Windows Forensics and Incident Recovery

Appendix B. Web Sites

Staying abreast of new developments via the Internet can be a time-consuming process. While there is a great deal of information available regarding incident response and forensics, it's not kept all in one place. Also, there is very little information available that specifically deals with conducting incident response and forensics on Windows systems. Much of the information that is available deals with collecting some modicum of data from a Windows system but provides very little guidance with regards to how to analyze that data or what that data tells us about the state of the system. In fact, there seems to be more information describing how to conduct forensic investigations of Windows systems from a Linux system than ...