Hands-on Incident Response and Digital Forensics

INDEX

180 day rule 112

acceptable use policy 82–3

preservation of evidence 57–8

violations of 14

access control, re-establishing after system compromised 58

AccessData

AD eDiscovery 126

Enterprise 168

Forensic Toolkit 98, 125, 193

FTK Imager 164

memory analysis with Enterprise 167

Mobile Phone Examiner+ 126, 186

acquisition

cloud computing 171–7

evidence 129–46

mobile devices 184–6

report of findings 192

agile software development 45

AlienVault

Open Threat Exchange 49

SIEM tool 23, 24 (fig.)

allocation units see clusters

‘always on,’ 148

Amazon Web Services (AWS) 170, 174–5

S3 (Simple Storage Service) 172

American Academy of Forensic Sciences 115

analysis of artefacts 144–6

overcoming challenges 145–6

relevant items 145

analysis of evidence ...