Top positive review
2 people found this helpful
Excellent Book, Five Stars!
on August 2, 2011
As Cory and Harlan state in the introduction, this book is intended for two audiences; new forensic practitioners and experienced digital forensics practitioners new to open source tools. I believe they have succeeded in providing top-notch material for both audiences. Several excellent five star reviews have already been posted, which I agree with wholeheartedly. In order to avoid simply rehashing these existing reviews, I would like to simply state that I believe Cory and Harlan did two things very well with DFWOST:
1. As Cory and Harlan state in the introduction to Chapter 2, "Being able to build software properly is critical for an examiner using open source tools". Speaking as a seasoned examiner that consistently leverages the majority of the tools in DFWOST, we sometimes forget that the configuration of various interpreters (Perl, Python, Ruby) and the proper installation of tools from source are a difficult task for those new to open source tools. This technical hurdle often inhibits the adoption of open source utilities by even senior analysts. I believe Cory and Harlan had this hurdle in mind when authoring DFWOST, as they provide their readers with valuable information regarding these tasks. Chapter 2 does an excellent job of stepping the reader through the installation of various interpreters and utilities for both the Linux and Windows environments. Before I read DFWOST, I was curious if Cory and Harlan would leverage an available Linux-based live distro and bypass the topic of installation and configuration of an examination system all together. I was happy to see they they did not take this route, as dependency on a live distro can simply add a layer of abstraction for a new student.
2. Instead of bloating DFWOST with content that has been covered in depth in existing publications, Cory and Harlan opt to simply direct readers to these resources. Given both the author's resumes (and previous publications), they could of easily supplied this information in DFWOST to unnecessarily bulk this book up. For instance, when the topic of advanced Windows Registry analysis is mentioned, the reader is directed to Harlan's Windows Registry Forensics. This may be construed as self-serving, but the same is done when the topic of Windows binary (PE) analysis is entered. In this case, the reader is directed towards Malware Analyst's Cookbook by Ligh, Adiar, Hartstein, and Richard. In my opinion, both these publications are the definitive sources for their perspective topics. It is refreshing to see the authors direct their readers to the appropriate place, instead of diving into a topic that probably doesn't have the appropriate real estate dedicated for discussion in the first place.
As with any material these two authors provide to the community, DFWOST should be required reading for any examiner - not just open source hobbyists and newbies. I hope we see another great publication from both Cory and Harlan in the near future. They make a good team.