Brett's Blog

Just some ramblings.

Vote for your favorite book.

Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/.  But of course, only vote if you liked it :)

And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard.  But again, only vote if you liked it :)

And if you didn’t like that book either…give me your phone number.  We need to talk…

484 Hits
0 Comments

Humbled and honored

[caption id="568" align="alignleft" width="150"]4cast Forensic 4cast Awards


I just saw that the book of the year nominees at the Forensic 4cast Awards include both the X-Ways Practitioner's Guide and Placing the Suspect Behind the Keyboard.  For those that made the nominations, that was very kind.  For those that vote for either book, I thank you in advance.

Both books are pretty good.  Each gives plenty of tips and information to save you hours of frustration, and more importantly, close some cases.  There is a sample chapter of Placing the Suspect Behind the Keyboard here: http://searchsecurity.techtarget.com/feature/Placing-the-Suspect-Behind-the-Keyboard  There are reviews at Amazon for both books that may be helpful if you were thinking of getting either book.

If you use X-Ways.....you need the X-Ways Guide, no matter how long you have been using X-Ways.  When I asked Eric to help me write this book, he ran with it and did a super job of helping create an easy to read guide to using a very powerful forensic tool.  I have more than a ton of emails of how the book converted Encase/FTK primary users into XWF primary users.

As for the Placing the Suspect Behind the Keyboard, that has also helped more than a few examiners close a case with a simple (yet elusive) tip, trick, method, or process that saves hours, if not days, of work.  Again, even if you have been doing forensics for a long time, nothing says you can't learn or relearn something you may not know or have forgotten.

Thanks again to everyone.

Brett

 

430 Hits
0 Comments

"Placing the Suspect Behind the Keyboard" discount code

Cool.  Looks like there is a new discount on my book, "Placing the Suspect Behind the Keyboard".  Plus, it also looks like an entire chapter is available for download.

[caption id="1142" align="alignleft" width="266"]discount Cool. A discount. Get it while you can!


PSBKI'm also giving a presentation on this book at NOLACON (New Orleans, Louisiana).
277 Hits
0 Comments

Hey look! Now there is a book on FTK.

FTK http://amzn.to/O38eWh


I previously posted that a book on FTK is sure to come along, since we have the best book of X-Ways and the other book on Encase.  Now comes a book on FTK.  Just like the XWF Guide or the upcoming Encase guide, I wouldn't see any reason for a FTK user to not have a book on FTK.

It makes sense to have "the" book on X-Ways, "the" book on Encase, and "the" book on FTK.  By having books on your major forensic suites, it is easier to compare what suite "A" does compared to tools "B" and "C" as well as how to get from point A to B using each tool.

So....how about that book on ProDiscover?  Anyone?  Grab the opportunity before someone else does.  I promise to buy it, as I have already ordered the FTK and Encase books.

I have brief reviews on my favorite DF books at http://winfe.wordpress.com/books/

--------------------------------------------------------------------------







 



[caption id="attachment_547" align="aligncenter" width="170"]FTK http://amzn.to/O38eWh


[caption id="attachment_549" align="aligncenter" width="169"]encase http://amzn.to/P9XxCl


[caption id="attachment_347" align="aligncenter" width="173"]Xways-Cover http://amzn.to/1gfx0t5
Tags:
372 Hits
0 Comments

Network Investigation & Digital Triage by SEARCH.org




Network Investigation & Digital Triage


Very cool.  SEARCH.org teaches WinFE in its Network Investigation & Digital Triage course.

[caption id="attachment_1108" align="alignleft" width="700"]search http://www.search.org/get-help/training/high-tech-crime-investigations/instructor-led-training/network-investigation-and-digital-triage/




311 Hits
0 Comments

Not X-Ways, but of interest to Encase users

Computer Forensics and Digital Investigation with EnCase Forensic


encase http://amzn.to/1eY02wn


 

I know, this has nothing to do with X-Ways Forensics.  But hey, the X-Ways Practitioner's Guide was first...

Practically, this seems like a good book for Encase users to park on the shelf (while the X-Ways Practitioner's Guide sits on your desk next to your keyboard).

So, when is that book on "FTK" coming out....and who is going to write it?...And if you do want to write it, give Syngress a shout.

Tags:
353 Hits
0 Comments

WinFE (and of course, XWF)

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool, but I spread this word to you because there are few things in life neater than a forensically bootable CD/USB with X-Ways Forensics.

From Hacking Exposed: Adding the WinFE Image to the Multiboot Thumbdrive Image (Video)


http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html

364 Hits
0 Comments

From Hacking Exposed: Adding the WinFE Image to the Multiboot Thumbdrive Image (Video)

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool.

http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html
312 Hits
0 Comments

A gathering of the X-Ways users in Australia

The X-Ways Users Conference is here in a few weeks.  My kind of conference: Australia and fellow X-Ways users! 

 

Maybe next year for me...but it sure would make for a good vacation, I mean, training trip.

 

 

...
Continue reading
591 Hits
0 Comments

Another reason to use, try, or at least just learn about XWF

Not that many years ago, you would not find a requirement of having experience with X-Ways to apply for a DFIR job.   But now, some jobs recommend it and yet some others require it.  This is not to say the other big players (Encase, Accessdata, etc..) are not needed or useful, just that XWF has made it to the same level at a price point that will probably not be beat with capabilities that still outpace other tools.

So......it makes sense to know a little about the tool that might put you over the edge for that next job.  Of course, you need to be competent too, but like I've said before, "beware the examiners that use X-Ways Forensics because they probably know what they are doing."

one two three

For the future XWF users, check out www.x-ways.net for some details, download and read a quick guide, and when you move forward with XWF, buy the book :)

 

424 Hits
0 Comments