Digital Forensics with Open Source Tools

As Cory and Harlan state in the introduction, this book is intended for two audiences; new forensic practitioners and experienced digital forensics practitioners new to open source tools. I believe they have succeeded in providing top-notch material for both audiences. Several excellent five star reviews have already been posted, which I agree with wholeheartedly. In order to avoid simply rehashing these existing reviews, I would like to simply state that I believe Cory and Harlan did two things very well with DFWOST:1. As Cory and Harlan state in the introduction to Chapter 2, "Being able to build software properly is critical for an examiner using open source tools". Speaking as a seasoned examiner that consistently leverages the majority of the tools in DFWOST, we sometimes forget that the configuration of various interpreters (Perl, Python, Ruby) and the proper installation of tools from source are a difficult task for those new to open source tools. This technical hurdle often inhibits the adoption of open source utilities by even senior analysts. I believe Cory and Harlan had this hurdle in mind when authoring DFWOST, as they provide their readers with valuable information regarding these tasks. Chapter 2 does an excellent job of stepping the reader through the installation of various interpreters and utilities for both the Linux and Windows environments. Before I read DFWOST, I was curious if Cory and Harlan would leverage an available Linux-based live distro and bypass the topic of installation and configuration of an examination system all together. I was happy to see they they did not take this route, as dependency on a live distro can simply add a layer of abstraction for a new student.2. Instead of bloating DFWOST with content that has been covered in depth in existing publications, Cory and Harlan opt to simply direct readers to these resources. Given both the author's resumes (and previous publications), they could of easily supplied this information in DFWOST to unnecessarily bulk this book up. For instance, when the topic of advanced Windows Registry analysis is mentioned, the reader is directed to Harlan's Windows Registry Forensics. This may be construed as self-serving, but the same is done when the topic of Windows binary (PE) analysis is entered. In this case, the reader is directed towards Malware Analyst's Cookbook by Ligh, Adiar, Hartstein, and Richard. In my opinion, both these publications are the definitive sources for their perspective topics. It is refreshing to see the authors direct their readers to the appropriate place, instead of diving into a topic that probably doesn't have the appropriate real estate dedicated for discussion in the first place.As with any material these two authors provide to the community, DFWOST should be required reading for any examiner - not just open source hobbyists and newbies. I hope we see another great publication from both Cory and Harlan in the near future. They make a good team.

First let me start off by saying that the Amazon packaging was terrible and likely the reason the book looked 'used' instead of new when I received it. In order to get better packaging you might want to order this book with other books.-----The author does not make the assumption that everyone reading the book will be familiar with what Open Source Software is and goes in to a little bit of detail on the subject. As a FOSS advocate I was appreciative of the effort put in to educate others on this subject.Chapter 2:This chapter is about getting your forensic computer setup with FOSS tools and applications. It covers setups on Linux and Windows, but with a preference towards Ubuntu (Linux) as this is what the author used and what the examples are done with.Chapter 3:Covers the basics of how to analyze disks. This includes covering ram slack, file slack, file systems specifics, carving and hashing. It is important to know how to handle evidence if will be needed in a court room. Failure to use hashes and load a disk as read only will likely result in evidence being questioned and potentially thrown out.Chapter 4:Covers Windows specific file systems artifactsChapter 5:Covers Linux specific file systems artifactsChapter 6:Covers OS specific file system artifactsChapter 7:Covers browser artifacts for IE, Firefox, Chrome and Safari. It also covers email artifacts. I was particularly interested by the Chrome and Safari artifacts.Chapter 8:Deals with file analysis covering media files, documents and others. It was interesting to note that there does not appear to be any ability for Open Source tools to leverage known hashes to identify files known to law enforcement.Chapter 9:Automating the process -- trust me you do not want to have to do everything by hand.Chapter 10:Covered free, but not open source tools that are available.Overall I found the book to have a solid mix of theory and tool use examples. It also included links to forensic images you can use to experiment with the tools. I already played with many of these images with proprietary tools a while back and look forward to exploring how open source tools work with them as well.Solid book diminished only by the inept packaging Amazon utilized. If the book were not so good I would be returning the book.

Albeit the overwhelming positive reviews, I do not consider this book good.Through this book I can see the wideness of the knowledge of the authors, however, this book covers just too much aspects, which makes each topic unacceptably shallow. After reading this book, without reading tens of books that explicitly or implicitly referenced inside, you will feel yourself knows many things, but in fact for most things you can do nothing but name them. It does not help much if you want to really learn something deep.Also, the authors writing style is kind loose. Just as I randomly scanning this book, look this paragraph "Microsoft states that the FAT32 file system can support disk up to 2Tb, but that Windows 2000 only supports partitions up to 32 GB. Using 4KB cluster, FAT32 users space more effciently; cluster size can range from 512 to 32 KB. The primary different between FAT16 and FAT32 is the logical partition size." I don't consider this a good scientific writing. From this paragraph, what would you learn, except some mere thin facts? I don't know why W2000 only support 32GB. I do not understand why using 4KB is "more efficient", and I do not know what is the difference in "partition size" between FAT16 and FAT32.I feel this book is kind of fits in the "for dummy" series. It does provide a variety of information, but each aspect are so simple that you can't really learn something deeper. And for me, memorizing based on understanding, and thus there will very little reside in your brain after you reading this book.

I found this text book to be a good general grounding for a forensic sciences degree, very good for first year students to grasp the basics of the subject.

Very good

Es un libro bueno para tener una referencia rápida de la práctica forense digital en diferentes sistemas, usando herramientas open source.Como material introducitorio está bien, porque presenta también de una forma bastante simplificada la estructura de los principales sistemas de archivos de Windows, Linux y de Mac y algunos de los rastros y ficheros clave que debes investigar. Sin embargo, como es un libro que aborda muchas áreas, no esperes una gran profundidad en los temas tratados y debes complementarlo con material específico.Por otra parte, no habla nada de la recogida de evidencias en caliente en equipos vivos, el análisis dinámico, etc.

Finalmente uno dei pochi libri (a mio modesto parere) ad oggi consultati, che mostrano effettivamente i principali comandi utlizzati in ambito forense e su sistemi open source per l'analisi e l'estrazioni di informazioni preziose da vari supporti di archiviazione.Consiglio l'acquisto a chi volesse approcciarsi a questo mondo che, spesso e volentieri, è immenso e di difficile comprensione.Unica pecca a sfavore è che purtroppo non esiste, attualmente, una versione in lingua italiana