xxx, 650 p. : 24 cm. + "First printing, September 2005"--T.p. verso Accompanying DVD-ROM contains "several gigabytes of compressed data generated from actual intrusions. This data mirrors what analysts might find in real investigations and allows the reader to learn about forensic investigations in a realistic setting"--P. [4] of cover Includes index Pt. I. Live incident response -- Ch. 1. Windows live response -- Ch. 2. Unix live response -- Pt. II. Network-based forensics -- Ch. 3. Collecting network-based evidence -- Ch. 4. Analyzing network-based evidence for a Windows intrusion -- Ch. 5. Analyzing network-based evidence for a Unix intrusion -- Pt. III. Acquiring a forensic duplication -- Ch. 6. Before you jump right in ... -- Ch. 7. Commercial-based forensic duplications -- Ch. 8. Noncommercial-based forensic duplications -- Pt. IV. Forensic analysis techniques -- Ch. 9. Common forensic analysis techniques -- Ch. 10. Web browsing activity reconstruction -- Ch. 11. E-mail activity reconstruction -- Ch. 12. Microsoft Windows registry reconstruction -- Ch. 13. Forensic tool analysis : an introduction to using Linux for analyzing files of unknown origin -- Ch. 14. Forensic tool analysis : a hands-on analysis of the Linux file aio -- Ch. 15. Forensic tool analysis : analyzing files of unknown origin (Windows) -- Pt. V. Creating a complete forensic tool kit -- Ch. 16. Building the ultimate response CD -- Ch. 17. Making your CD-ROM a bootable environment -- Pt. VI. Mobile device forensics -- Ch. 18. Forensic duplication and analysis of personal digital assistants -- Ch. 19. Forensic duplication of USB and compact flash memory devices -- Ch. 20. Forensic analysis of USB and compact flash memory devices -- Pt. VII. Online-based forensics -- Ch. 21. Tracing E-mail -- Ch. 22. Domain name ownership -- App. An introduction to Perl System requirements for accompanying DVD-ROM: Microsoft Windows 2000/XP and an open source version of Unix, such as FreeBSD, OpenBSD, NetBSD, or Linux; DVD-ROM drive