registry
- History
- Registry Basics
- Registry Analysis
- General
- Folder Locations
- Startup Items
- Intelliforms
- Advanced Registry Analysis
- Additional Resources
- Chapter 7 Forensic Analysis
- Chapter 8 Live System Analysis
- Covert Analysis
- System State Analysis
- System Tools
- Storage
- Services and Applications
- Remote Enumeration
- Monitoring
- Keystroke Recording
- Network Monitoring
- Overt Analysis
- GUI-based Overt Analysis
- Local Command Line Analysis
- Remote Command Line Analysis
- Basic Information Gathering
- System State Information
- Running Program Information
- Main Memory Analysis
- Additional Resources
- Chapter 9 Forensic Duplication
- Hard Disk Duplication
- In-Situ Duplication
- Direct Duplication
- Magnetic Tape
- Hard Disks
- Optical Disks
- Multi-tiered Storage
- Log File Duplication
- Additional Resources
- Chapter 10 File System Analysis
- Searching
- Index-based Searching
- Bitwise Searching
- Search Methodology
- Hash Analysis
- Positive Hash Analysis
- Negative Hash Analysis
- File Recovery
- Special Files
- Print Spool Files
- Windows Shortcuts
- Paging File
- Additional Resources
- Chapter 11 Log File Analysis
- Event Logs
- Application Log
- System Log
- Security Log
- Successful Log-on/Log-off Events
- Failed Log-on Event
- Change of Policy
- Successful or Failed Object Access
- Account Change
- Log Clearing
- Internet Logs
- HTTP Logs
- FTP Logs
- SMTP Logs
- Additional Resources
- Chapter 12 Internet Usage Analysis
- Web Activity
- Internet Explorer
- Favorites
- History
- Cache
- Cookies
- Firefox
- Favorites
- History
- Cache
- Cookies
- Passwords
- Downloads
- Toolbar History
- Network, Proxy, and DNS History
- Peer-to-Peer Networking
- Gnutella Clients
- Bearshare
- Downloading
- Sharing
- Other Information
- Limewire
- Downloading
- Sharing
- FastTrack Clients
- Overnet, eMule, and eDonkey2000 Clients
- Downloading
- Sharing
- Instant Messaging
- AOL Instant Messenger
- Microsoft Messenger
- Additional Resources
- Chapter 13 Email Investigations
- Outlook/Outlook Express
- Outlook Express
- Acquisition
- Analysis
- Outlook
- Acquisition
- Access Control
- Analysis
- Lotus Notes
- Acquisition
- Access Control and Logging
- Analysis
- Address Book
- Additional Resources
- Appendix A Sample Chain of Custody Form
- Appendix B Master Boot Record Layout
- Appendix C Partition Types
- Ap