舉報 
會員
Windows Forensics Cookbook
最新章節：
Twitter Accounts
IfyouareaforensicanalystorincidentresponseprofessionalwhowantstoperformcomputerforensicsinvestigationsfortheWindowsplatformandexpandyourtookkit,thenthisbookisforyou.
- Twitter Accounts 更新時間：2021-07-02 20:58:30
- Websites
- Books
- Advanced further reading
- How do I get started?
- Law enforcement
- Corporate
- Academia
- Taking your first steps in digital forensics
- False positives during data processing with digital forensics software
- Legal and jurisdictional challenges
- Your process is faulty
- It was a virus / I was hacked
- It wasn't me
- Soundness of evidence
- Troubleshooting when processes fail
- Troubleshooting in free and open source tools
- Troubleshooting in commercial tools
- Introduction
- Troubleshooting in Windows Forensic Analysis
- See also
- How it works...
- How to do it...
- Getting ready
- Nuix Web Review & Analytics
- See also
- How it works...
- How to do it...
- Getting ready
- Making a timeline in Autopsy
- How it works...
- How to do it...
- Getting ready
- Data visualization with FTK
- Introduction
- Data Visualization
- How it works...
- How to do it...
- Getting ready
- Windows 10 Xbox App
- How it works...
- How to do it...
- Getting ready
- Windows 10 mail app
- See also
- How it works...
- How to do it...
- Getting ready
- Dropbox forensics
- See also
- How it works...
- How to do it...
- Getting ready
- OneDrive forensics
- See also
- How it works...
- How to do it...
- Getting ready
- Cortana forensics
- See also
- How it works...
- How to do it...
- Getting ready
- Parsing Windows 10 Notifications
- Introduction
- Windows 10 Forensics
- See also
- How it works...
- How to do it...
- Getting ready
- Skype forensics with SkypeLogView
- See also
- How it works...
- How to do it...
- Getting ready
- Skype forensics with Belkasoft Evidence Center
- See also
- How it works...
- How to do it...
- Getting ready
- Webmail analysis with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- Thunderbird mailbox parsing with Autopsy
- See also
- How it works...
- How to do it...
- Getting ready
- Outlook mailbox parsing with Intella
- Introduction
- Email and Instant Messaging Forensics
- See also
- How it works...
- How to do it...
- Getting ready
- Extracting web browser data from Pagefile.sys
- See also
- How it works...
- How to do it...
- Getting ready
- Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center
- See also
- How it works...
- How to do it...
- Getting ready
- Google Chrome analysis with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- Mozilla Firefox analysis with BlackBag's BlackLight
- Introduction
- Web Browser Forensics
- See also
- How it works...
- How to do it...
- Getting ready
- Prefetch file recovery with Windows Prefetch Carver
- See also
- How it works...
- How to do it...
- Getting ready
- Prefetch file parsing with PECmd
- See also
- How it works...
- How to do it...
- Getting ready
- Prefetch file analysis with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- LNK file analysis with Link Parser
- See also
- How it works...
- How to do it...
- Getting ready
- LNK file analysis with LECmd
- See also
- How it works...
- How to do it...
- Getting ready
- LNK file analysis with EnCase forensic
- See also
- How it works...
- How to do it...
- Getting ready
- Event log recovery with EVTXtract
- See also
- How it works...
- How to do it...
- Getting ready
- Event log analysis with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- Event log analysis with FullEventLogView
- See also
- How it works...
- How to do it...
- Getting ready
- Recycle bin content analysis with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- Recycle bin content analysis with Rifiuti2
- See also
- How it works...
- How to do it...
- Getting ready
- Recycle Bin content analysis with EnCase Forensic
- Introduction
- Main Windows Operating System Artifacts
- See also
- How it works...
- How to do it...
- Getting ready
- Registry analysis with FTK Registry Viewer
- See also
- How it works...
- How to do it...
- Getting ready
- Recovering deleted Registry artifacts with Registry Explorer
- See also
- How it works...
- How to do it...
- Getting ready
- Parsing registry files with RegRipper
- See also
- How it works...
- How to do it...
- Getting ready
- Extracting and viewing Windows Registry files with Magnet AXIOM
- Introduction
- Windows Registry Analysis
- See also
- How it works...
- How to do it...
- Getting ready
- Processing and analyzing VSC data with Magnet AXIOM
- See also
- How it works...
- How to do it...
- Getting ready
- Mounting VSCs from disk images with VSSADMIN and MKLINK
- See also
- How it works...
- How to do it...
- Getting ready
- Browsing and copying files from VSCs on a live system with ShadowCopyView
- Introduction
- Windows Shadow Copies Analysis
- See more
- How it works...
- How to do it...
- Getting ready
- File carving with PhotoRec
- See also
- How it works...
- How to do it...
- Getting ready
- Undeleting files from ReFS with ReclaiMe File Recovery
- See also
- How it works...
- How to do it...
- Getting ready...
- Undeleting files from NTFS with Autopsy
- See also
- How it works...
- How to do it...
- Getting ready
- NTFS Analysis with The Sleuth Kit
- Introduction
- Windows File System Analysis
- See also
- How it works...
- How to do it...
- Getting ready
- Mounting forensic images with Arsenal Image Mounter
- See also
- How it works...
- How to do it...
- Getting ready
- Drive acquisition in RAW format with dc3dd
- See more
- How it works...
- How to do it...
- Getting ready
- Drive acquisition in E01 format with FTK Imager
- Introduction
- Windows Drive Acquisition
- There is more...
- How to do it...
- Getting ready
- Variations in Windows versions
- See also
- How it works...
- How to do it...
- Getting ready
- Windows memory image analysis with Volatility
- See also
- How it works...
- How to do it...
- Getting ready
- Windows memory image analysis with Belkasoft Evidence Center
- See also
- How it works…
- How to do it…
- Getting ready
- Windows memory acquisition with DumpIt
- See also
- How it works…
- How to do it…
- Getting ready
- Windows memory acquisition with Belkasoft RAM Capturer
- Introduction
- Windows Memory Acquisition and Analysis
- Challenges of acquiring digital evidence from Windows systems
- What can we do to make things easier for ourselves in the meantime?
- Digital forensic investigation - an international field
- Writing reports
- Ensuring evidence is forensically sound
- Identifying evidence sources
- Windows file system
- Why Windows?
- Introduction
- Digital Forensics and Evidence Acquisition
- Questions
- Piracy
- Errata
- Downloading the color images of this book
- Customer support
- Conventions
- See also
- There's more…
- How it works…
- How to do it…
- Getting ready
- Sections
- Who this book is for
- What you need for this book
- What this book covers
- Preface
- Customer Feedback
- Why subscribe?
- www.PacktPub.com
- About the Reviewer
- About the Authors
- Credits
- Windows Forensics Cookbook
- Copyright
- Title Page
- cover
- cover
- Title Page
- Copyright
- Windows Forensics Cookbook
- Credits
- About the Authors
- About the Reviewer
- www.PacktPub.com
- Why subscribe?
- Customer Feedback
- Preface
- What this book covers
- What you need for this book
- Who this book is for
- Sections
- Getting ready
- How to do it…
- How it works…
- There's more…
- See also
- Conventions
- Customer support
- Downloading the color images of this book
- Errata
- Piracy
- Questions
- Digital Forensics and Evidence Acquisition
- Introduction
- Why Windows?
- Windows file system
- Identifying evidence sources
- Ensuring evidence is forensically sound
- Writing reports
- Digital forensic investigation - an international field
- What can we do to make things easier for ourselves in the meantime?
- Challenges of acquiring digital evidence from Windows systems
- Windows Memory Acquisition and Analysis
- Introduction
- Windows memory acquisition with Belkasoft RAM Capturer
- Getting ready
- How to do it…
- How it works…
- See also
- Windows memory acquisition with DumpIt
- Getting ready
- How to do it…
- How it works…
- See also
- Windows memory image analysis with Belkasoft Evidence Center
- Getting ready
- How to do it...
- How it works...
- See also
- Windows memory image analysis with Volatility
- Getting ready
- How to do it...
- How it works...
- See also
- Variations in Windows versions
- Getting ready
- How to do it...
- There is more...
- Windows Drive Acquisition
- Introduction
- Drive acquisition in E01 format with FTK Imager
- Getting ready
- How to do it...
- How it works...
- See more
- Drive acquisition in RAW format with dc3dd
- Getting ready
- How to do it...
- How it works...
- See also
- Mounting forensic images with Arsenal Image Mounter
- Getting ready
- How to do it...
- How it works...
- See also
- Windows File System Analysis
- Introduction
- NTFS Analysis with The Sleuth Kit
- Getting ready
- How to do it...
- How it works...
- See also
- Undeleting files from NTFS with Autopsy
- Getting ready...
- How to do it...
- How it works...
- See also
- Undeleting files from ReFS with ReclaiMe File Recovery
- Getting ready
- How to do it...
- How it works...
- See also
- File carving with PhotoRec
- Getting ready
- How to do it...
- How it works...
- See more
- Windows Shadow Copies Analysis
- Introduction
- Browsing and copying files from VSCs on a live system with ShadowCopyView
- Getting ready
- How to do it...
- How it works...
- See also
- Mounting VSCs from disk images with VSSADMIN and MKLINK
- Getting ready
- How to do it...
- How it works...
- See also
- Processing and analyzing VSC data with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Windows Registry Analysis
- Introduction
- Extracting and viewing Windows Registry files with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Parsing registry files with RegRipper
- Getting ready
- How to do it...
- How it works...
- See also
- Recovering deleted Registry artifacts with Registry Explorer
- Getting ready
- How to do it...
- How it works...
- See also
- Registry analysis with FTK Registry Viewer
- Getting ready
- How to do it...
- How it works...
- See also
- Main Windows Operating System Artifacts
- Introduction
- Recycle Bin content analysis with EnCase Forensic
- Getting ready
- How to do it...
- How it works...
- See also
- Recycle bin content analysis with Rifiuti2
- Getting ready
- How to do it...
- How it works...
- See also
- Recycle bin content analysis with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Event log analysis with FullEventLogView
- Getting ready
- How to do it...
- How it works...
- See also
- Event log analysis with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Event log recovery with EVTXtract
- Getting ready
- How to do it...
- How it works...
- See also
- LNK file analysis with EnCase forensic
- Getting ready
- How to do it...
- How it works...
- See also
- LNK file analysis with LECmd
- Getting ready
- How to do it...
- How it works...
- See also
- LNK file analysis with Link Parser
- Getting ready
- How to do it...
- How it works...
- See also
- Prefetch file analysis with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Prefetch file parsing with PECmd
- Getting ready
- How to do it...
- How it works...
- See also
- Prefetch file recovery with Windows Prefetch Carver
- Getting ready
- How to do it...
- How it works...
- See also
- Web Browser Forensics
- Introduction
- Mozilla Firefox analysis with BlackBag's BlackLight
- Getting ready
- How to do it...
- How it works...
- See also
- Google Chrome analysis with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center
- Getting ready
- How to do it...
- How it works...
- See also
- Extracting web browser data from Pagefile.sys
- Getting ready
- How to do it...
- How it works...
- See also
- Email and Instant Messaging Forensics
- Introduction
- Outlook mailbox parsing with Intella
- Getting ready
- How to do it...
- How it works...
- See also
- Thunderbird mailbox parsing with Autopsy
- Getting ready
- How to do it...
- How it works...
- See also
- Webmail analysis with Magnet AXIOM
- Getting ready
- How to do it...
- How it works...
- See also
- Skype forensics with Belkasoft Evidence Center
- Getting ready
- How to do it...
- How it works...
- See also
- Skype forensics with SkypeLogView
- Getting ready
- How to do it...
- How it works...
- See also
- Windows 10 Forensics
- Introduction
- Parsing Windows 10 Notifications
- Getting ready
- How to do it...
- How it works...
- See also
- Cortana forensics
- Getting ready
- How to do it...
- How it works...
- See also
- OneDrive forensics
- Getting ready
- How to do it...
- How it works...
- See also
- Dropbox forensics
- Getting ready
- How to do it...
- How it works...
- See also
- Windows 10 mail app
- Getting ready
- How to do it...
- How it works...
- Windows 10 Xbox App
- Getting ready
- How to do it...
- How it works...
- Data Visualization
- Introduction
- Data visualization with FTK
- Getting ready
- How to do it...
- How it works...
- Making a timeline in Autopsy
- Getting ready
- How to do it...
- How it works...
- See also
- Nuix Web Review & Analytics
- Getting ready
- How to do it...
- How it works...
- See also
- Troubleshooting in Windows Forensic Analysis
- Introduction
- Troubleshooting in commercial tools
- Troubleshooting in free and open source tools
- Troubleshooting when processes fail
- Soundness of evidence
- It wasn't me
- It was a virus / I was hacked
- Your process is faulty
- Legal and jurisdictional challenges
- False positives during data processing with digital forensics software
- Taking your first steps in digital forensics
- Academia
- Corporate
- Law enforcement
- How do I get started?
- Advanced further reading
- Books
- Websites
- Twitter Accounts 更新時間：2021-07-02 20:58:30
