Executing Windows Command Line Investigations

Utilizing Window Command Line Interface (CLI) during forensic triage and incident response can provide immediate evidence and actionable intelligence. The CLI enables responders to leverage a myriad of tools and technologies while they collect evidence that is used throughout their investigation. Unfortunately, in many cases, investigators lack specific knowledge, detailed processes, and specialized tools to effectively perform these operations and to ensure that evidence collected during this interactive triage process meets best practices in relation to documentation, evidentiary handling, chain of custody, integrity validation, and non-repudiation. " Executing Windows Command Line Investigations "targets cyber security practitioners that focus on digital forensics and incident response. These are the individuals that are ultimately responsible for executing critical tasks such as incident response; forensic analysis and triage; damage assessments; espionage or other criminal investigations; malware analysis; and responding to human resource violations. Author Chet Hosmer leads readers through the importance of Windows CLI, as well as optimal configuration and usage. Readers will then learn how to use the proprietary software that accompanies the book as a download from the companion website. This software, called Proactive Incident Response Command Shell (PIRCS), has been developed by Exelis, Inc. under direct funding from the U.S. Department of Homeland Security and administered by the U.S. Air Force Research Laboratory. PIRCS is a CLI tool that automates evidentiary chain of custody and reduces human error and documentation gaps during incident response. The only book that exclusively focuses on using Windows Command Line Interface in incident response and forensics. Includes free download of Proactive Incident Response Command Shell (PIRCS) software, which automates evidentiary chain of custody and reduces human error and documentation gaps during incident response Learn about the technical details of Windows CLI so you can directly manage every aspect of incident response, while maintaining evidentiary integrity. "