Windows forensics and incident recovery - Carvey, Harlan A. (Addison-Wesley, 2005)
Provides a 'command-line centric' view of Microsoft and non-Microsoft tools that can be very helpful to folks responsible for security and system administration on the Windows platform. This book focuses on forensics and incident recovery in a Windows environment. It teaches through case studies and real world-examples.