Windows Forensic Analysis Toolkit

The fourth edition of this guide by Harlan Carvey extends its coverage to Windows 8. Its main emphasis is on examining Windows 8 systems and the processes running on them, using tools that are free and open source. The book covers live response, file analysis, malware detection, and system timelines, along with a good deal more.

Carvey draws on real-world experience from actual investigations and explains the reasoning behind each technique, not only the steps to carry it out. A companion collection of materials is available online, including printable checklists, cheat sheets, free custom tools, and walk-through demonstrations.

Readers of earlier editions will note that the second edition concentrates on Windows XP and the third on Windows 7. This edition adds much beyond Windows 8 itself: case examples that follow an investigation from start to finish, analysis of USB devices, intrusion and hacking cases, and practical answers drawn from Carvey's own casework and from questions readers have sent him. It also includes an all-new chapter on reporting.