CHAPTER 12
Investigating Windows Systems
The objective of this chapter is to help you understand the fundamental sources of evidence on a Windows system, and how you can apply them to solve common questions that typically arise during an incident response investigation. To be blunt, investigating Windows can be an intimidating challenge. The operating system is a complex beast on its own—even more so when it’s part of an Active Directory domain, as is most often the case in corporate environments. The sheer volume of files, registry keys, log ...
Get Incident Response & Computer Forensics, Third Edition, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
