Incident response and computer forensics / Chris Prosise and Kevin Mandia.

Real-world incidents -- Introduction to the incident response process -- Preparing for incident response -- After detection of an incident -- Live data collection from Windows systems -- Live data collection of Unix systems -- Forensic duplication -- Collecting network-based evidence -- Evidence handling -- Computer system storage fundamentals -- Data analysis techniques -- Investigating Windows systems -- Investigating Unix systems -- Analyzing network traffic -- Investigating hacker tools -- Investigating routers -- Writing computer forensic reports.

"An insider's look at the legal procedural and technical steps of computer forensics and analysis. Contains all-new forensics content and real-world scenarios."--Cover.