Windows Forensics and Incident Recovery

Prologue

We join our intrepid hero, Andy, a Windows system administrator for a medium-sized engineering consulting firm. The firm had a great deal of computer assets, particularly file servers and tape backup systems. They also had several web servers, not only to provide the usual public interface and marketing information, but also to provide information to the public regarding the various projects they were involved in. The firm was the primary contractor on several projects and subcontractor on several more, and over the years they'd found that providing updated information to the public regarding the project was good for public relations. The projects were usually small and didn't require a great deal of space, so several projects could ...