舉報 
會員
Digital Forensics and Incident Response
最新章節：
Summary
ThisbookistargetedatInformationSecurityprofessionals,forensicspractitioners,andstudentswithknowledgeandexperienceintheuseofsoftwareapplicationsandbasiccommand-lineexperience.Itwillalsohelpprofessionalswhoarenewtotheincidentresponse/digitalforensicsrolewithintheirorganization.
目錄(198章)
倒序
- coverpage
- Title Page
- Credits
- About the Author
- About the Reviewer
- www.PacktPub.com
- Why subscribe?
- Customer Feedback
- Preface
- What this book covers
- What you need for this book
- Who this book is for
- Conventions
- Reader feedback
- Customer support
- Downloading the color images of this book
- Errata
- Piracy
- Questions
- Incident Response
- The incident response process
- The role of digital forensics
- The incident response framework
- The incident response charter
- CSIRT
- CSIRT core team
- Technical support personnel
- Organizational support personnel
- External resources
- The incident response plan
- Incident classification
- The incident response playbook
- Escalation procedures
- Maintaining the incident response capability
- Summary
- Forensic Fundamentals
- Legal aspects
- Laws and regulations
- Rules of evidence
- Digital forensic fundamentals
- A brief history
- The digital forensic process
- Identification
- Preservation
- Collection
- Proper evidence handling
- Chain of custody
- Examination
- Analysis
- Presentation
- Digital forensic lab
- Physical security
- Tools
- Hardware
- Software
- Jump kit
- Summary
- Network Evidence Collection
- Preparation
- Network diagram
- Configuration
- Logs and log management
- Network device evidence
- Security information and event management system
- Security onion
- Packet capture
- tcpdump
- WinPcap and RawCap
- Wireshark
- Evidence collection
- Summary
- Acquiring Host-Based Evidence
- Preparation
- Evidence volatility
- Evidence acquisition
- Evidence collection procedures
- Memory acquisition
- Local acquisition
- FTK Imager
- Winpmem
- Remote acquisition
- Winpmem
- F-Response
- Virtual machines
- Non-volatile data
- Summary
- Understanding Forensic Imaging
- Overview of forensic imaging
- Preparing a stage drive
- Imaging
- Dead imaging
- Live imaging
- Imaging with Linux
- Summary
- Network Evidence Analysis
- Analyzing packet captures
- Command-line tools
- Wireshark
- Xplico and CapAnalysis
- Xplico
- CapAnalysis
- Analyzing network log files
- DNS blacklists
- SIEM
- ELK Stack
- Summary
- Analyzing System Memory
- Memory evidence overview
- Memory analysis
- Memory analysis methodology
- SANS six-part methodology
- Network connections methodology
- Tools
- Redline
- Volatility
- Installing Volatility
- Identifying the image
- pslist
- psscan
- pstree
- DLLlist
- Handles
- svcscan
- netscan and sockets
- LDR modules
- psxview
- Dlldump
- memdump
- procdump
- Rekall
- imageinfo
- pslist
- Event logs
- Sockets
- Malfind
- Summary
- Analyzing System Storage
- Forensic platforms
- Autopsy
- Installing Autopsy
- Opening a case
- Navigating Autopsy
- Examining a Case
- Web Artifacts
- Attached Devices
- Deleted Files
- Keyword Searches
- Timeline Analysis
- Registry analysis
- Summary
- Forensic Reporting
- Documentation overview
- What to document
- Types of documentation
- Sources
- Audience
- Incident tracking
- Fast incident response
- Written reports
- Executive summary
- Incident report
- Forensic report
- Summary
- Malware Analysis
- Malware overview
- Malware analysis overview
- Static analysis
- Dynamic analysis
- Analyzing malware
- Static analysis
- Pestudio
- Remnux
- Dynamic analysis
- Process Explorer
- Cuckoo sandbox
- Summary
- Threat Intelligence
- Threat intelligence overview
- Threat intelligence types
- Threat intelligence methodology
- Threat intelligence direction
- Cyber kill chain
- Diamond model
- MITRE ATT&CK
- Threat intelligence sources
- Internally developed sources
- Commercial sourcing
- Open source
- Threat intelligence platforms
- MISP threat sharing
- Using threat intelligence
- Proactive threat intelligence
- Reactive threat intelligence
- Autopsy
- Redline
- Yara and Loki
- Summary 更新時間：2021-07-02 18:50:19
推薦閱讀
- Learning Single：page Web Application Development
- 軟件測試項目實戰之性能測試篇
- PHP網絡編程學習筆記
- Learning Hunk
- 自然語言處理Python進階
- Spring Boot企業級項目開發實戰
- Nginx實戰：基于Lua語言的配置、開發與架構詳解
- Scala Reactive Programming
- Unity 2018 Shaders and Effects Cookbook
- 寫給程序員的Python教程
- Image Processing with ImageJ
- 網絡數據采集技術：Java網絡爬蟲實戰
- Learning VMware vSphere
- Magento 2 Beginners Guide
- Scratch從入門到精通
- Game Development Patterns and Best Practices
- Oracle Database 12c DBA官方手冊（第8版）
- Mastering React Test：Driven Development
- RPA開發：UiPath入門與實戰
- 嵌入式Linux C語言程序設計基礎教程（微課版）
- Unity 5.x 2D Game Development Blueprints
- 計算機網絡概論（第二版）
- INSTANT OSGi Starter
- Mastering Service Mesh
- Mobile Prototyping with Axure 7
- 演進式架構
- 按鈕+菜單+加載+轉場UI交互動效設計教程
- Appcelerator Titanium Business Application Development Cookbook
- Learning Shell Scripting with Zsh
- Python編程從零開始學（視頻教學版）
