Foundation -- Empty cup mind -- Anti-forensics overview -- Hardware briefing -- System software briefing -- Tools of the trade -- Life in kernel space -- Post-mortem -- Defeating disk analysis -- Foiling executable analysis -- Live response -- Defeating live response -- Shellcode -- Modifying call tables -- Modifying code -- Modifying objects kernel -- Covert channels -- Going out-of-band -- Summation -- The tao of rootkits -- Epilogue