COVID-19 Update: We are currently shipping orders daily. However, due to transit disruptions in some geographies, deliveries may be delayed. To provide all customers with timely access to content, we are offering 50% off Science and Technology Print & eBook bundle options. Terms & conditions.
Windows Forensic Analysis Toolkit - 3rd Edition - ISBN: 9781597497275, 9781597497282

Windows Forensic Analysis Toolkit

3rd Edition

Advanced Analysis Techniques for Windows 7

Author: Harlan Carvey
Paperback ISBN: 9781597497275
eBook ISBN: 9781597497282
Imprint: Syngress
Published Date: 27th January 2012
Page Count: 296
Sales tax will be calculated at check-out Price includes VAT/GST
Price includes VAT/GST

Institutional Subscription

Secure Checkout

Personal information is secured with SSL technology.

Free Shipping

Free global shipping
No minimum order.


Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 7 provides an overview of live and postmortem response collection and analysis methodologies for Windows 7. It considers the core investigative and analysis concepts that are critical to the work of professionals within the digital forensic analysis community, as well as the need for immediate response once an incident has been identified. Organized into eight chapters, the book discusses Volume Shadow Copies (VSCs) in the context of digital forensics and explains how analysts can access the wealth of information available in VSCs without interacting with the live system or purchasing expensive solutions. It also describes files and data structures that are new to Windows 7 (or Vista), Windows Registry Forensics, how the presence of malware within an image acquired from a Windows system can be detected, the idea of timeline analysis as applied to digital forensic analysis, and concepts and techniques that are often associated with dynamic malware analysis. Also included are several tools written in the Perl scripting language, accompanied by Windows executables. This book will prove useful to digital forensic analysts, incident responders, law enforcement officers, students, researchers, system administrators, hobbyists, or anyone with an interest in digital forensic analysis of Windows 7 systems.

Key Features

  • Timely 3e of a Syngress digital forensic bestseller
  • Updated to cover Windows 7 systems, the newest Windows version
  • New online companion website houses checklists, cheat sheets, free tools, and demos


Computer forensic and incident response professionals. This includes LE, federal government, commercial/private sector contractors, consultants, etc.

Table of Contents

  • Dedication
  • Preface
  • Acknowledgments
  • About the Author
  • About the Technical Editor
  • Chapter 1. Analysis Concepts
    • Introduction
    • Analysis Concepts
    • Setting up an Analysis System
    • Summary
  • Chapter 2. Immediate Response
    • Introduction
    • Being Prepared to Respond
    • Data Collection
    • Summary
  • Chapter 3. Volume Shadow Copies
    • Introduction
    • What are “Volume Shadow Copies”?
    • Live Systems
    • Acquired Images
    • Summary
  • Chapter 4. File Analysis
    • Introduction
    • MFT
    • Event Logs
    • Recycle Bin
    • Prefetch Files
    • Scheduled Tasks
    • Jump Lists
    • Hibernation Files
    • Application Files
    • Summary
  • Chapter 5. Registry Analysis
    • Introduction
    • Registry Analysis
    • Summary
  • Chapter 6. Malware Detection
    • Introduction
    • Malware Characteristics
    • Detecting Malware
    • Summary
  • Chapter 7. Timeline Analysis
    • Introduction
    • Timelines
    • Creating Timelines
    • Case Study
    • Summary
  • Chapter 8. Application Analysis
    • Introduction
    • Log Files
    • Dynamic Analysis
    • Network Captures
    • Application Memory Analysis
    • Summary
  • Index


No. of pages:
© Syngress 2012
27th January 2012
Paperback ISBN:
eBook ISBN:

About the Author

Harlan Carvey

Mr. Carvey is a digital forensics and incident response analyst with past experience in vulnerability assessments, as well as some limited pen testing. He conducts research into digital forensic analysis of Window systems, identifying and parsing various digital artifacts from those systems, and has developed several innovative tools and investigative processes specific to the digital forensics analysis field. He is the developer of RegRipper, a widely-used tool for Windows Registry parsing and analysis. Mr. Carvey has developed and taught several courses, including Windows Forensics, Registry, and Timeline Analysis.

Affiliations and Expertise

DFIR analyst, presenter, and open-source tool author


"Harlan has done it again! Continuing in the tradition of excellence established by the previous editions, Windows Forensics Analysis Toolkit 3e is an indispensable resource for any forensic examiner. Whether you're a seasoned veteran or just starting out, this work is required reading. WFA3e will maintain a perennial spot on my core reference bookshelf!"--Cory Altheide, Google

"Windows Forensic Analysis Toolkit 3rd Edition provides a wealth of important information for new and old practitioners alike. Not only does it provide a great overview of artifacts of interest on Windows 7 systems, but it also presents plenty of technology independent concepts that play an important role in any investigation. Feel free to place a copy on your shelf next to WFA 2ed and WRF."

"The third edition of this reference for system administrators, digital forensic analysts, students, and law enforcement does not replace the second edition, but rather serves as a companion. Coverage encompasses areas such as immediate response, volume shadow copies, file and registry analysis, malware detection, and application analysis. Learning features include b&w screenshots, tip and warning boxes, code (also available on a website), case studies, and 'war stories' from the field. The tools described throughout the book are written in the Perl scripting language, but readers don't need to be experts in Perl, and most of the scripts are accompanied by Windows executables found online. For this third edition, a companion website provides printable checklists, cheat sheets, custom tools, and demos."--Reference and Research Book News, Inc.

"There is a good reason behind the success of the previous editions of this book, and it has to do with two things: new Windows versions are different enough from previous ones to warrant a new edition and, most importantly, the author is simply that good at explaining things. This edition is no different."--HelpNetSecurity

Ratings and Reviews