Incident Response & Computer Forensics, Third Edition
This book provides a comprehensive guide to incident response and computer forensics, covering the entire lifecycle of incident response, including preparation, data collection, data analysis, and remediation. It includes real-world case studies and practical techniques for investigating and remediating data breaches. The book covers topics such as architecting an infrastructure for methodical investigation and remediation, developing leads and identifying indicators of compromise, collecting and preserving live data, performing forensic duplication, analyzing data from networks and applications, investigating Windows and Mac OS X systems, performing malware triage, writing detailed incident response reports, and creating comprehensive remediation plans.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A network forensics toolkit that transforms network traffic data into graph-based representations for interactive analysis and visualization through a web interface.
A reliable end-to-end DFIR solution for boosting cyber incident response and forensics capacity.
Universal hexadecimal editor for computer forensics, data recovery, and IT security.
A repository containing material from a talk on sub-domain enumeration techniques
A read-only FUSE driver that enables Linux systems to mount and access Apple File System (APFS) volumes, including encrypted and fusion drives.
GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation.
A Windows Registry hive extraction library that reads and writes Windows Registry 'hive' binary files.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.