Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Digital Forensics and Incident Response

You're reading from   Digital Forensics and Incident Response Incident response techniques and procedures to respond to modern cyber threats

Arrow left icon
Product type Paperback
Published in Jan 2020
Publisher
ISBN-13 9781838649005
Length 448 pages
Edition 2nd Edition
Languages
Concepts
Arrow right icon
Author (1):
Arrow left icon
Gerard Johansen Gerard Johansen
Author Profile Icon Gerard Johansen
Gerard Johansen
Arrow right icon
View More author details
Toc

Table of Contents (22) Chapters Close

Preface 1. Section 1: Foundations of Incident Response and Digital Forensics
2. Understanding Incident Response FREE CHAPTER 3. Managing Cyber Incidents 4. Fundamentals of Digital Forensics 5. Section 2: Evidence Acquisition
6. Collecting Network Evidence 7. Acquiring Host-Based Evidence 8. Forensic Imaging 9. Section 3: Analyzing Evidence
10. Analyzing Network Evidence 11. Analyzing System Memory 12. Analyzing System Storage 13. Analyzing Log Files 14. Writing the Incident Report 15. Section 4: Specialist Topics
16. Malware Analysis for Incident Response 17. Leveraging Threat Intelligence 18. Hunting for Threats 19. Assessment 20. Other Books You May Enjoy Appendix

Using write blockers

A key tenet of digital forensics is to ensure that no changes are made to digital evidence while processing and examining it. Any change, no matter how slight, has the potential to bring the entire examination into question. There is a distinct possibility that the evidence may even be excluded from legal proceedings if the responder is unable to articulate how they ensured that the evidence was not tainted during the examination. As a result, it is important to understand how write blockers maintain the integrity of digital evidence.

Write blockers come in two different types. The first of these is a software write blocker. This software sits between the operating system and the evidence. These are often part of any digital forensics tools that are used during the examination phase. They ensure that there is read-only access to the evidence file and that...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image