Windows Forensics and Incident Recovery

Host Configuration

The host systems we are most concerned with are those computers that make up your internal infrastructure. These systems can include web or FTP servers (which may be located on the DMZ or the corporate LAN), file servers, application servers, domain controllers, and workstations. Any of these systems may be a target for attack and compromise, depending upon the configuration of the infrastructure and of the host systems themselves. In particular, any system exposed to the Internet will likely be a target for at least scanning and probing at some point. However, the exposure of these systems can be limited by the configuration of the infrastructure. Configuration of perimeter devices was addressed in the previous section in ...