Incident Response: Computer Forensics Toolkit
Your in-depth guide to detecting network breaches, uncovering evidence, and preventing future attacksWhether it’s from malicious code sent through an e-mail or an unauthorized user accessing company files, your network is vulnerable to attack. Your response to such incidents is critical. With this comprehensive guide, Douglas Schweitzer arms you with the tools to reveal a security breach, gather evidence to report the crime, and conduct audits to prevent future attacks. He also provides you with a firm understanding of the methodologies for incident response and computer forensics, Federal Computer Crime law information and evidence requirements, legal issues, and how to work with law enforcement.You’ll learn how to:Recognize the telltale signs of an incident and take specific response measuresSearch for evidence by preparing operating systems, identifying network devices, and collecting data from memoryAnalyze and detect when malicious code enters the system and quickly locate hidden filesPerform keyword searches, review browser history, and examine Web caches to retrieve and analyze cluesCreate a forensics toolkit to prop-erly collect and preserve evidenceContain an incident by severing network and Internet connections, and then eradicate any vulnerabilities you uncoverAnticipate future attacks and monitor your system accordinglyPrevent espionage, insider attacks, and inappropriate use of the networkDevelop policies and procedures to carefully audit the systemCD-ROM includes:Helpful tools to capture and protect forensic data; search volumes, drives, and servers for evidence; and rebuild systems quickly after evidence has been obtainedValuable checklists developed by the author for all aspects of incident response and handling