Just as regular police forensics focus on the information available at a crime scene, computer forensics looks at evidence that can be gleaned in the aftermath of a computer security incident. Two computer security professionals provide a methodology for collecting information that can lead to a perpetrator and prove useful in prosecutions. Chapters cover encryption, data hiding, hostile code, and introductions to forensics on Windows and Unix operating systems.