Book Layout

The chapters of this book are provided in a progressive sequence, each chapter building on the information discussed in the previous chapter. The progression through the chapters is intended to provide a thorough understanding of the issues presented when faced with performing live investigations of security incidents on Windows systems. However, several of the chapters can also be standalone references.

The chapters and appendices in this book are provided in the following sequence:

Chapter 1: Introduction is, well, this chapter. The introduction provides an overview of the book and why it was written, what the reader should expect, and the target audience of the book.

Chapter 2: How Incidents Occur addresses...well...how incidents ...

Get Windows Forensics and Incident Recovery now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.