Computer and Intrusion Forensics (Artech House Computer Security Series)

Rating:
Summary: Good Process Overview
Review: The "Computer and Intrusion Forensics" book is a good high-level overview of the digital forensic process. It contains chapters that will appeal to all types of new investigators who will need to deal with computer-related incidents, including law enforcement, corporate investigators, internal audit teams, and corporate incident teams. A strong International overview of the legal issues are also given for the United States, Europe, and Australia.

This book provides a good overview of tool techniques, but does not give many details on how the techniques would actually be done with any tool. A detailed overview of three tools are given, but two of them are available to law enforcement only. The reader will finish this book with a solid understanding of the process that occurs during a computer investigation, but will still need additional books or training to start performing an investigation.

The chapter on fraud is very informative, as the topic is not covered in other digital forensic books and the skills will likely be helpful for most investigators in the future. The "Computer Forensics in Law Enforcement and National Security" chapter describes the investigation process that any investigator would find useful, not just law enforcement as the title suggests. The "Intrusion Detection and Intrusion Forensics" chapter gives an overview of Intrusion Detection Systems and Logging, but little is mentioned on how to confirm an intrusion while minimizing the amount of evidence that is modified.

This book will be useful as a first book to a new investigator who is looking to learn about the digital forensic process. This book will also be useful for technical managers and supervisors who will need to understand what their investigators are doing.

Rating:
Summary: Good Process Overview
Review: The "Computer and Intrusion Forensics" book is a good high-level overview of the digital forensic process. It contains chapters that will appeal to all types of new investigators who will need to deal with computer-related incidents, including law enforcement, corporate investigators, internal audit teams, and corporate incident teams. A strong International overview of the legal issues are also given for the United States, Europe, and Australia.

This book provides a good overview of tool techniques, but does not give many details on how the techniques would actually be done with any tool. A detailed overview of three tools are given, but two of them are available to law enforcement only. The reader will finish this book with a solid understanding of the process that occurs during a computer investigation, but will still need additional books or training to start performing an investigation.

The chapter on fraud is very informative, as the topic is not covered in other digital forensic books and the skills will likely be helpful for most investigators in the future. The "Computer Forensics in Law Enforcement and National Security" chapter describes the investigation process that any investigator would find useful, not just law enforcement as the title suggests. The "Intrusion Detection and Intrusion Forensics" chapter gives an overview of Intrusion Detection Systems and Logging, but little is mentioned on how to confirm an intrusion while minimizing the amount of evidence that is modified.

This book will be useful as a first book to a new investigator who is looking to learn about the digital forensic process. This book will also be useful for technical managers and supervisors who will need to understand what their investigators are doing.