Cover -- Contents -- Preface -- Chapter 1: Live Response: Collecting Volatile Data -- Introduction -- Live Response -- What Data to Collect -- Nonvolatile Information -- Live-Response Methodologies -- Chapter 2: Live Response: Data Analysis -- Introduction -- Data Analysis -- Chapter 3: Windows Memory Analysis -- Introduction -- Dumping Physical Memory -- Analyzing a Physical Memory Dump -- Collecting Process Memory -- Chapter 4: Registry Analysis -- Introduction -- Inside the Registry -- Registry Analysis -- Chapter 5: File Analysis -- Introduction -- Event Logs -- File Metadata -- Alternative Methods of Analysis -- Chapter 6: Executable File Analysis -- Introduction -- Static Analysis -- Dynamic Analysis -- Chapter 7: Rootkits and Rootkit Detection -- Introduction -- Rootkits -- Rootkit Detection -- Index.