I just wanted to post quickly the resources from our SEC312: Implementing the Fundamental Computer Investigation Guide for Windows from Tech-Ed 2007. Those of you who attended…..THANK YOU! I know a lot of speakers don’t listen, heed, or are truly grateful for the feedback you submit…but I truly am thankful. We can only improve the session when we get feedback. Don’t hold back! If we suck, we need to know we suck…so we can improve.
Okay, so here are the resources I mentioned during the session. I don’t get any kickbacks and these are books I personally use. Please feel free to add comments on books YOU use!
- Encase – http://www.guidancesoftware.com
- Forensic Toolkit – http://www.accessdata.com/
- The Sleuth Kit/Autopsy – http://www.sleuthkit.org
- Helix – http://www.e-fense.com/helix/
Guide and Books:
- Fundamental Computer Investigation Guide For Windows – http://www.microsoft.com/technet/security/guidance/disasterrecovery/computer_investigation/default.mspx
- File System Forensic Analysis. Brian Carrier (ISBN: 0-321-26817-2)
- Digital Evidence and Computer Crime. Eoghan Casey (ISBN: 012162885X)
- Incident Response: Investigating Computer Crime. Kevin Mandia & Chris Prosise. (ISBN: 007222696X)
- Hacking Exposed: Computer Forensics. Chris Davis, Aaron Phillip. (ISBN: 0072256753)
Okay, I hope everyone is recovered from last night’s party. I have one more session remaining: Securing the Small Business and I hope to turn it into a discussion with those in the audience, and avoid yet another Microsoft lecture on the last day.
Oh yeah….the travel part. Well, some of you at Tech-Ed were wondering where the heck I was yesterday. Well, I had a meeting I had to attend in North Carolina, so yes, I flew out at 6:00 AM from Orlando to Raleigh…and then back 2 hours later. Connecting flight back to Orlando got canceled. I was re-booked on flight that potentially could have had me miss my last session today, so I flew into Tampa at 8:00 PM and I drove from Tampa to Orlando in the rain. Lovely evening all around. I do so love air travel.