Chapter 4. Acquiring Host-Based Evidence

Host systems are far too often the target of malicious actions. They represent a possible initial target to gain a foothold in the network, pivot point, or the goal of threat actors. As a result, incident response analyst should be prepared to investigate these systems. Modern operating systems such as Microsoft Windows makes a number of changes during the execution of an application, changes to files, or the addition of user accounts. All of these changes leave traces of activity that can be evaluated by incident response analysts. Compounding the amount of data available to incident response analysis is the increasing storage and memory available in even the lowest-cost consumer systems. Commonly available systems are routinely manufactured with extensive memory and storage in terabytes; there is a great deal of data that could assist incident responders with determining a root cause analysis. As a result, incident response analysts should be prepared...