Operating System Forensics (Paperback)

Ric Messier

商品描述

Operating System Forensics is the first book to cover all three critical operating systems for digital forensic investigations in one comprehensive reference. 

Users will learn how to conduct successful digital forensic examinations in Windows, Linux, and Mac OS, the methodologies used, key technical concepts, and the tools needed to perform examinations.

Mobile operating systems such as Android, iOS, Windows, and Blackberry are also covered, providing everything practitioners need to conduct a forensic investigation of the most commonly used operating systems, including technical details of how each operating system works and how to find artifacts.

This book walks you through the critical components of investigation and operating system functionality, including file systems, data recovery, memory forensics, system configuration, Internet access, cloud computing, tracking artifacts, executable layouts, malware, and log files. You'll find coverage of key technical topics like Windows Registry, /etc directory, Web browers caches, Mbox, PST files, GPS data, ELF, and more. Hands-on exercises in each chapter drive home the concepts covered in the book. You'll get everything you need for a successful forensics examination, including incident response tactics and legal requirements. Operating System Forensics is the only place you'll find all this covered in one book.

  • Covers digital forensic investigations of the three major operating systems, including Windows, Linux, and Mac OS
  • Presents the technical details of each operating system, allowing users to find artifacts that might be missed using automated tools
  • Hands-on exercises drive home key concepts covered in the book.
  • Includes discussions of cloud, Internet, and major mobile operating systems such as Android and iOS

商品描述(中文翻譯)

《作業系統取證學》是第一本涵蓋所有三個關鍵作業系統的數位取證調查的綜合參考書。

讀者將學習如何在Windows、Linux和Mac OS中進行成功的數位取證調查,包括使用的方法論、關鍵技術概念以及執行調查所需的工具。

本書還涵蓋了Android、iOS、Windows和Blackberry等移動作業系統,提供了執行對最常用作業系統進行數位取證調查所需的一切,包括每個作業系統的技術細節以及如何尋找證據。

本書將引導您了解調查和作業系統功能的關鍵組件,包括檔案系統、資料恢復、記憶體取證、系統配置、網際網路存取、雲端運算、追蹤證據、可執行程式佈局、惡意軟體和日誌檔案。您將找到有關Windows註冊表、/etc目錄、網頁瀏覽器快取、Mbox、PST檔案、GPS資料、ELF等關鍵技術主題的相關內容。每章的實作練習將強化書中所涵蓋的概念。您將獲得進行成功取證調查所需的一切,包括事件回應策略和法律要求。《作業系統取證學》是唯一一本涵蓋所有這些內容的書籍。

本書涵蓋了對三個主要作業系統(包括Windows、Linux和Mac OS)的數位取證調查,並呈現了每個作業系統的技術細節,讓使用者能夠找到使用自動化工具可能會遺漏的證據。

實作練習強化了書中所涵蓋的關鍵概念。

本書還討論了雲端、網際網路和Android、iOS等主要移動作業系統。