Windows Forensic Analysis Toolkit, 3rd Edition

Chapter 2

Immediate Response

Chapter Outline

Introduction

Being Prepared to Respond

Questions

The Importance of Preparation

Logs

Data Collection

Training

Summary

Information in this Chapter

• Being Prepared to Respond

• Data Collection

Introduction

Much of what we read regarding incident response is that computer security incidents are a fact of life when we employ IT resources. It’s long been said that it’s not a matter of if your organization will experience a computer security incident, but when that incident will occur. If the media has made anything clear at all during the first half of 2011, it’s that no organization is immune to computer security incidents, whether that’s a web page defaced, sensitive corporate emails exposed, or sensitive ...