Executing Windows Command Line Investigations: While Ensuring Evidentiary Integrity

The book Executing Windows Command Line Investigations targets the needs of cyber security practitioners who focus on digital forensics and incident response. These are the individuals who are ultimately responsible for executing critical tasks such as incident response; forensic analysis and triage; damage assessments; espionage or other criminal investigations; malware analysis; and responding to human resource violations.

The authors lead readers through the importance of Windows CLI, as well as optimal configuration and usage. Readers will then learn the importance of maintaining evidentiary integrity, evidence volatility, and gain appropriate insight into methodologies that limit the potential of inadvertently destroying or otherwise altering evidence. Next, readers will be given an overview on how to use the proprietary software that accompanies the book as a download from the companion website. This software, called Proactive Incident Response Command Shell (PIRCS), developed by Harris Corporation provides an interface similar to that of a Windows CLI that automates evidentiary chain of custody and reduces human error and documentation gaps during incident response.

• Includes a free download of the Proactive Incident Response Command Shell (PIRCS) software
• Learn about the technical details of Windows CLI so you can directly manage every aspect of incident response evidence acquisition and triage, while maintaining evidentiary integrity

Chet Hosmer is a retired Assistant Professor of Practice at the University of Arizona and now serves as a Designated Campus Colleague. He previously taught in the Cybersecurity Graduate Program at Utica College and is the founder of Python Forensics, a nonprofit research and educational institution dedicated to advancing investigative capabilities through innovative research and specialized Python tools.

A recognized authority on emerging cyber threats, Chet has been featured by NPR, ABC News, Forbes, IEEE, The New York Times, The Washington Post, Government Computer News, Salon, and Wired. He is the author of seven books published by Elsevier and Apress covering passive cyber defense for OT environments, Python and PowerShell for investigators, data hiding and steganography, and IoT security. He has also delivered Congressional testimony before the House Science Committee on cybersecurity education.

Joshua Bartolomie (CISSP, CRISC, DFCP, CEECS, CFCE) has 20 years of technical and management experience within the information technology and cyber security domains. Joshua has contributed to and managed programs that range from teaching digital forensics to designing, implementing, and managing cutting edge Security Operations Centers and Incident Response Teams. Mr. Bartolomie is an active participant in multiple information sharing and collaborative consortiums and has presented at numerous cyber security forums, conferences, and venues.

In his current role, Joshua is responsible for translating corporate business strategies, environmental conditions, infrastructure requirements, and industry best practices into strategic cyber security designs and architectural roadmaps. Joshua holds a Master’s Degree in Information Assurance from Norwich University and a Bachelor’s of Science in Digital and Computer Forensics from Champlain College.

Ms. Rosanne Pelli, is a certified Project Management Professional (PMP) through the Project Management Institute (PMI) and CompTIA Security+ professional with Harris Corporation. She has over ten years of experience in the coordination, programmatic oversight and management of US government contracts as well as Harris’ Secure-U Training Program. During her years of experience, Ms. Pelli has assisted in the management and coordination of various government contracts that focused on the identification and analysis of emerging cyber threats; evaluation and transition of cyber security technologies for tactical use by the cyber security community; technical assistance to federal, state and local law enforcement communities; development and maintenance of a virtual cyber security training portal; and the development, coordination and execution of various national and international cyber security training initiatives.