Windows Forensics and Incident Recovery

Fourth Dream

Not surprisingly, Andy found himself at his desk again. He looked down and saw his note pad with the information he'd received from Dave scrawled on the first couple of lines. In his past dreams, Andy had gotten up and charged down to the server room, but this time was different. This time, he sat and thought for a moment. He'd used various tools to retrieve information from the system, most of which had been native to the system. The one exception was fport.exe, which he'd downloaded from FoundStone's web site. Yet, he realized that previously he had not really determined the full extent of the issue on the web server he was examining. He'd simply killed the first unusual process he'd found, and then in his most recent dream, deleted ...