第四章计算机证据-helixSysinternal.pptVIP

Helix传统取证工具 Helix operates in two different modes – Windows and Linux. Helix is a forensically sound bootable Linux environment much like Knoppix, but a whole lot more. The “other side” of Helix, a Microsoft Windows executable feature, contains approximately 90 MB of incident response tools for Windows. Windows工具 Windows工具 Windows工具 Windows工具 Windows工具 Windows工具 Windows工具 Windows工具 Windows工具 WFT工具：综合取证 WFT工具：综合取证 WFT工具：综合取证 WFT工具：综合取证 Windows工具 Windows工具 Malware Hunting with the Sysinternals Tools This session provides an overview of several Sysinternals tools, including Process Monitor, Pr