Dude, just write the book.

Dude, just write the book.

I had a discussion with a peer of mine about writing a book, in that my peer has been thinking of writing a book but never gets around to doing it.  After about two years of listening to how he should write his book, my response was “Dude, stop talking about it and write the darn book.”

His book idea is a nonfiction technical book and is about **secret topic** (of course I’m not leaking the topic or title!).  He is an expert, or at least knows a heckuv a lot more about the topic than I do.  I would buy the book tomorrow.  I even said that if he had written this book when he first told me about it, we’d be talking about the next edition and I would have already bought the first edition.  "Dude, you’re two years and two editions behind now!”

Which brings me to my point. Years ago, I said the same thing.  “Hey, I think I could write a book.” I said it a few people and one of the guys told me, “Dude, just write the darn book.” And so I did.  Three times already. Started a fourth. Plans for a fifth.  All from one person telling me to stop talking about it and write the book.  I took the suggestion to heart because he had already published several books himself. Thanks HC.

Fair warning: It’s not easy.

If you can get a contract, you’ll have deadlines to meet, standards to keep up, and demands placed on you by the publisher. Worse yet, if you don’t have a contract and want to self-publish, you have to place those same demands on yourself.

So now you know the secret. Just write the darn thing.


959 Hits

Books written by practitioners are many times better than those written by those who 'never done it'

Books written by practitioners are many times better than those written by those who 'never done it'

Many of Syngress published books I’ve read are those written by people simply writing about how they do their job…while they are doing their job.   They are probably not writing while they are physically doing their work, but you know what I mean.

With my first book, Placing the Suspect Behind the Keyboard, I was consulting on a criminal cyber harassment case, two arson cases, and several civil litigation projects. In three of the cases during writing the book, the main goal was identifying users behind the keyboard (in one case, behind a mobile device).  In addition to doing what I knew from my law enforcement detective days, I conferred with experts for tips and tricks on tracking Internet users.  I was writing the book while doing the work.

My current book, Hiding the Behind the Keyboard, was virtually the same, however, this time with a co-author (John Bair). While writing the book, there were multiple interruptions of having to do work in the real-world outside of typing and testing theories. While John was working homicides and examining mobile devices in those cases, I was consulting on employee matters where unidentified employees were creating havoc with their company by being anonymous online. It is one thing to create a perfect scenario to test a theory and quite another to have actual evidence on an active case.  Again, this was another book of authors writing what they do on a daily basis.

I write about this only because I remind myself regularly of college courses I have taken in digital forensics where the required books not only cost an arm and a leg, but were written by academia, not active practitioners.  I’ve even taken a computer forensics course from a community college where the professor had not done one forensic exam…not a single one.  The professor did not even know how to connect a hardware write-blocker to a hard drive. I kid you not.  

I’m not a Syngress employee, but I do like their books. The cost may seem high for some of the books, but it is still about half the price of a college text in the same subject matter.  But the biggest difference is how the books read. I so much prefer reading a book that simply says, “This is how you do it in the real world”. I do not prefer books that speak in terms of an idealized theory.  Reminds me of my Field Training Officers in patrol telling me to forget what I learned at the academy because they were going to teach me what works on the street, in real life.  The best thing I like about the Syngress books is that I can read what the experts are using day-to-day in their own words.

And year after year, I check to see the new titles that come out and hope that Syngress changes their book covers from the previous year.  This year, there are more than a few titles that I have already pre-ordered and will have on hand for the next conference to have signed by the authors.  The cover design change was probably a bit overdue, but glad it has changed.

The discounts are nice too when you have more than a few books you want to buy...



913 Hits

Massive Government Surveillance - Not a new thing

I'm close to wrapping up my latest book, Hiding Behind the Keyboard. One of the more interesting things I found while researching the electronic surveillance chapter is a historical note of massive electronic surveillance...way back in the early  1890s

Considering that government surveillance is one of the hottest topics today, no doubt brought into the spotlight by Edward Snowden, I found this one historical bit of surveillance in New York to be a reminder that electronic surveillance has been around much longer than what the average person may know.

Before getting into the New York Police massive surveillance story, you should know that wiretapping has been around as long as communicating electronically has existed.  For example, as soon as the telegraph was used, the telegraph communications were intercepted. During the Civil War, a "wire tapper" was an actual job in the war to intercept telegraphs!  But that's not what I mean in regards to mass goverment surveillance. The New York Police Department's history with wiretaps is what I found to be really interesting, even more interesting than the NSA surveillance disclosures

In short, back in the late 1800s, New York made wiretapping a felony but the NYPD believed they were above this law. They tapped people at whim and without warrants, including tapping Catholic priests.

In fact, NYPD quickly discovered that they could tap into any phone line of the New York Telephone Company, at anytime  to listen to any person on the line. They even tapped into hotels to listen to hotel any guest.

Obviously, this free-wheeling phone tapping ended after the Supreme Court decided that the Fourth Ammendent protected "intangles" such as communications when it was previously believed that only "tangibles" were protected against unreasonable search and seizure. However, the NYPD experience shows that when  given unfettered access to monitoring and surveillance, government can go too far with good or bad intentions.

The solution to prevent going too far is simple. Get a warrant. Smart government employees know that a warrant protects the people and the employee's career. For anyone to say warrants are difficult, impossible, or too burdonsome simply has not written an affidavit for a warrant or just doesn't have the probable cause in the first place (or may be lazy....).  Warrants are easy to write if you have probable cause.  In fact, some warrants don't even need to be written for approval as a recorded phone call to a judge can get you a telephonic warrant approved in less than half an hour or faster.

For those against any government surveillance, such as wiretaps or pen registers, as long as there is a warrant, there really isn't any problem.  The Constitution and state or federal  laws that approve wiretaps require that the searches not be unreasonable or unnecessary (meaning, there must be cause).  Technically, it is almost as easy as flipping a switch, but practically, it takes takes an investigation to develop probable cause that a crime exists in the first place.  No crime = no probable cause = no warrant.

As a disclaimer to my personal experiences, I have initiated and supported dozens of wiretaps, pen registers, trap and traces, hidden cameras, GPS installations, body wires, and bugs during my time in criminal investigations. I've had probable cause every single time, so much so, that PC dripped out of my investigation binders. And with that, I'm not a fan of unfettered, massive government surveillance without cause...

1322 Hits

Last day of discounted X-Ways Forensics online course

I'm sure there are a few more people left to register for the X-Ways Forensics online course (XWF I) with the discount code of "xwf1". That's 25% off, plus includes free tuition to the X-Ways Forensics II online course. XWF I is introductory, XWF II is more indepth, quite a bit longer, and will be released in August. XWF III, a shorter course will be released sometime after August.

Everyone registering by midnight tonight (Pacific time) for XWF I, gets access to XWF II and XWF III when published without cost. Otherwise, it's a separate tuition payment for each course.  From July 18, the XWF I is back to $195, XWF II will be $299, and XWF III will be $75.   Each class is lifetime access, on demand training, including updates to the courses when XWF is substantially updated (should be a course update once a year).

Details on XWF II are here: http://xwaysforensics.wordpress.com/2014/07/05/x-ways-forensics-practitioners-guide-online-ii/

Register for X-Ways Forensics Practitioner's Guide online course here:  http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide

785 Hits

X-Ways Forensics Practitioner's Guide Online II

For all  XWF I registrations prior to July 17, 2014, you will receive a code for 100% off the XWF II course shown below at the email you registered.  The deadline to register in order to receive the 100% discount code for XWF II is July 17, 2014, after which, the course is available for purchase without a discount.

These are on-demand courses and you have lifetime access to both courses (XWF I and XWF II).  There will be an XWF III course released during the summer, all who register before July 17, 2014 will receive another 100% off discount code for XWF III.  So, for the purchase of XWF I by July 17, you will have lifetime access to XWF I, XWF II and XWF III.

XWF II will be released after the discount codes currently given have expired in a few weeks.  The general discount code for 25% off is:   xwf1

Members of HTCC, IACIS, and CTIN have received a 30% discount code in their e-mail.  If you are a member and did not receive the code, check your e-mail, it should be there.  If you belong to a high tech crime group not listed, This email address is being protected from spambots. You need JavaScript enabled to view it. and I can send a 30% code to your association.  Otherwise, feel free to use the 25% discount code.


878 Hits

Digital Forensics Book of the Year!

The X-Ways Forensics Practitioner's Guide won the Best Digital Forensics Book of the Year award at the DFIR Summit 2014 in Austin, Texas.  I'd like to thank everyone who voted for the XWF Guide and hope the book has helped you in your work.


[caption id="attachment_587" align="alignleft" width="620"]award https://forensic4cast.com/forensic-4cast-awards/2014-results/
556 Hits

Don't blame me...

[caption id="attachment_579" align="alignleft" width="700"]dontdoit "Of course you can trust PDF downloads." - UglyGorilla and KandyGoo

I have been given about a dozen or so URLs from friends with the X-Ways Practitioner's Guide as downloads.  Mostly, I am given the URLs so I can let  the publisher  know and they can take the pirated files down (good luck with that....).

If you ever considered downloading these sort of of things, just a thought, don't do it!  I'd hate for bad things to happen to your computer because of a file with my name on it that was manipulated by Unit 61398 or some other hacking organization.
490 Hits

Vote for the best book right away!

The deadline for the Forensic 4:cast Digital Forensics Book of the Year has been changed.



[caption id="attachment_1218" align="aligncenter" width="708"] My personal favorite....Placing the Suspect Behind the Keyboard...it's the first and only writing on the subject manner incorporating investigative methods in and out of the (computer) box.


Xways-Cover http://amzn.to/1g5sfSX


]Placing the Suspect Behind the Keyboard http://amzn.to/1owuRmr


479 Hits

Hey look! Now there is a book on FTK.

FTK http://amzn.to/O38eWh

I previously posted that a book on FTK is sure to come along, since we have the best book of X-Ways and the other book on Encase.  Now comes a book on FTK.  Just like the XWF Guide or the upcoming Encase guide, I wouldn't see any reason for a FTK user to not have a book on FTK.

It makes sense to have "the" book on X-Ways, "the" book on Encase, and "the" book on FTK.  By having books on your major forensic suites, it is easier to compare what suite "A" does compared to tools "B" and "C" as well as how to get from point A to B using each tool.

So....how about that book on ProDiscover?  Anyone?  Grab the opportunity before someone else does.  I promise to buy it, as I have already ordered the FTK and Encase books.

I have brief reviews on my favorite DF books at http://winfe.wordpress.com/books/



[caption id="attachment_547" align="aligncenter" width="170"]FTK http://amzn.to/O38eWh

[caption id="attachment_549" align="aligncenter" width="169"]encase http://amzn.to/P9XxCl

[caption id="attachment_347" align="aligncenter" width="173"]Xways-Cover http://amzn.to/1gfx0t5
490 Hits

Not X-Ways, but of interest to Encase users

Computer Forensics and Digital Investigation with EnCase Forensic

encase http://amzn.to/1eY02wn


I know, this has nothing to do with X-Ways Forensics.  But hey, the X-Ways Practitioner's Guide was first...

Practically, this seems like a good book for Encase users to park on the shelf (while the X-Ways Practitioner's Guide sits on your desk next to your keyboard).

So, when is that book on "FTK" coming out....and who is going to write it?...And if you do want to write it, give Syngress a shout.

505 Hits