| | |  | Remote Access | Home » » » Windows Forensic Analysis DVD Toolkit, Second Edition | | | | | | | Product Promotions: | | | | | Description: | | "If your job requires investigating compromised Windows hosts, you must read Windows Forensic Analysis." -Richard Bejtlich, Coauthor of Real Digital Forensics and Amazon.com Top 500 Book Reviewer "The Registry Analysis chapter alone is worth the price of the book." -Troy Larson, Senior Forensic Investigator of Microsoft's IT Security Group "I also found that the entire book could have been written on just registry forensics. However, in order to create broad appeal, the registry section was probably shortened. You can tell Harlan has a lot more to tell." -Rob Lee, Instructor and Fellow at the SANS Technology Institute, coauthor of Know Your Enemy: Learning About Security Threats, 2E Author Harlan Carvey has brought his best-selling book up-to-date to give you: the responder, examiner, or analyst the must-have tool kit for your job. Windows is the largest operating system on desktops and servers worldwide, which mean more intrusions, malware infections, and cybercrime happen on these systems. Windows Forensic Analysis DVD Toolkit, 2E covers both live and post-mortem response collection and analysis methodologies, addressing material that is applicable to law enforcement, the federal government, students, and consultants. The book is also accessible to system administrators, who are often the frontline when an incident occurs, but due to staffing and budget constraints do not have the necessary knowledge to respond effectively. The book's companion DVD contains significant new and updated materials (movies, spreadsheet, code, etc.) not available any place else, because they are created and maintained by the author. - Best-Selling Windows Digital Forensic book completely updated in this 2nd Edition
- Learn how to Analyze Data During Live and Post-Mortem Investigations
- DVD Includes Custom Tools, Updated Code, Movies, and Spreadsheets!
| | | Product Details: | | | Author:
| Harlan Carvey | | Paperback:
| 512 pages | | Publisher:
| Syngress | | Publication Date:
| June 11, 2009 | | Language:
| English | | ISBN:
| 1597494224 | | Product Length:
| 9.2 inches | | Product Width:
| 7.5 inches | | Product Height:
| 1.2 inches | | Product Weight:
| 1.95 pounds | | Package Length:
| 9.21 inches | | Package Width:
| 7.64 inches | | Package Height:
| 1.18 inches | | Package Weight:
| 2.03 pounds | | Average Customer Rating:
|  based on 20 reviews |
| | | | Used and New: | | | |
| All | |
| $26.58 | Used
- Good | | | $26.58 | Used
- VeryGood | | | $27.02 | Used
- VeryGood | | | $27.98 | Used
- Acceptable | | | $33.00 | Used
- Mint | | | $33.01 | Used
- Good | | | $33.03 | Used
- VeryGood | | | $33.03 | Used
- VeryGood | | | $33.12 | Used
- VeryGood | | | $36.87 | Used
- VeryGood | | | $37.43 | Used
- Good | | | $40.00 | New | | | $41.22 | Used
- Mint | | | $45.00 | Used
- VeryGood | | | $45.75 | Used
- Acceptable | | | $46.49 | Used
- Mint | | | $46.51 This item ships for FREE with Super Saver Shipping. | Used
- Good | | | $46.51 This item ships for FREE with Super Saver Shipping. | Used
- Mint | | | $47.79 | Used
- VeryGood | | | $48.85 | New | | | $50.00 | New | | | $52.85 This item ships for FREE with Super Saver Shipping. | New | | | $53.46 | New | | | $53.99 | New | | | $55.00 | Used
- VeryGood | | | $58.49 | New | | | $59.09 | New | | | $59.26 | Used
- Mint | | | $61.58 | Used
- Acceptable | | | $62.60 | New | | | $65.16 | Used
- Good | | | $65.83 | Used
- Mint | | | $65.83 | New | | | $65.92 | New | | | $67.80 | New | | | $68.00 | Used
- Mint | | | $68.43 | New | | | $68.43 | Used
- Mint | | | $68.82 | New | | | $69.25 | New | | | $69.28 | New | | | $69.28 | Used
- Mint | | | $69.70 | New | | | $70.32 | New | | | $73.16 | New | | | $73.56 | New | | | $74.33 | New | | | $82.80 | New | | | $84.70 | New | | | $87.23 | Used
- Mint | | | $88.71 | Used
- VeryGood | | | $89.79 | New | | | $90.57 | New | | | $93.05 | New | | | $94.24 | Used
- Mint | | | $103.35 | Used
- Mint | | | $108.99 | New | | | $166.09 | Used
- Good | | | $999.00 | Used
- Mint | |
| New | |
| $40.00 | New | | | $48.85 | New | | | $50.00 | New | | | $52.85 This item ships for FREE with Super Saver Shipping. | New | | | $53.46 | New | | | $53.99 | New | | | $58.49 | New | | | $59.09 | New | | | $62.60 | New | | | $65.83 | New | | | $65.92 | New | | | $67.80 | New | | | $68.43 | New | | | $68.82 | New | | | $69.25 | New | | | $69.28 | New | | | $69.70 | New | | | $70.32 | New | | | $73.16 | New | | | $73.56 | New | | | $74.33 | New | | | $82.80 | New | | | $84.70 | New | | | $89.79 | New | | | $90.57 | New | | | $93.05 | New | | | $108.99 | New | |
| Used | |
| $26.58 | Used
- Good | | | $26.58 | Used
- VeryGood | | | $27.02 | Used
- VeryGood | | | $27.98 | Used
- Acceptable | | | $33.00 | Used
- Mint | | | $33.01 | Used
- Good | | | $33.03 | Used
- VeryGood | | | $33.03 | Used
- VeryGood | | | $33.12 | Used
- VeryGood | | | $36.87 | Used
- VeryGood | | | $37.43 | Used
- Good | | | $41.22 | Used
- Mint | | | $45.00 | Used
- VeryGood | | | $45.75 | Used
- Acceptable | | | $46.49 | Used
- Mint | | | $46.51 This item ships for FREE with Super Saver Shipping. | Used
- Good | | | $46.51 This item ships for FREE with Super Saver Shipping. | Used
- Mint | | | $47.79 | Used
- VeryGood | | | $55.00 | Used
- VeryGood | | | $59.26 | Used
- Mint | | | $61.58 | Used
- Acceptable | | | $65.16 | Used
- Good | | | $65.83 | Used
- Mint | | | $68.00 | Used
- Mint | | | $68.43 | Used
- Mint | | | $69.28 | Used
- Mint | | | $87.23 | Used
- Mint | | | $88.71 | Used
- VeryGood | | | $94.24 | Used
- Mint | | | $103.35 | Used
- Mint | | | $166.09 | Used
- Good | | | $999.00 | Used
- Mint | |
| | | | Customer Reviews: | |
Average Customer Review:
 ( 20 customer reviews )
Write an online review and share your thoughts with other customers.
Most Helpful Customer Reviews
16 of 17 found the following review helpful:
Essential readingJun 07, 2009
By Jimmy Weg
"CFCE"
The second edition of Harlan's book nicely complements the first and is essential reading for practitioners at all levels. For those of us who primarily engage in exams of acquired images, the chapters on Registry Analysis, File Analysis, Executable Analysis, and Rootkit Detection provide and build upon basic concepts that go beyond what is taught in beginning and intermediate computer forensics courses.
The registry analysis chapter is particularly valuable and one that I draw on repeatedly. The accompanying DVD, with its scripts, not only provides tools to gather the data that Harlan describes, but provides a means to learn while you read by taking a hands on approach to registry analysis.
The chapter on file analysis teaches fundamentals of system files and logs that can provide key evidence in an exam. It explains not only what may be found, but how to get it and why it got there. These are the types of issues that can aid immeasurably when it comes to report writing and courtroom testimony. Similarly, the discussions on malware, rootkits, and executables provide guidance and solutions to considerations of whether an uninvited influence played a role in data arriving on, or departing from, a system.
For those who don't engage in incident or live response at the moment, the time is fast approaching when that aspect forensics is going to be vital to us all. Harlan explains what information is available, and he describes the methods and tools with which we can acquire volatile data and access information that's gone once the plug is pulled. Harlan brings together this area of his book with a discussion of analyzing the data.
In sum, this is a great work that is suited to those who have had basic computer forensics training as well as examiners who have been practicing for a long time. Things change every day, and WFA II provides a means to keep pace.
14 of 17 found the following review helpful:
Even better than the first editionJun 21, 2009
By hogfly
"hogfly"
In ancient times, when philosophers and scientists gathered to discuss and debate important topics, people would travel for weeks and months to arrive, just to hear the debates. To listen to the great minds of the time, to learn from them, and on occasion ask questions. In 2009 that trend continues though in a different fashion.
In the case of Windows Forensic Analysis we are fortunate enough to have Harlan Carvey. He has a deep well of knowledge to pull from and he continues to pull buckets of information out of the well to keep us all well hydrated. I was honored to read this book, and it's my privilege to write a review. It's the least I could do.
It's a text book, it's a field manual, it's reference material. This is Windows Forensic Analysis Second Edition and it's the best damn book on the planet for Windows Forensics. I thought I liked the first edition and then I read the second.
It's been updated to be sure, but it's also been expanded. There's current information contained in the over 400 pages of content. There are case studies, there are details you won't find elsewhere.
Want to know how to dump memory and collect volatile data? It's in the book.
Can't recall which tool has certain limitations or what the tool can do? It's in the book.
Want to know how to analyze volatile data? It's in the book.
Want to learn how to registry works? It's in the book.
Want to know how to do Windows Forensic Analysis? Read this book.
I've watched the forums and mailing lists since the first edition of the book was released two years ago. Time after time I read the questions being asked and went to the book. In an overwhelming majority of cases, the answer was there. To those of you that asked these questions, do yourself a favor. Go to the bookstore, or online store and buy the book, read it, highlight it, dog ear pages for reference. Make use of the knowledge that has been shared, your clients deserve it.
In ancient times, people would travel for weeks or months to listen and learn from the greats..all you have to do is spend a little money and open the book.
5 of 5 found the following review helpful:
If you buy one book on Windows forensics, this should be itJul 23, 2009
By Jennifer Kolde
For several years, Harlan Carvey has led the field in sharing and publishing his extensive knowledge of Windows forensics. The latest edition of Harlan's book does not disappoint, and this updated and revised copy remains THE Windows forensics reference book to have on your shelf. Harlan draws on both his in-depth knowledge of the Windows operating system and his extensive experience in real-world incident response to successfully bridge what is often a gap between the world of the first responder and the world of the forensic analyst. This is particularly appropriate at a time when those roles continue to converge. If there is information to be found on a Windows system (and I think Harlan knows and has documented the Windows registry better than anyone at Microsoft), Harlan will tell you not only where, but also how to find it. But he doesn't stop there; Harlan also provides several open-source (Perl-based) tools on the accompanying DVD to allow you to extract a variety of useful data from a Windows computer to aid you in your investigation. If you want to do two things to aid your incident response / forensics capabilities, then 1. buy this book, and 2. learn Perl!
7 of 8 found the following review helpful:
There is no substitute for this bookSep 07, 2009
By Richard Bejtlich
"TaoSecurity"
I read and reviewed the 1st Ed of this book in July 2007, and I just finished reading Windows Forensic Analysis 2nd Ed (WFA2E) this weekend. If your job involves investigating Windows systems, you must read this book. It's as simple as that. There is no substitute for this book. It also perfectly complements other solid forensics works already published.
The three main reasons why I liked the 1st Ed hold for the 2nd Ed. The subject matter is exactly what I wanted to read. WFA2E introduces a vast number of tools to help investigators implement the concepts explained by the author. Harlan brings a lot of experience to WFA. Of these three, I really appreciate Harlan's experience. He is constantly "in the fight" so he knows what works and what doesn't. He's been around so long that he knows what he's talking about. If he encounters a problem, he can either try fixing it himself or he is friends with someone who can work the issue. All of these characteristics shine in WFA2E.
I expect to see a 3rd Ed of this book in a few years, incorporating more Windows Vista and Windows 7 material. It might also be helpful to consider techniques for Windows Server and Mobile platforms in the 3rd Ed. Regardless, I will look forward to that book when it arrives because I enjoyed WFA1E and WFA2E so much.
4 of 4 found the following review helpful:
Incredible Book!Sep 07, 2010
By Allen W.
I'm extremely impressed with how thoroughly the author covers the methods discussed in this book. Usually when I pick up a book like this I'm prepared for more questions than when I started, but that's not the case with Windows Forensic Analysis. It's elegantly worded and easy to follow which is hard to find when it comes to technical books, especially on a subject like this that can easily intimidate a reader who isn't already a programmer or an industry professional. I almost hesitate to use the term "technical" because that implies you need to be an engineer to understand the subject matter which is not the case here.
I read non-stop for 8 hours straight yesterday and I still didn't want to put it down. Not only that, but today I was able to recall almost all of the subject matter covered without returning to the book for a reminder. This speaks volumes about a book where too often information is easily forgotten if you aren't sitting in front of a computer practicing the methods being discussed as you make your way through it.
As a long time Windows user, this book has helped fill in a lot of blanks, and I feel like I'll have a lot more flexibility and power by employing many of the tools and techniques as an individual who spends a lot of time using Windows. Thank you Harlan!
See all 20 customer reviews on Amazon.com
| | |
|
