Mastering Windows Network Forensics and Investigation

An authoritative guide to investigating high-technology crimes Internet crime is seemingly ever on the rise, making the need for a comprehensive resource on how to investigate these crimes even more dire. This professional-level book--aimed at law enforcement personnel, prosecutors, and corporate investigators--provides you with the training you need in order to acquire the sophisticated skills and software solutions to stay one step ahead of computer criminals. Specifies the techniques needed to investigate, analyze, and document a criminal act on a Windows computer or network Places a special emphasis on how to thoroughly investigate criminal activity and now just perform the initial response Walks you through ways to present technically complicated material in simple terms that will hold up in court Features content fully updated for Windows Server 2008 R2 and Windows 7 Covers the emerging field of Windows Mobile forensics Also included is a classroom support package to ensure academic adoption, Mastering Windows Network Forensics and Investigation, 2nd Edition offers help for investigating high-technology crimes.

An authoritative guide to investigating high-technologycrimesInternet crime is seemingly ever on the rise, making the needfor a comprehensive resource on how to investigate these crimeseven more dire. This professional-level book--aimed at lawenforcement personnel, prosecutors, and corporateinvestigators--provides you with the training you need in order toacquire the sophisticated skills and software solutions to stay onestep ahead of computer criminals.* Specifies the techniques needed to investigate, analyze, anddocument a criminal act on a Windows computer or network* Places a special emphasis on how to thoroughly investigatecriminal activity and now just perform the initial response* Walks you through ways to present technically complicatedmaterial in simple terms that will hold up in court* Features content fully updated for Windows Server 2008 R2 andWindows 7* Covers the emerging field of Windows Mobile forensicsAlso included is a classroom support package to ensure academicadoption, Mastering Windows Network Forensics and Investigation2nd Edition offers help for investigating high-technologycrimes.

Introduction xviiPart 1 Understanding and Exploiting Windows Networks 1Chapter 1 Network Investigation Overview 3Chapter 2 The Microsoft Network Structure 25Chapter 3 Beyond the Windows GUI 63Chapter 4 Windows Password Issues 85Chapter 5 Windows Ports and Services 137Part 2 Analyzing the Computer 157Chapter 6 Live-Analysis Techniques 159Chapter 7 Windows Filesystems 179Chapter 8 The Registry Structure 215Chapter 9 Registry Evidence 257Chapter 10 Introduction to Malware 325Part 3 Analyzing the Logs 349Chapter 11 Text-Based Logs 351Chapter 12 Windows Event Logs 381Chapter 13 Logon and Account Logon Events 419Chapter 14 Other Audit Events 463Chapter 15 Forensic Analysis of Event Logs 505Part 4 Results, the Cloud, and Virtualization 537Chapter 16 Presenting the Results 539Chapter 17 The Challenges of Cloud Computing and Virtualization 565Part 5 Appendices 597Appendix A The Bottom Line 599Appendix B Test Environments 633Index 647