Loading ...
Sorry, an error occurred while loading the content.

REVIEW: "Guide to Computer Forensics and Investigations", Bill Nelson et al

Expand Messages
  • Rob, grandpa of Ryan, Trevor, Devon & Ha
    BKGTCFAI.RVW 20050801 Guide to Computer Forensics and Investigations , Bill Nelson et al, 2004, 0-619-13120-9 %A Bill Nelson %A Amelia Phillips %A
    Message 1 of 1 , Dec 16 8:44 AM
      BKGTCFAI.RVW 20050801

      "Guide to Computer Forensics and Investigations", Bill Nelson et al,
      2004, 0-619-13120-9
      %A Bill Nelson
      %A Amelia Phillips
      %A Frank Enfinger
      %A Chris Steuart
      %C 25 Thomson Place, Boston, MA 02210
      %D 2004
      %G 0-619-13120-9
      %I Thomson Learning Inc.
      %O www.course.com
      %O http://www.amazon.com/exec/obidos/ASIN/0619131209/robsladesinterne
      %O http://www.amazon.ca/exec/obidos/ASIN/0619131209/robsladesin03-20
      %O Audience i- Tech 1 Writing 1 (see revfaq.htm for explanation)
      %P 689 p. + CD-ROM
      %T "Guide to Computer Forensics and Investigations"

      The preface states that the book is intended for newcomers to computer
      forensics that have a basic background in computers and networking.
      There is mention of instructor material on the CD-ROM, but no other
      direction in regard to use as a course text.

      Chapter one purports to provide an overview of the computer forensics
      profession. It jumps, seemingly without structure, from topic to
      topic, never providing solid information about much of anything. The
      progress and process of computer investigations is the topic of
      chapter two, but the material ranges between the uselessly vague
      (brief mentions of important concepts such as chain of
      evidence/custody, with no discussion of why they are vital) and the
      uselessly specific (six pages of instruction on how to make a Windows
      98 system boot to DOS). The content also relies heavily upon the
      assumption that the reader will have a certain suite of commercial
      forensics tools from a particular company. (It also seems to feel
      that the reader will never need to examine systems other than DOS,
      Windows 98, FAT12, and floppy disks.) DOS and Windows file systems
      (including NTFS) are reviewed in chapter four, although the level of
      detail provided is very inconsistent (eight pages of information on
      DOS batch files, and only four pages to describe the entire NTFS disk
      structure). Illustrations are less than helpful, particularly in
      regard to labelling, and the use of terminology in non-standard ways
      can lead to confusion. (In this book, "file slack" refers to what is
      otherwise simply known as unused or unallocated space.) Basically,
      the material is simplistic and unlikely to be needed by most people
      with an intermediate level of computer knowledge, while at the same
      time being incomplete, and probably not of any assistance to someone
      actually looking at disk sectors. The material on Macintosh and Linux
      systems, in chapter four, is similar.

      Most of the material in chapter five, on a forensics lab and office,
      is generic advice on either computer requirements or forensics (but
      non-computer) labs. Chapter six lists an apparently random collection
      of forensics tools. Rules of evidence (American) and a brief
      description of one program for hash calculation are in chapter seven.
      Chapter eight talks about processing the crime scene: the text ranges
      from the vague (identifying the computer) to the bizarre (HAZMAT
      suits). Some of the aforementioned commercial programs used in data
      acquisition are outlined in chapter nine while the analytical tools
      are depicted in chapter ten.

      Chapter eleven, on email, does show how to read headers in more than
      one mail user agent program, and mentions the log files on a couple of
      mail servers. Some random notes on graphics files, and, as in the
      rest of the book, lots of verbiage for not much information, is in
      chapter twelve. The advice on preparing reports, in chapter thirteen,
      is banal and has little bearing on forensics. Chapter fourteen, on
      expert witness, does not deal with the requirements for establishing
      that status, nor the restrictions on opinion in some cases.

      As far as computer forensics goes, the foundation provided in this
      work is far from solid. It mentions the basic topics, but fails to
      provide much in the way of resources for proceeding with the
      profession. The material provided is excessively wordy, and the
      structure is often jumpy and unhelpful. Extensive sections have been
      added that will be of little use to anyone other than a computer
      novice, seemingly only in an attempt to pad the length of the book. I
      would have trouble recommending this text to any audience.

      copyright Robert M. Slade, 2005 BKGTCFAI.RVW 20050801

      ====================== (quote inserted randomly by Pegasus Mailer)
      rslade@... slade@... rslade@...
      There is nothing in this world constant but inconstancy. - Swift
      http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade
    Your message has been successfully submitted and would be delivered to recipients shortly.