Windows Internals, Part 1: System Architecture, Processes, Threads, Memory Management, and More
Pavel Yosifovich, Mark E. Russinovich, Alex Ionescu, David A. Solomon · Microsoft Press (Pearson) · Seventh edition · 2017
Identifier: ISBN 978-0-7356-8418-8
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
The reference documentation of how Windows actually works: the object manager, processes and threads, virtual memory, handles, tokens and the security model, described at the level of the kernel structures themselves.
Who it is for, and when
Not a forensics book, but the book that makes memory forensics and malware analysis make sense. When a memory tool reports an EPROCESS, a token, a handle table or an unlinked VAD, this is where you learn what that object is and why its absence or modification is suspicious. Read the chapters your case needs; nobody reads it cover to cover.
What it does not cover
No forensics, no acquisition, no tooling guidance and no case material — it describes the system, not how to examine it. Written against Windows 10 of 2017, so Windows 11-era changes and the later virtualisation-based security features are not here. Check for a newer edition before buying.
Go to the source
Open at microsoftpressstore.com (opens in a new tab)https://www.microsoftpressstore.com/store/windows-internals-part-1-system-architecture-processes-threads-9780735684188
Details
- Type
- Book
- Written for
- AdvancedAdvanced
- Author
- Pavel Yosifovich, Mark E. Russinovich, Alex Ionescu, David A. Solomon
- Publisher
- Microsoft Press (Pearson)
- Version verified
- Seventh edition
- Year
- 2017
- Identifier
- ISBN 978-0-7356-8418-8
- Topics
- windows, memory-forensics, foundations, reverse-engineering
- Checked at source
Related entries
13Cubed
Partly freeA YouTube channel and companion training site covering Windows, Linux and macOS endpoint forensics, memory analysis and threat hunting. The YouTube videos are free; the on-demand courses on training.13cubed.com are paid.
A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and the evidence to work it. Subjects include a breached web server with both disk image and memory dump, Windows user policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, a Sysinternals-abuse malware case, encryption, and anti-forensics and data hiding.
FTK Imager
Partly freeA free Windows imaging and preview tool, originally from AccessData and now distributed by Exterro, which acquired the FTK line. It creates raw, E01, and AD1 images, captures live RAM, previews file systems before acquisition, and produces hash verification reports.
A scripted corporate scenario covering the first four weeks of a fictional patent-search company, from 13 November 2009 to 12 December 2009. It ships daily hard drive images and daily RAM captures for each computer, USB drive images, inbound and outbound packet captures, final-day images of every system, and simulated case paperwork including detective reports, warrants and affidavits.
MemProcFS
FreeAn open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state appear as browsable files and directories rather than plugin output. It ships a Python and C API and a plugin ecosystem.