Real Digital Forensics: Computer Security and Incident Response. By Keith J. Jones, Richard Bejtlich, and Curtis W. Rose

摘要

A major complaint about many digital forensics books on the market is that they inform readers about what to do conceptually but not necessarily when to do it, why, or how. This final category of instruction— how—is perhaps the most prevailing weakness. With respect to live incident response and network (intrusion) investigations, this book does an exceptional job of instructing readers step-by-step how to collect and analyze data. This book sets a new standard for instructing digital forensics investigators what to do, when to do it, why, and how.