Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Digital Forensics and Incident Response
  • Table Of Contents Toc
  • Feedback & Rating feedback
Digital Forensics and Incident Response

Digital Forensics and Incident Response

By : Gerard Johansen
4.9 (15)
close
close
Digital Forensics and Incident Response

Digital Forensics and Incident Response

4.9 (15)
By: Gerard Johansen

Overview of this book

An understanding of how digital forensics integrates with the overall response to cybersecurity incidents is key to securing your organization’s infrastructure from attacks. This updated third edition will help you perform cutting-edge digital forensic activities and incident response with a new focus on responding to ransomware attacks. After covering the fundamentals of incident response that are critical to any information security team, you’ll explore incident response frameworks. From understanding their importance to creating a swift and effective response to security incidents, the book will guide you using examples. Later, you’ll cover digital forensic techniques, from acquiring evidence and examining volatile memory through to hard drive examination and network-based evidence. You’ll be able to apply these techniques to the current threat of ransomware. As you progress, you’ll discover the role that threat intelligence plays in the incident response process. You’ll also learn how to prepare an incident response report that documents the findings of your analysis. Finally, in addition to various incident response activities, the book will address malware analysis and demonstrate how you can proactively use your digital forensic skills in threat hunting. By the end of this book, you’ll be able to investigate and report unwanted security breaches and incidents in your organization.
Table of Contents (28 chapters)
close
close
1
Part 1: Foundations of Incident Response and Digital Forensics
6
Part 2: Evidence Acquisition
11
Part 3: Evidence Analysis
17
Part 4: Ransomware Incident Response
20
Part 5: Threat Intelligence and Hunting
Appendix

To get the most out of this book

A basic understanding of the Windows operating system internals will make some core concepts such as memory analysis or process execution easier to understand. Further, you should be comfortable working in the Windows and Linux command lines. Finally, a basic understanding of network protocols will be useful in analyzing network evidence.

Software/hardware covered in the book

Wireshark

Encrypted Disk Detector 3.0.2

FTK Imager 4.7.12

Security Onion 2.3

WinPmem 2.0.1

Zeek

Belkasoft Live RAM Capturer

RITA

Kroll gkape 1.2.0.0

Network Miner 2.7.3

Velociraptor 0.6.4

Arkime 3.3.1

Eraser 6.2.0.2993

Monolith Notes

Volatility 3 Framework 2.2.0

Pestudio 9.3.7

Volatility Workbench v3.0.1003

Process Explorer

Autopsy 4.19.3

ClamAV

Event Log Explorer 5.2

Maltego 4.3.1

Skadi 2019.4

Operating system requirements

Windows 10

Ubuntu 20.04

Various tools need to be run on a Linux OS, such as Ubuntu 20.04. There are also techniques that should be conducted in a sandbox environment to limit the potential for inadvertent infection. You should have a virtualization tool such as VMWare Workstation Player or VirtualBox to use several of the covered operating systems and tools.

In some cases, tools that are covered have a commercial version. There should be no need to purchase commercial tools in following the various examples presented. It is the intent that you can take the examples and constructs into a production environment and use them in actual investigations.

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Confirmation

Modal Close icon
claim successful

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY