Windows Forensics: The Field Guide for Corporate Computer Investigations


The evidence is in—to solve Windows crime, you need Windows tools

An arcane pursuit a decade ago, forensic science today is a household term. And while the computer forensic analyst may not lead as exciting a life as TV's CSIs do, he or she relies just as heavily on scientific principles and just as surely solves crime.

Whether you are contemplating a career in this growing field or are already an analyst in a Unix/Linux environment, this book ...

See more details below
Other sellers (Paperback)
  • All (15) from $6.55   
  • New (6) from $26.59   
  • Used (9) from $6.55   
Sending request ...


The evidence is in—to solve Windows crime, you need Windows tools

An arcane pursuit a decade ago, forensic science today is a household term. And while the computer forensic analyst may not lead as exciting a life as TV's CSIs do, he or she relies just as heavily on scientific principles and just as surely solves crime.

Whether you are contemplating a career in this growing field or are already an analyst in a Unix/Linux environment, this book prepares you to combat computer crime in the Windows world. Here are the tools to help you recover sabotaged files, track down the source of threatening e-mails, investigate industrial espionage, and expose computer criminals.
* Identify evidence of fraud, electronic theft, and employee Internet abuse
* Investigate crime related to instant messaging, Lotus Notes(r), and increasingly popular browsers such as Firefox(r)
* Learn what it takes to become a computer forensics analyst
* Take advantage of sample forms and layouts as well as case studies
* Protect the integrity of evidence
* Compile a forensic response toolkit
* Assess and analyze damage from computer crime and process the crime scene
* Develop a structure for effectively conducting investigations
* Discover how to locate evidence in the Windows Registry

Read More Show Less

Product Details

  • ISBN-13: 9780470038628
  • Publisher: Wiley
  • Publication date: 5/15/2006
  • Edition number: 1
  • Pages: 408
  • Product dimensions: 7.30 (w) x 9.10 (h) x 0.80 (d)

Meet the Author

Chad Steel has investigated more than 300 computer security incidents. As an adjunct faculty member, he developed and taught the Computer Forensics graduate course in Penn State's engineering program and has instructed federal and local law enforcement, commercial clients, and graduate students in forensic analysis. His experience includes serving as head of IT investigations for a Global 100 corporation and as managing director of the Systems Integration and Security practice at Qwest Communications.

Read More Show Less

Table of Contents

Chapter 1 Windows Forensics 1

The Corporate Computer Forensic Analyst 2

Windows Forensics 3

People, Processes, and Tools 6

Computer Forensics: Today and Tomorrow 8

Additional Resources 9

Chapter 2 Processing the Digital Crime Scene 11

Identify the Scene 12

Perform Remote Research 15

Secure the Crime Scene 17

Document the Scene 18

Process the Scene for Physical Evidence 19

Process the Scene for Electronic Evidence 22

Chain of Custody 25

Best Evidence 26

Working with Law Enforcement 28

Additional Resources 29

Chapter 3 Windows Forensic Basics 31

History and Versions 32


Windows 1.x, 2.x, and 3.x 32

Windows NT and 2000 33

Windows 95, 98, and ME 34

Windows XP and 2003 35

Non-Volatile Storage 38

Floppy Disks 38

Tapes 43

CDs and DVDs 46

USB Flash Drives 48

Hard Disks 51

Additional Resources 58

Chapter 4 Partitions and File Systems 59

Master Boot Record 59

Windows File Systems 65

FAT 66



Compression 85

Encryption 88

Additional Resources 96

Chapter 5 Directory Structure and Special Files 97

Windows NT/2000/XP 97

Directories 98

Files 107

Windows 9x 112

Directories 112

Files 113

Additional Resources 114

Chapter 6 The Registry 115

History 115

Registry Basics 116

Registry Analysis 121

General 122

Folder Locations 125

Startup Items 128

Intelliforms 132

Advanced Registry Analysis 133

Additional Resources 136

Chapter 7 Forensic Analysis 137

Chapter 8 Live System Analysis 139

Covert Analysis 144

System State Analysis 144

System Tools 146

Storage 147

Services and Applications 148

Remote Enumeration 150

Monitoring 154

Keystroke Recording 155

Network Monitoring 157

Overt Analysis 166

GUI-based Overt Analysis 166

Local Command Line Analysis 169

Remote Command Line Analysis 170

Basic Information Gathering 173

System State Information 177

Running Program Information 182

Main Memory Analysis 186

Additional Resources 189

Chapter 9 Forensic Duplication 193

Hard Disk Duplication 194

In-Situ Duplication 197

Direct Duplication 203

Magnetic Tape 204

Hard Disks 205

Optical Disks 205

Multi-tiered Storage 206

Log File Duplication 208

Additional Resources 210

Chapter 10 File System Analysis 211

Searching 211

Index-based Searching 212

Bitwise Searching 217

Search Methodology 219

Hash Analysis 220

Positive Hash Analysis 223

Negative Hash Analysis 224

File Recovery 225

Special Files 236

Print Spool Files 236

Windows Shortcuts 239

Paging File 241

Additional Resources 244

Chapter 11 Log File Analysis 247

Event Logs 247

Application Log 250

System Log 252

Security Log 253

Successful Log-on/Log-off Events 254

Failed Log-on Event 255

Change of Policy 256

Successful or Failed Object Access 256

Account Change 256

Log Clearing 257

Internet Logs 257

HTTP Logs 260

FTP Logs 266

SMTP Logs 268

Additional Resources 270

Chapter 12 Internet Usage Analysis 271

Web Activity 272

Internet Explorer 272

Favorites 274

History 277

Cache 281

Cookies 283

Firefox 285

Favorites 285

History 288

Cache 289

Cookies 291

Passwords 292

Downloads 293

Toolbar History 293

Network, Proxy, and DNS History 294

Peer-to-Peer Networking 294

Gnutella Clients 296

Bearshare 297

Downloading 297

Sharing 298

Other Information 298

Limewire 299

Downloading 300

Sharing 300

FastTrack Clients 301

Overnet, eMule, and eDonkey2000 Clients 302

Downloading 304

Sharing 305

Instant Messaging 305

AOL Instant Messenger 306

Microsoft Messenger 307

Additional Resources 309

Chapter 13 Email Investigations 311

Outlook/Outlook Express 314

Outlook Express 314

Acquisition 315

Analysis 317

Outlook 321

Acquisition 321

Access Control 322

Analysis 322

Lotus Notes 326

Acquisition 329

Access Control and Logging 330

Analysis 331

Address Book 333

Additional Resources 338

Appendix A Sample Chain of Custody Form 339

Appendix B Master Boot Record Layout 341

Appendix C Partition Types 343

Appendix D FAT32 Boot Sector Layout 349

Appendix E NTFS Boot Sector Layout 353

Appendix F NTFS Metafiles 355

Appendix G Well-Known SIDs 357

Index 363

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)