"Placing the Suspect Behind the Keyboard" discount code

Cool.  Looks like there is a new discount on my book, "Placing the Suspect Behind the Keyboard".  Plus, it also looks like an entire chapter is available for download.

[caption id="1142" align="alignleft" width="266"]discount Cool. A discount. Get it while you can!


PSBKI'm also giving a presentation on this book at NOLACON (New Orleans, Louisiana).
Rate this blog entry:
0
544 Hits

Network Investigation & Digital Triage by SEARCH.org




Network Investigation & Digital Triage


Very cool.  SEARCH.org teaches WinFE in its Network Investigation & Digital Triage course.

[caption id="attachment_1108" align="alignleft" width="700"]search http://www.search.org/get-help/training/high-tech-crime-investigations/instructor-led-training/network-investigation-and-digital-triage/




Rate this blog entry:
0
591 Hits

WinFE (and of course, XWF)

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool, but I spread this word to you because there are few things in life neater than a forensically bootable CD/USB with X-Ways Forensics.

From Hacking Exposed: Adding the WinFE Image to the Multiboot Thumbdrive Image (Video)


http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html

Rate this blog entry:
0
669 Hits

From Hacking Exposed: Adding the WinFE Image to the Multiboot Thumbdrive Image (Video)

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool.

http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html
Rate this blog entry:
0
569 Hits

A gathering of the X-Ways users in Australia

The X-Ways Users Conference is here in a few weeks.  My kind of conference: Australia and fellow X-Ways users! 

 

Maybe next year for me...but it sure would make for a good vacation, I mean, training trip.

 

 

 

 

 

Rate this blog entry:
0
970 Hits

Another reason to use, try, or at least just learn about XWF

Not that many years ago, you would not find a requirement of having experience with X-Ways to apply for a DFIR job.   But now, some jobs recommend it and yet some others require it.  This is not to say the other big players (Encase, Accessdata, etc..) are not needed or useful, just that XWF has made it to the same level at a price point that will probably not be beat with capabilities that still outpace other tools.

So......it makes sense to know a little about the tool that might put you over the edge for that next job.  Of course, you need to be competent too, but like I've said before, "beware the examiners that use X-Ways Forensics because they probably know what they are doing."

one two three

For the future XWF users, check out www.x-ways.net for some details, download and read a quick guide, and when you move forward with XWF, buy the book :)

 

Rate this blog entry:
0
760 Hits

Hacking Exposed - Daily Blog #242, How to build WinFE to add to the Multiboot thumbdrive

David Cowen has a great instruction writeup on adding WinFE to the Multiboot thumbdrive.  I am anxious to see the video he plans to make next week to add this to the multiboot thumbdrive.

[caption id="attachment_1091" align="aligncenter" width="683"]cowen http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-242-how-to-build-winfe-to.html


I may have said that WinFE is nearly the perfect forensic boot system before, but actually, when WinFE is on a multiboot media, I would have to change it to the multiboot thumbdrive with WinFE being the perfect forensic boot system.  Very very cool.

 
Rate this blog entry:
0
563 Hits

WinFE has some street cred with the Scientific Working Group on Digital Evidence

Cool.  WinFE is mentioned in a Scientific Working Group on Digital Evidence document.

 
Rate this blog entry:
0
451 Hits

No surprise. XWF does something other tools don't

From a twitter post, a cool video on imaging with X-Ways noted (13:50) as doing something other tools don't.  The entire video is actually pretty good too.

xwf

http://youtu.be/zYYCv21I-1I

Rate this blog entry:
0
719 Hits

Windows Forensic Analysis, Fourth Edition

I'll wait to give an "official" review of Harlan's book (Windows Forensic Analysis Toolkit, Fourth Edition: Advanced Analysis Techniques for Windows 8) only to give others the chance to read it once it becomes available.  But...I'll say that based on my early reading as a tech editor, this is a book that ranks for me in as much anticipation as a new Tom Clancy novel being released.

fourth editionI also think this is one of those books that if not pre-ordered, will have you waiting until it is reprinted due to being over-ordered.  The X-Ways Practitioner's Guide was one of those books too, where late-comers had to wait weeks for the second printing.  This book is no different, because just about all of the neat things in the book show just how much Harlan has discovered in some very neat areas of Windows 8.

One thing I learned about ordering books from Amazon, is that Amazon will pretty much match the lowest price found elsewhere.  I also learned that with a pre-ordered book, you can cancel before the book is printed if you find a lower price somewhere else.  The point is, pre-order the book or you may be waiting a month after everyone else gets their copy...it comes out in April '14 and I'd expect the second printing to be needed in April '14...
Rate this blog entry:
0
507 Hits