Packt+ | Advance your knowledge in tech

You're reading from Practical Windows Forensics Leverage the power of digital forensics for Windows systems

Product type Paperback

Published in Jun 2016

Publisher Packt

ISBN-13 9781783554096

Length 322 pages

Edition 1st Edition

Tools

Windows Server

Concepts

Forensics

Table of Contents (20) Chapters

Practical Windows Forensics

Credits

About the Authors

About the Reviewers

www.PacktPub.com

Preface

1. The Foundations and Principles of Digital Forensics FREE CHAPTER

2. Incident Response and Live Analysis

3. Volatile Data Collection

4. Nonvolatile Data Acquisition

5. Timeline

6. Filesystem Analysis and Data Recovery

7. Registry Analysis

8. Event Log Analysis

9. Windows Files

10. Browser and E-mail Investigation

11. Memory Forensics

12. Network Forensics

Building a Forensic Analysis Environment

Factors that need to be considered

Case Study

Summary

In this chapter, we looked at time-related attributions on different filesystems, how to build a timeline with TSK and with the Plaso framework.

In the next chapter, we will cover how to analyze dates on the NTFS and FAT filesystems. We will continue to work with TSK and study other utilities from TSK.

The rest of the chapter is locked

You're reading from Practical Windows Forensics Leverage the power of digital forensics for Windows systems

Table of Contents (20) Chapters

Summary

Unlock this book and the full library FREE for 7 days

Personalised recommendations for you