No abstract

This chapter presents a very current theme that has received substantial attention from both academic and industrial communities: the computer forensics. The scientific and systematic inspection of computational environments, with the goal of figuring out and reconstruct events, still has lot of open research topics. On industry, the interest on this subject is supported by an increasing amount of criminal investigations having digital data as its main evidences. In this chapter, we present basic notions of computer forensics and tools that can be used to collect, keep and analyze evidences. The anatomy of some malicious codes and case studies are also used as a complement on the subject and as a way of increasing its comprehension.