Incident response & computer forensics [electronic resource] / Chris Prosise, Kevin Mandia.

Real-world incidents
Introduction to the incident response process
Preparing for incident response
After detection of an incident
Live Data Collection from Windows systems
Live data collection from Unix systems
Forensic duplication
Collecting network-based evidence
Evidence handling
Computer system storage fundamentals
Data analysis techniques
Investigating Windows systems
Investigating Unix systems
Analyzing network traffic
Investigating hacker tools
Investigating routers
Writing computer forensic reports
Appendixes.