"This is highly detailed material. Although the introductory chapter adopts an easy pace, with overviews of important technical concepts, most of the other chapters get right down to the practice of forensic analysis. This is not a book you're going to want to read in bed: you'll want this right next to a computer - preferably two or three computers running different operating systems - so that you can try the techniques for yourself as you work your way through. The authors admit that this book does not cover everything you need to know. For instance, it focuses entirely on 'dead drive' forensics - offline systems. Analysing running systems often requires high-level proprietary tools. But it does give an excellent grounding in the methods of digital forensic analysis and provides a valuable first step in learning the technicalities."--Network Security, May 2012, page 4
"Digital Forensics - MacGyver Style! The practical solutions of this book, Digital Forensics with Open Source Tools, save the day when commercial tools fail. During an incident, the clock ticks. Response teams scramble to pull anything together to solve the immediate challenge. Cory Altheide and Harlan Carvey take you through the tools and tactics that you need - the ones that in a pinch will get the job done. A welcome addition to my library."--Rob Lee, SANS Institute
"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools."--Reference and Research Book News
"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools. Chapter examples assume a basic knowledge of the Linux command line interface."--Reference and Research Book News
"The authors intended this book for two types of readers: complete novices in the world of digital forensics, and seasoned practitioners who are interested in learning more about open source tools that could help them in their work. And although it might seem difficult to merge the knowledge in such a way to make for an interesting book for both groups, in my opinion, the writers managed to do it beautifully."--Net-Security.org
No dongle? No problem, says it all! Authors, Cory Altheide and Harlan Carvey, deliver a superb, field guide for digital forensic practitioners. This book is not a textbook on how to perform digital forensics, but a guide for the veteran or new forensic examiner to reference, to extend his/her analysis capabilities with open source tools. The authors bring their years of real world experience at practicing digital forensics, into a single publication.
Digital Forensics With Open Source Tools (DFWOST) begins by defining "free" vs. "open" and the digital forensic process, as well as the benefits of using open source tools. DFWOST quickly moves into setting up the examination workstation, that the examiner/analyst will use to perform the digital forensic examination; regardless, of the host operating system of your forensic machine.
While the book is not a textbook on how to perform a digital forensic examination, it does outline basic digital forensic concepts and terminology that the forensic examiner must comprehend to utilize the open source framework that the book mainly focuses upon, The Sleuth Kit.
From here, the book goes into depth with Windows, Linux, and Mac OS X operating systems and how to use open source tools to identify, parse, and "forensicate" the various system artifacts.
The book's final chapter focuses on automating forensic analysis and extending capabilities with open source tools Finally, the appendix is full of free, non-open source tools that you should become familiar with and integrate into your digital forensic toolkit. Remember, there are many ways to skin a cat! [Disclaimer: no kitteh's were harmed in compiling this book review :)]
Here's why I am giving this book a five star review:
1) Altheide and Carvey walk the reader through compiling a forensic examination workstation to utilize for a digital forensic investigation. It's full of tips, command line refreshers, and best practices delivered from experienced digital forensic professionals with perfect symmetry (i.e., "It is best to complete Y, to avoid Z").
2) In regards to symmetry, Altheide and Carvey do an awesome job of describing The Sleuth Kit Tools, breaking down the common TSK prefixes and each layer of TSK tools, which for new examiners can be task within itself. If you are new to TSK, DFWOST is the perfect companion.
3) Altheide and Carvey eliminate the barrier of just having OS specific forensic tools. Linux and Mac OS X users can now play in their own sandbox, using their own toys (Of course, Linux and Mac users knew this all along).
4) Chapter 8 on File Analysis is the longest chapter (41 pages in length), covering analysis of image files, audio and video files, archive files, and documents. This chapter breaks down a file's content and metadata. DFWOST puts file analysis into a practical and digestible format, that a new examiner should be able to apply immediately to a forensic investigation.
5) The book's length, based on the subject matter is spot on and not too cumbersome (255 pages including Appendix on Free, Non Open Tools). Just as Carvey done with Windows Registry Forensics (WRF), Digital Forensics With Open Source Tools (DFWOST) takes a sniper approach on the subject matter. Depending on what type of reader you are, you may knock it out in a single reading session; or, it may take several reading sessions, which will allow you to follow along, complete the examples, and exercises outlined in the book.
6) Lastly, the DFWOST print version that I purchased is signed by both authors. I was able to catch both authors at the Open Source Digital Forensics Conference last week in NoVa. Thank you gentlemen!
The book's content, length, and practical application make it a necessity for the digital forensic examiner's toolkit! Now, go forth and 'forensicate', DFWOST-style!
With more forensic books hitting the shelves, I find myself prioritizing those by authors I know and trust. I have worked with Cory Altheide and he is an extremely talented forensic professional with a passion for open source tools. Not surprisingly, I would not categorize this as a beginner book. Open source tools require a higher level of interaction than their commercial counterparts, but are a great way to take your forensic skills to the next level. While teaching, I often see students frustrated that there is no one tool that can do it all. Such a tool does not exist, no matter how much you are able to pay for it. Free and open source tools fill large gaps in the capabilities of commercial forensic suites and will continue to do so in the foreseeable future.
The book begins with an excellent section on setting up your forensic workstation, using either Linux or Windows as a host. I was immediately impressed with how succinctly the authors were able to cover this topic. File system analysis is broken into three chapters covering Linux, Windows, and OS X. It is rare to find more than one of these operating systems covered, and references to all three continue throughout the rest of the book. This breadth does come at a cost; a fair amount of system knowledge is assumed. As an example, NTFS is covered in six pages and readers are assumed to have prior knowledge of concepts like NTFS attributes and resident versus non-resident files. Without a doubt, Digital Forensics with Open Source Tools (DFWOST) runs at a blistering pace. This is a boon for more advanced practitioners who do not want to rehash old concepts. However, there were several instances when "newer" artifacts like the Linux Logical Volume Manager (LVM) were discussed that I found myself wanting more. In other sections I found some of the best topic coverage in print. The discussion of image metadata in Chapter 8 is particularly comprehensive.
Of course the coverage of open source tools is why many will buy this book. In this regard it does not disappoint. I was pleased to find nearly all of my favorite tools covered along with many new ones. I found myself dog-earing pages to return back to when time permits. Harlan Carvey's touch was evident in the coverage of Windows based tools. Tools are covered in conjunction with their related forensic artifacts, reinforcing key concepts and underscoring tool relevance. While coverage is ample, tools are not discussed exhaustively. Readers will need to work with the tools themselves to fully understand their capabilities - an approach which I agree with.
Overall, I found DFWOST to be a tremendous asset in an area with few published resources. If you are looking to push your forensic skills forward, I highly recommend this book.
Product Details :
Paperback: 288 pages
Publisher: Syngress; 1 edition (April 28, 2011)
Language: English
ISBN-10: 1597495867
ISBN-13: 978-1597495868
Product Dimensions: 7.5 x 0.6 x 9.2 inches
More Details about Digital Forensics with Open Source Tools 1st edition
or
Download Digital Forensics with Open Source Tools 1st edition PDF Ebook
No comments:
Post a Comment