Incident Response & Computer Forensics, 2nd Ed., 2nd Edition

CHAPTER 5

Live Data Collection from Windows Systems

 

One of the first steps of any preliminary investigation is to obtain enough information to determine an appropriate response. The steps you take to confirm whether or not an incident occurred vary depending on the type of incident. Obviously, you will take different steps to verify unacceptable web surfing than you will to determine whether an employee has been stealing files from another system’s file shares. You need to take into consideration the totality of the circumstances before responding at the target system, using the standard investigative techniques outlined in Chapter 4. If we could become a broken record, we would repeat “totality of the circumstances” over and over. Initial ...