Preface

Digital Forensics and Incident Response – Second Edition provides an overview of the various topics surrounding the various technical and operational aspects of incident response and digital forensics. This will start with an examination of the proactive actions to take to ensure that an organization is ready for an incident. Next, the integration of digital forensic concepts and techniques and how they relate to incident response is addressed. Moving from concepts to actual techniques, you will be shown how to acquire evidence from a variety of sources including disks, memory, and networks. You will then be guided through examining those sources of evidence for indicators of compromise or attack. Next, you will examine the role of reporting your findings and how to configure reports for the various entities that require insight into an incident. To round out the skill set, the roles of malware analysis, threat intelligence, and threat hunting are discussed. By the end of this book, you will have a solid foundation in the forensic techniques and methodologies of incident response, as well as the experience required to bring these techniques into your own organization to better prepare for a potential security incident.