“Windows Forensics and Incident Recovery” includes tools for analysis and shows readers how to use them. Harlan Carvey offers a start-to-finish guide to the subject: everything administrators must know to recognize and respond to virtually any attack. Carvey uses real-world examples to cover every significant incident response, recovery, and forensics technique. This book’s tools and techniques apply to every current and professional version of Windows: NT, 2000, XP, and Windows Server 2003. Coverage includes: Preparing your systems to prevent and detect incidents;Analyzing live forensics data to determine what occurred.”]
Source: https://www.amazon.co.uk/exec/obidos/ASIN/0321200985/helpnetsecuri-21