Corrections
This page will list all corrections for errors in the print of IR3E
Chapter One
- None
Chapter Two
- p.24, Under “What is a computer security incident?”, in the second paragraph, the sixth sentence starts with “The third characteristic”. That should be “The second characteristic”. (Thanks to Jeremy Hosbein)
Chapter Three
- None
Chapter Four
- None
Chapter Five
- None
Chapter Six
- None
Chapter Seven
- None
Chapter Eight
- None
Chapter Nine
- p.185, Go Get It On The Web: “Sourcefile: ” should read “Sourcefire: “. (Now listed in the correct chapter section on this page, thanks to Ivan Alvarado)
- p.195, 2nd paragraph from the bottom, second sentence: “a system to perform network su1rveillance” should read “a system to perform network surveillance“. (Thanks to Chris Mayhew)
- p.220, Last sentence on the page: “particularly important during and indent” should read “particularly important during an incident“. (Thanks to Tad Schlatre)
Chapter Ten
- p.238, The second sentence under the “WEB SERVERS” heading: “deliver most of the Internet’s contact” should read “deliver most of the Internet’s content“. (Thanks to Chris Mayhew)
Chapter Eleven
- p.255, In the Field, sentence four: “It nearly all cases, it will be difficult, if not impossible.” should read “In nearly all cases, it will be difficult, if not impossible.”
Chapter Twelve
- p.277, In the “Note”, second sentence: “key and value HKLM\CurrentControlSet\…” should read “key and value HKLM\SYSTEM\CurrentControlSet\…”. (Thanks to Ely Petty)
- p.299, Last bullet item on the page, first sentence: “logon type 3 recorded on beta” should read “logon type 3 recorded on gamma“. (Thanks to Pasquale Stirparo)
- p.300, First sentence on the page, continued from bullet item on the previous page: “and the target system beta.” should read “and the target system gamma.” (Thanks to Pasquale Stirparo)
- p.322, The Shim Cache Windows XP location: “HKLM\CurrentControlSet\…” should read “HKLM\SYSTEM\CurrentControlSet\…”. (Thanks to Ely Petty)
- p.325, First sentence in the paragraph after the “Note”: “values and subkeys under HKLM\CurrentControlSet\…” should read “values and subkeys HKLM\SYSTEM\CurrentControlSet\…”. (Thanks to Ely Petty)
- p.326, The sentence just prior to Figure 12-15: “HKLM\CurrentControlSet\…” should read “HKLM\SYSTEM\CurrentControlSet\…”. (Thanks to Ely Petty)
- p.350, In “The Evidence” section, the operating system names are swapped. The first two locations are for Windows XP and 2000, and the second two are for Windows Vista, 7, and 2008.
Chapter Thirteen
- None
Chapter Fourteen
- None
Chapter Fifteen
- None
Chapter Sixteen
- None
Chapter Seventeen
- None
Chapter Eighteen
- None