Windows Forensics and Incident Recovery

Second Dream

Andy found himself back in his office, hanging up the phone after Dave's call. He thought about the lessons he'd just learned, rolling them over in his mind as he finished up his coffee and headed to the server room.

Once in the server room, he found that he had a mild sense of familiarity, the faint shadow of a sense that he had done this before. He cautiously slid into the seat of the KVM console he'd used in the past. He once again opened the Event Viewer but only gave it a cursory view, not expecting to find anything unusual.

Andy had done some reading of news items over the past couple of weeks and had happened upon a series of articles regarding spyware and adware. This was software that was installed on a system when the user ...