Practical Windows Forensics

Chapter 2. Incident Response and Live Analysis

The stages of preparation to respond to an incident are a matter which much attention should be paid to. In some cases, the lack of necessary tools during the incident leads to the inability to perform the necessary actions at the right time.

Taking into account that the reaction time of an incident depends on the efficiency of the incident handling process, it becomes clear that in order to prepare the IR team, its technical support should be very careful.

The whole set of requirements can be divided into several categories for the IR team:

• Skills
• Hardware
• Software

Let's consider the main issues that may arise during the preparation of the incident response team in more detail.

If we want to build a computer ...