Windows forensic analysis toolkit : advanced analysis techniques for Windows 8 / created by Harlan Carvey.

Includes index.

Preface -- Acknowledgments -- About the Author -- About the technicla Editor -- Analysis Concepts -- Incident preparation -- Volume Shadow Copies -- File Analysis -- Registry Analysis -- Malware Detection -- Timeline Analysis -- Correlating artifacts -- Reporting -- Index.

When I sat down to update the material for this edition, I wanted to not only include new information that I'd found or developed since the third edition was published, but I also wanted to try to include as much information as possible regarding Windows 8 and 8.1. With Windows 8.1 becoming available while I was updating the book, the inevitable questions were being asked, and invariably it won't be long before we start seeing the systems appear on analyst's workbenches. As such, I've tried to provide as much information as I could with respect to newer versions of Windows (i.e., 8 and 8.1), either by writing it directly into the book or linking to the sources of information on the Internet, when attempting to summarize it would simply not do the content justice. Keep in mind, however, that new information is being discovered and developed all the time, and at some point, I needed to stop writing and submit the book for final review and publishing. I'm sure that even more information will become available during the time between when the book goes to the printer, and when it actually comes out on the shelves at bookstores.