TY  - BOOK
AU  - Steel,Chad
TI  - Windows forensics: the field guide for conducting corporate computer investigations 
SN  - 0470038624 (pbk.)
AV  - HV8079.C65 S84 2006
U1  - 363.25/968 22
PY  - 2006///
CY  - Indianapolis, IN
PB  - Wiley Pub.
KW  - Microsoft Windows (Computer file)
KW  - Security measures
KW  - Computer crimes
KW  - Investigation
KW  - United States
KW  - Methodology
KW  - Computer networks
KW  - Internet
KW  - Computer security
N1  - Includes bibliographical references and index; Windows forensics -- Processing the digital crime scene -- Windows forensics basics -- Partitions and file systems -- Directory structure and special files -- The registry -- Forensic analysis -- Live system analysis -- Forensic duplication -- File system analysis -- Log file analysis -- Internet usage analysis -- Email investigations -- App. A. Sample chain of custody form -- App. B. Master boot record layout -- App. C. Partition types -- App. D. Fat32 boot sector layout -- App. E. NTFS boot sector layout -- App. F. NTFS metafiles -- App. G. Well-known SIDs -- Index
UR  - http://www.loc.gov/catdir/toc/ecip069/2006005530.html
UR  - http://www.loc.gov/catdir/enhancements/fy0741/2006005530-b.html
UR  - http://www.loc.gov/catdir/enhancements/fy0741/2006005530-d.html
ER  -