You are previewing Malware Forensics Field Guide for Windows Systems.
O'Reilly logo
Malware Forensics Field Guide for Windows Systems

Book Description

Dissecting the dark side of the Internet with its infectious worms, botnets, rootkits, and Trojan horse programs (known as malware) is a treaterous condition for any forensic investigator or analyst. Written by information security experts with real-world investigative experience, Malware Forensics Field Guide for Windows Systems is a "tool" with checklists for specific tasks, case studies of difficult situations, and expert analyst tips.



*A condensed hand-held guide complete with on-the-job tasks and checklists

*Specific for Windows-based systems, the largest running OS in the world

*Authors are world-renowned leaders in investigating and analyzing malicious code

Table of Contents

  1. Cover Image
  2. Table of Contents
  3. Title
  4. Copyright
  5. Dedication
  6. Acknowledgments
  7. About the Authors
  8. About the Technical Editor
  9. Introduction
  10. Chapter 1. Malware Incident Response
    1. Solutions in this chapter:
    2. Volatile Data Collection and Analysis Tools
    3. Non-Volatile Data Collection and Analysis Tools
    4. Selected Readings
    5. Jurisprudence/RFCS/Technical Specifications
  11. Chapter 2. Memory Forensics
    1. Solutions in this chapter:
    2. Selected Readings
  12. Chapter 3. Post-Mortem Forensics
    1. Solutions in this chapter:
    2. Selected Readings
  13. Chapter 4. Legal Considerations
    1. Solutions in this chapter:
  14. Chapter 5. File Identification and Profiling
    1. Solutions in this chapter:
    2. Selected Readings
  15. Chapter 6. Analysis of a Malware Specimen
    1. Solutions in this chapter:
    2. Introduction
    3. Goals
    4. Guidelines for Examining a Malicious File Specimen
    5. Establishing the Environment Baseline
    6. Pre-Execution Preparation: System and Network Monitoring
    7. Execution Artifact Capture: Digital Impression and Trace Evidence
    8. Executing the Malicious Code Specimen
    9. Execution Trajectory Analysis: Observing Network, Process, Api, File System, and Registry Activity
    10. Automated Malware Analysis Frameworks
    11. Online Malware Analysis Sandboxes
    12. Defeating Obfuscation
    13. Embedded Artifact Extraction Revisited
    14. Interacting with and Manipulating the Malware Specimen: Exploring and Verifying Functionality and Purpose
    15. Event Reconstruction and Artifact Review: Post-Run Data Analysis
    16. Digital Virology: Advanced Profiling Through Malware Taxonomy and Phylogeny
    17. Conclusion
    18. Pitfalls to Avoid
    19. Selected Readings
  16. Index