Incident Response: Computer Forensics Toolkit

Features

• Cover Type: Paperback with 360 pages
• Published by: Wiley April 11, 2003
• Written in: English
• ISBN 10 Number: 0764526367
• ISBN 13 Number: 978-0764526367
• Book Dimensions: 9.1 x 7.4 x 0.9 inches
• Weighs: 1.2 pounds

Product Description
* Incident response and forensic investigation are the processes of detecting attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks
* This much-needed reference covers the methodologies for incident response and computer forensics, Federal computer crime law information and evidence requirements, legal issues, and working with law enforcement
* Details how to detect, collect, and eradicate breaches in e-mail and malicious code
* CD-ROM is packed with useful tools that help capture and protect forensic data; search volumes, drives, and servers for evidence; and rebuild systems quickly after evidence has been obtained

Book Info
Guide provides the tools needed to reveal a security breach, gather evidence to report the crime, and conduct audits to prevent future attacks. Provides an understanding of the methodologies for incident response and computer forensics, Federal computer crime law investigation, legal issues, and how to work with law enforcement. Softcover.

Reader Reviews
The introduction describes this book as a "complete introductory course in basic computer forensics and incident response" and that is indeed the case. It begins with an overview of computer forensics and incident response in Chapter 1 and progresses to legal considerations, obtaining and preserving digital evidence, system internals (mostly Windows although Unix is also discussed) and ends with analysis of real-world attacks and possible defences in Chapter 12. Press references and citations are used to give the big picture. All in all this is a book which I would recommend with two "buts": first, the author is writing from a US perspective for a US reader, presenting and discussing US-specific legislation and legal issues; while this would be of direct interest to our US-based brethren it is of no much use to anyone else. Second, platform-dependent coverage is mostly Windows, and although Linux/Unix get mentioned throughout the book the coverage of UNIX internals and forensics is not on par with Windows counterparts. Having said this, if you are in the US and are using Windows, do get this book - it is a readable and straight introduction to a complex and interesting field which becomes more and more important.