Incident Response and Computer Forensics, Second Edition 2nd Edition

by Chris Prosise (Author), Kevin Mandia (Author), Matt Pepe (Author)

35 customer reviews

ISBN-13: 978-0072226966

ISBN-10: 007222696X

Why is ISBN important?

Have one to sell? Sell on Amazon

Share <Embed>

More Buying Choices

8 New from $58.66 43 Used from $0.77

51 used & new from $0.77

See All Buying Options

There is a newer edition of this item:

Incident Response & Computer Forensics, Third Edition

Incident Response & Computer Forensics, Third Edition
$51.80
(18)
In Stock.

Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student

Written by FBI insiders, this updated best-seller offers a look at the legal, procedural, and technical steps of incident response and computer forensics. Including new chapters on forensic analysis and remediation, and real-world case studies, this revealing book shows how to counteract and conquer today’s hack attacks.

Incident Response and Computer Forensics, Second Edition

Available from these sellers.

Customers Who Bought This Item Also Bought

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Carl Endorf

4

Paperback
Don Murdoch GSE

93

Paperback
$14.49
Richard Bejtlich

41

Paperback
$37.77
Jason T. Luttgens

18

Paperback
$51.80
Lev Virine

10

Paperback
$44.10
Harvard Business…

76

Paperback
$14.00

Customers Viewing This Page May Be Interested In These Sponsored Links

(What's this?)

Editorial Reviews

Amazon.com Review

A strong system of defenses will save your systems from falling victim to published and otherwise uninventive attacks, but even the most heavily defended system can be cracked under the right conditions. Incident Response aims to teach you how to determine when an attack has occurred or is underway--they're often hard to spot--and show you what to do about it. Authors Kevin Mandia and Chris Prosise favor a tools- and procedures-centric approach to the subject, thereby distinguishing this book from others that catalog particular attacks and methods for dealing with each one. The approach is more generic, and therefore better suited to dealing with newly emerging attack techniques.

Anti-attack procedures are presented with the goal of identifying, apprehending, and successfully prosecuting attackers. The advice on carefully preserving volatile information, such as the list of processes active at the time of an attack, is easy to follow. The book is quick to endorse tools, the functionalities of which are described so as to inspire creative applications. Information on bad-guy behavior is top quality as well, giving readers knowledge of how to interpret logs and other observed phenomena. Mandia and Prosise don't--and can't--offer a foolproof guide to catching crackers in the act, but they do offer a great "best practices" guide to active surveillance. --David Wall

Topics covered: Monitoring computer systems for evidence of malicious activity, and reacting to such activity when it's detected. With coverage of Windows and Unix systems as well as non-platform-specific resources like Web services and routers, the book covers the fundamentals of incident response, processes for gathering evidence of an attack, and tools for making forensic work easier. --This text refers to the Digital edition.

Review

"... poorly trained network administrators and the lack of firewalls and intrustion detection systems still make it difficult to find the source and strategy of the attack." Computerworld article (8/21/00) on Incident Response featuring David Dittrich, a researcher who spoke at the Usenix Security Symposium." --This text refers to the Digital edition.

See all Editorial Reviews

NO_CONTENT_IN_FEATURE

Product Details

Paperback: 507 pages
Publisher: McGraw-Hill/Osborne; 2 edition (July 17, 2003)
Language: English
ISBN-10: 007222696X
ISBN-13: 978-0072226966
Product Dimensions: 7.5 x 1 x 9.2 inches
Shipping Weight: 2 pounds
Average Customer Review: 4.0 out of 5 stars See all reviews (35 customer reviews)
Amazon Best Sellers Rank: #703,181 in Books (See Top 100 in Books)
- #407 in Books > Computers & Technology > Security & Encryption > Privacy & Online Safety
- #704 in Books > Law > Criminal Law > Criminal Procedure
- #884 in Books > Textbooks > Computer Science > Networking

Customers Viewing This Page May Be Interested In These Sponsored Links

(What's this?)

Customer Reviews

4.0 out of 5 stars

5 star		69%
4 star		11%
3 star		11%
2 star		9%
1 star		0%

Write a customer review

See all verified purchase reviews

Top Customer Reviews

ByMarco De Vivoon May 19, 2002

Format: PaperbackVerified Purchase

There are several good books related to the forensic area.
However, only this book, covers multiple platforms scenarios: Windows, UNIX and Nonplatform-specific technologies are thoroughly discussed. As a bonus, some ORIGINAL attacks (not found elsewhere) are explained and documented (e.g., 'Stateless TCP Covert Channels').
You can try this book whichever is your level in this area.
The main themes are covered both, in introductory chapters, and in more advanced ones.
If you are looking for advice about specific tools, or 'response toolkits'. . . again this is your book, hundreds of references, and several 'typical toolkits' are included.
Chapter 16, 'Investigating Hacker Tools' is a winner discussing the issue of how files are compiled (and the related analysis techniques).
Chapters 13 (Investigating Routers), 14 (Investigating Web Attacks), and 15 (Investigating Application Servers), are extremely useful, and really help to make unique this book.
I own two copies, one to be used at home, and one as a reference for my students. It is a very worthy book, and at the Amazon price, it is a real bargain.

0Comment 5 people found this helpful. Was this review helpful to you?YesNo

ByGabe Maxwellon July 14, 2016

Format: PaperbackVerified Purchase

Decent

0CommentWas this review helpful to you?YesNo

ByChykitytaon October 5, 2015

Format: PaperbackVerified Purchase

This item arrived "as described".

0CommentWas this review helpful to you?YesNo

ByTeeTwoon October 27, 2012

Format: PaperbackVerified Purchase

This is a required text for a class I am taking. It is pretty outdated, but the foundation knowledge is good for someone that can apply the thoughts behind it to current technology.

0CommentWas this review helpful to you?YesNo

For once somebody understands forensics

ByG. Mitchellon December 6, 2001

Format: PaperbackVerified Purchase

The rule about pulling the plug to preserve the evidence is history. The authors explain the importance of getting a snapshot of system dynamics. For example, who is logged in to the machine, what ports are open, what is going on.
Real world information is provided. Any security professional or forensic investigator who hasn't read this book is out of date

0Comment One person found this helpful. Was this review helpful to you?YesNo

Copyright 2003--This book is ancient!

Bycdmon February 4, 2010

Format: PaperbackVerified Purchase

Amazingly enough this book still has some value--human processes don't change that much. Their incident response examples seem charmingly innocent--like being called to assist a company with a single exchange server or setting a threshold of 5 affected machines. But,unless you're just nostalgic you probably want to stay away.

How big a machine do you need to run your tools on? Their specification for a forensics workstation calls for a "High end processor" with "A minimum of 256MB of RAM". (Yes, that's *megabytes* and I'm sure it was a screamer in its day.) And they keep talking about these things called "floppies"... Furthermore, I'm pretty sure their 7 year old tools are going to be pretty hit or miss in terms of their value and I'm guessing that the 7 year old links to web resources are going to be a little spotty.

Memo to self--check copyright dates next time.

33 comments 2 people found this helpful. Was this review helpful to you?YesNo

You must buy...

ByDinoon January 16, 2007

Format: PaperbackVerified Purchase

You must buy if you are beginner, intermedium or advanced in forensic computers.

0CommentWas this review helpful to you?YesNo

Once good, and still is, but getting too old.

ByFinn B. Kjelstrupon March 7, 2012

Format: Paperback

This book is in my opinion good.

But it's written at a time when the new hot stuff was Windows 2000 and 200Gig drives the largest you could get.

So the links to many of the web pages are frequently not relevant any more, and there exist newer tools that the book don't mention. So you have to update yourself using google and wikipedia with regards to the links and tools.

But I assume and think that the methodology and the things to be aware of and check are still relevant to a 80 to 90 % degree.

And I haven't found a better book (more up to date).

This book would have received 4.5 stars from me if it had been up to date. But it's not, and in this area such a book need to be updated once a year.

I do recommend the book though.

0Comment One person found this helpful. Was this review helpful to you?YesNo

Most Recent Customer Reviews

Still Relevant and an Excellent book

Must have been 5 years ago or so when I first bought this book. I have been using it ever since. This is not a Forensics book, but it is a nice marketing ploy to add it into the...Read more

Published on June 22, 2009 by Viken Derderian

Ok book but File System Forensic is better

I liked this book, but it is scattered in its topics. A lot of the information can be found online, and the tools aren't what we use on a daily basis.Read more

Published on May 24, 2006 by Rob DePena, CCSE

Best incidence reponse book out

This is no doubt the best incidence reponse book out. I highly recommend this for anyone either in the field, learning to get into the field, or running a small to medium sized...Read more

Published on March 3, 2005 by David Trube

Excellent basic reference

I read the book in about three days and found it to be a good primer for one leaning towards computer forensics.Read more

Published on May 14, 2004 by Brian Saloum

The Very Best Computer Forensics Primer Out There (1/04)

As an attorney and a formally-trained computer forensics examiner and instructor who has been tilling the fields of digital evidence for some time, I'm always on the prowl for the...Read more

Published on January 21, 2004 by Craig Ball

The book gives a decent overview on the field, but lacks technical accuracy. The authors fumble on technical details.Read more

Published on November 28, 2003 by Leroy Galager

This is a great book.
I think it is the best incident response book available.
These guys really know their stuff and the book has a ton of good information.Read more

Published on November 20, 2003 by Eric Kent

Customers Who Viewed This Item Also Viewed

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Jason T. Luttgens

18

Paperback
$51.80
Don Murdoch GSE

93

Paperback
$14.49
Warren G. Kruse II

24

Paperback
$46.74
Carl Endorf

4

Paperback
Lev Virine

10

Paperback
$44.10
John Sammons

45

Paperback
$21.24

Conditions of Use
Privacy Notice
Interest-Based Ads
© 1996-2017, Amazon.com, Inc. or its affiliates