Buy New
$39.94
Qty:1
  • List Price: $59.95
  • Save: $20.01 (33%)
In Stock.
Ships from and sold by Amazon.com.
Gift-wrap available.
Sell yours for a Gift Card
We'll buy it for $18.28
Learn More
Trade in now
Have one to sell? Sell on Amazon
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See all 2 images

Digital Forensics with Open Source Tools Paperback – April 14, 2011

ISBN-13: 978-1597495868 ISBN-10: 1597495867 Edition: 1st

Buy New
Price: $39.94
34 New from $37.29 18 Used from $33.51 1 Collectible from $49.99
Rent from Amazon Price New from Used from
Kindle
"Please retry"
$18.37
Paperback
"Please retry"
$39.94
$37.29 $33.51
Free Two-Day Shipping for College Students with Amazon Student Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student


Frequently Bought Together

Digital Forensics with Open Source Tools + The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics
Price for both: $60.28

Buy the selected items together
NO_CONTENT_IN_FEATURE
Shop the new tech.book(store)
New! Introducing the tech.book(store), a hub for Software Developers and Architects, Networking Administrators, TPMs, and other technology professionals to find highly-rated and highly-relevant career resources. Shop books on programming and big data, or read this week's blog posts by authors and thought-leaders in the tech industry. > Shop now

Product Details

  • Paperback: 288 pages
  • Publisher: Syngress; 1 edition (April 14, 2011)
  • Language: English
  • ISBN-10: 1597495867
  • ISBN-13: 978-1597495868
  • Product Dimensions: 7.5 x 0.6 x 9.2 inches
  • Shipping Weight: 1.2 pounds (View shipping rates and policies)
  • Average Customer Review: 4.7 out of 5 stars  See all reviews (28 customer reviews)
  • Amazon Best Sellers Rank: #63,405 in Books (See Top 100 in Books)

Editorial Reviews

Review

"This is highly detailed material. Although the introductory chapter adopts an easy pace, with overviews of important technical concepts, most of the other chapters get right down to the practice of forensic analysis. This is not a book you're going to want to read in bed: you'll want this right next to a computer - preferably two or three computers running different operating systems - so that you can try the techniques for yourself as you work your way through. The authors admit that this book does not cover everything you need to know. For instance, it focuses entirely on 'dead drive' forensics - offline systems. Analysing running systems often requires high-level proprietary tools. But it does give an excellent grounding in the methods of digital forensic analysis and provides a valuable first step in learning the technicalities."--Network Security, May 2012, page 4

"Digital Forensics - MacGyver Style! The practical solutions of this book, Digital Forensics with Open Source Tools, save the day when commercial tools fail. During an incident, the clock ticks. Response teams scramble to pull anything together to solve the immediate challenge. Cory Altheide and Harlan Carvey take you through the tools and tactics that you need - the ones that in a pinch will get the job done. A welcome addition to my library."--Rob Lee, SANS Institute

"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools."--Reference and Research Book News

"Intended for students and new computer professionals, or those new to open source applications, this guide to digital forensics provides practical instructions for many common tasks in data recovery and analysis using open source tools. Beginning with a discussion of setting up an open source examination platform and tool set, the work covers disk and file system analysis, Windows, GNU/Linux and Mac OS X systems and artifacts, Internet artifacts, file analysis and automated analysis. The volume includes numerous code examples and tips and tricks as well as an appendix of software tools. Chapter examples assume a basic knowledge of the Linux command line interface."--Reference and Research Book News

"The authors intended this book for two types of readers: complete novices in the world of digital forensics, and seasoned practitioners who are interested in learning more about open source tools that could help them in their work. And although it might seem difficult to merge the knowledge in such a way to make for an interesting book for both groups, in my opinion, the writers managed to do it beautifully."--Net-Security.org

From the Back Cover

Digital Forensics with Open Source Tools is the definitive book on investigating and analyzing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of these tools on Linux and Windows systems as a platform for performing computer forensics. Both well known and novel forensic methods are demonstrated using command-line and graphical open source computer forensic tools for examining a wide range of target systems and artifacts.


More About the Author

Cory Altheide has eleven years of information security, forensics & incident investigations experience. Cory responds to incidents and performs system and network investigations daily and is constantly seeking to improve the methodologies in use in the incident response field.

While with Mandiant, he has responded to dozens of incidents across numerous industries. Cory has also performed a wide variety of cyber-crime investigations, ranging from corporate espionage to distributed financial crime criminal organizations. Prior to joining Mandiant, Cory worked at IBM, Google and the National Nuclear Security Administration (NNSA).

Cory is the primary author of "Digital Forensics with Open Source Tools" and a contributing author on "UNIX & Linux Forensic Analysis" & "Handbook of Digital Forensics and Investigation."

Customer Reviews

Highly recommended for anyone pursing or currently working in the digital forensics field.
BBP
Free and open source tools fill large gaps in the capabilities of commercial forensic suites and will continue to do so in the foreseeable future.
Chad Tilbury
I read this relatively fast and in one sitting, so it's written well and in an easy to understand way.
Fathom

Most Helpful Customer Reviews

21 of 22 people found the following review helpful By Brad Garnett on June 22, 2011
Format: Paperback
No dongle? No problem, says it all! Authors, Cory Altheide and Harlan Carvey, deliver a superb, field guide for digital forensic practitioners. This book is not a textbook on how to perform digital forensics, but a guide for the veteran or new forensic examiner to reference, to extend his/her analysis capabilities with open source tools. The authors bring their years of real world experience at practicing digital forensics, into a single publication.
Digital Forensics With Open Source Tools (DFWOST) begins by defining "free" vs. "open" and the digital forensic process, as well as the benefits of using open source tools. DFWOST quickly moves into setting up the examination workstation, that the examiner/analyst will use to perform the digital forensic examination; regardless, of the host operating system of your forensic machine.
While the book is not a textbook on how to perform a digital forensic examination, it does outline basic digital forensic concepts and terminology that the forensic examiner must comprehend to utilize the open source framework that the book mainly focuses upon, The Sleuth Kit.
From here, the book goes into depth with Windows, Linux, and Mac OS X operating systems and how to use open source tools to identify, parse, and "forensicate" the various system artifacts.
The book's final chapter focuses on automating forensic analysis and extending capabilities with open source tools Finally, the appendix is full of free, non-open source tools that you should become familiar with and integrate into your digital forensic toolkit. Remember, there are many ways to skin a cat!
Read more ›
3 Comments Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
10 of 10 people found the following review helpful By Chad Tilbury on June 13, 2011
Format: Paperback
With more forensic books hitting the shelves, I find myself prioritizing those by authors I know and trust. I have worked with Cory Altheide and he is an extremely talented forensic professional with a passion for open source tools. Not surprisingly, I would not categorize this as a beginner book. Open source tools require a higher level of interaction than their commercial counterparts, but are a great way to take your forensic skills to the next level. While teaching, I often see students frustrated that there is no one tool that can do it all. Such a tool does not exist, no matter how much you are able to pay for it. Free and open source tools fill large gaps in the capabilities of commercial forensic suites and will continue to do so in the foreseeable future.

The book begins with an excellent section on setting up your forensic workstation, using either Linux or Windows as a host. I was immediately impressed with how succinctly the authors were able to cover this topic. File system analysis is broken into three chapters covering Linux, Windows, and OS X. It is rare to find more than one of these operating systems covered, and references to all three continue throughout the rest of the book. This breadth does come at a cost; a fair amount of system knowledge is assumed. As an example, NTFS is covered in six pages and readers are assumed to have prior knowledge of concepts like NTFS attributes and resident versus non-resident files. Without a doubt, Digital Forensics with Open Source Tools (DFWOST) runs at a blistering pace. This is a boon for more advanced practitioners who do not want to rehash old concepts. However, there were several instances when "newer" artifacts like the Linux Logical Volume Manager (LVM) were discussed that I found myself wanting more.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
12 of 14 people found the following review helpful By Eric Huber on June 16, 2011
Format: Paperback
Let me start off by stating that I was provided a free review copy of this book by the authors and their publisher. I know both Cory Altheide and Harlan Carvey and I'm an admirer of their work in the field. If I hadn't been provided a review copy of the book, I would have purchased it on my own and reviewed it because of the trust I have in their abilities as researchers and writers. Part of me wishes I hadn't written that sentence because I know Harlan Carvey is working on another book and I probably just eliminated any possibility of getting a free review copy. Someday I'll learn, but today is clearly not that day.

Unsurprisingly, Cory and Harlan turned out a five star effort. The book does three things for the reader. First, it explains the purpose and use of a variety of open source digital forensic tools (as well as using an appendix to explain some free, but non-open source tools), it provides the reader with some foundational education on file system forensics (Windows, Apple, and Linux), and it explains selected important topics in digital forensics such as web browser forensics, shortcut files, and mail artifacts.

I had a bit of an internal debate regarding whether this book is something that an entry level person would be able to grasp in its entirety. Some of the concepts presented such as the more advanced file system forensic issues can be relatively complicated for a beginner. Ultimately, I think this complexity is a strength of the book in that it makes it a learning barometer of sorts. A good use of this book for a new forensic examiner would be to use it as a guide to determine which portions they already know and which portions are they find confusing.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Most Recent Customer Reviews


What Other Items Do Customers Buy After Viewing This Item?