Practical Windows Forensics

Summary

After we finished the main book chapters, in this appendix we conducted a primary analysis and discovered malware in an infected machine. We used different analysis techniques, live analysis and postmortem analysis, and explained how to get the same results from both ways. Although, live analysis is easier, it is not applicable all the time. This is why we must be aware of both techniques for the real-life investigations.