Read more
"When I sat down to update the material for this edition, I wanted to not only include new information that I'd found or developed since the third edition was published, but I also wanted to try to include as much information as possible regarding Windows 8 and 8.1. With Windows 8.1 becoming available while I was updating the book, the inevitable questions were being asked, and invariably it won't be long before we start seeing the systems appear on analyst's workbenches. As such, I've tried to provide as much information as I could with respect to newer versions of Windows (i.e., 8 and 8.1), either by writing it directly into the book or linking to the sources of information on the Internet, when attempting to summarize it would simply not do the content justice. Keep in mind, however, that new information is being discovered and developed all the time, and at some point, I needed to stop writing and submit the book for final review and publishing. I'm sure that even more information will become available during the time between when the book goes to the printer, and when it actually comes out on the shelves at bookstores"--
List of contents
1. Analysis Concepts
2. Incident Preparation
3. Volume Shadow Copies
4. File Analysis
5. Registry Analysis
6. Malware Detection
7. Timeline Analysis
8. Application Analysis
Report
"Harlan has done it again! Continuing in the tradition of excellence established by the previous editions, Windows Forensics Analysis Toolkit 3e is an indispensable resource for any forensic examiner. Whether you're a seasoned veteran or just starting out, this work is required reading. WFA3e will maintain a perennial spot on my core reference bookshelf!"-- Cory Altheide, Google
" Windows Forensic Analysis Toolkit 3rd Edition provides a wealth of important information for new and old practitioners alike. Not only does it provide a great overview of artifacts of interest on Windows 7 systems, but it also presents plenty of technology independent concepts that play an important role in any investigation. Feel free to place a copy on your shelf next to WFA 2ed and WRF."--Digital4rensics.com
"The third edition of this reference for system administrators, digital forensic analysts, students, and law enforcement does not replace the second edition, but rather serves as a companion. Coverage encompasses areas such as immediate response, volume shadow copies, file and registry analysis, malware detection, and application analysis. Learning features include b&w screenshots, tip and warning boxes, code (also available on a website), case studies, and 'war stories' from the field. The tools described throughout the book are written in the Perl scripting language, but readers don't need to be experts in Perl, and most of the scripts are accompanied by Windows executables found online. For this third edition, a companion website provides printable checklists, cheat sheets, custom tools, and demos." -- Reference and Research Book News, Inc.
"There is a good reason behind the success of the previous editions of this book, and it has to do with two things: new Windows versions are different enough from previous ones to warrant a new edition and, most importantly, the author is simply that good at explaining things. This edition is no different."-- HelpNetSecurity
