Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister

Windows Forensics and Incident Recovery

by Milamber (Beadle)
on Sep 03, 2006 at 15:11 UTC ( #570938=bookreview: print w/replies, xml ) Need Help??
Order Windows Forensics and Incident Recovery

Item Description: Using Perl to conduct forensic analysis and incident recovery

Review Synopsis: Learning neat tricks on Windows using Perl

In May 2006, Infoworld produced a series of Hack Tales, describing enterprising IT hacks. My favourite was the hack that described the use of Perl to audit file shares on a 2,000 user network spread across 8 remote sites. A few weeks later, browsing a local bookstore, I stumbled across a book called Windows Forensics and Incident Recovery, by Harlan Carvey.

A quick flick across some pages, and I was headed for a nearby coffee shop to peruse my new purchase. In addition to describing various open source tools throughout the book, the Perl scripts described (and provided on the companion CD), provided an excellent tutorial for using Perl in a number of interesting scenarios, such as extracting metadata from a Microsoft Word document, or detecting local or remote rootkits.

The scripts can be split, merged and rewritten to target different issues as the reader sees fit, providing an excellent resource on doing almost anything on a Windows system using Perl. Throughout the book, you'll learn about manipulating documents, alternate data streams in NTFS, using the registry, auditing user and file permissions, network socket programming and more.

This book is one of those rare gems that goes beyond the scope of its stated purpose and becomes a resource for so much more, making it a worthy addition to any aspiring JAPH's library

  • Comment on Windows Forensics and Incident Recovery
Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: bookreview [id://570938]
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others examining the Monastery: (4)
As of 2023-12-04 02:52 GMT
Find Nodes?
    Voting Booth?
    What's your preferred 'use VERSION' for new CPAN modules in 2023?

    Results (20 votes). Check out past polls.