Book Review: Windows Forensic Analysis
343919
There are very few books on the topic of Windows Forensic Analysis and Harlan Carvey has taken it upon himself to provide the security community with a guided tour of the inner workings of Microsoft operating systems. As Microsoft does not yet offer a "forensic" track in it's training offerings most forensic knowledge of Windows comes from on the job experience or tool specific training offered by a vendor.

This book begins by leading you through the collection of evidence. The author provides you with examples of collecting data from live running systems using commercial tools, tools native to Windows, and advanced perl scripts which are provided on the accompanying DVD. Locard's Exchange Principle, a principle unknown to me prior to reading this book, is explained in great detail and is reference throughout the book. The concept is further demonstrated in an example using my favorite security tool, Netcat. People who respond to incidents need to know what to look for. Harlan dives deep into the key items of interest and explains how to pay special attention to volatile information such as system time, network connections, clipboard contents, and mapped drives, to name a few.

Once you have collected your data the author moves into specific chapters on how to analyze and make sense of it. Harlan does a fantastic job of explaining how to analyze memory (dumping the memory, analyzing crash dumps, reading through memory, etc.), analyzing the registry (tracking user activity, explaining how processes autostart from registry entries, etc.), analyzing windows files (working with event logs, common document formats, alternate data streams, etc.), analyzing executable files (static and dynamic analysis), and finally rootkits (detecting and preventing).

On the cover of the book the author has a quote by Troy Larson, Senior Forensic Investigator of Microsoft's IT Security Group which states:

"The Registry Analysis chapter alone is worth the price of the book."

When I first received the book I thought "Wow, that's a glowing recommendation" and upon reading the book cover to cover I couldn't agree more. I have yet to see a book which takes you through the intricacies of the Windows Registry in such a way that I, being a Linux person, could easily relate to.

The rootkit chapter was a little light on content but the rest of the book makes up for it. There are books out there dedicated to rootkits and I wouldn't expect the author to provide a book that explains everything about everything and still expect people to be able to carry it with them.

The accompanying DVD contains the scripts mentioned in the book, some videos explaining the use of some tools, as well as a bonus folder that contains ... well I'll let you buy the book to find out what cool tools are provided.

This book should be on every analysts shelf whether they perform Windows forensic analysis as part of their role, or think that they might be called upon to do so in a pinch. I also think that this book is a fantastic supplement to any Microsoft training and any security training you may receive in the future.

I give this book 4.5 stars as it is easy to read and kept my interest throughout the entire book.

Do yourself a favor and pick up this book today.
1233977
Upgrading and Repairing PCs, 22nd Edition
by Scott M. Mueller
Pearson Education, Inc. / Que Publishing
ISBN-13: 978-0-7897-5610-7 / ISBN-10: 0-7897-5610-2
Fred Sabin (President, New Jersey Computer Club) Review  November 9, 2015

I previously reviewed the 16th, 20th, and 21st editions of this book with five star ratings, and this 22nd edition is certainly of the same quality. Unfortunately, I believe that the changes from the 21st edition are relatively minor (except for technical data updating), and there is no preface that highlights these changes. In addition, on Scott Mueller's Upgrading and Repairing PCs Forum he posted as recently as October 23, 2015 (http://forum.scottmueller.com/viewtopic.php?f=3&t=3100) that Unfortunately I don't currently recommend any Windows versions beyond Windows 7. This is reflected in this book with scant coverage of these Windows editions, although in fairness this is not the focus of this book and Windows 10 is still very recent. I would therefore suggest and recommend that Scott Mueller update and reissue his Upgrading and Repairing Microsoft Windows, 2nd Edition last released in 2008 for Vista and XP.

This 22nd edition continues to deliver the most authoritative, current, and comprehensive reference on everything associated with computer hardware; includes an instructional and reference DVD; and an online "Bonus Content" that includes additional videos and the complete 19th and 20th editions of this book (in PDF format). Since this book contains older and obsolete information that is readily available in prior online PDF editions, future editions might eliminate much of this information for a smaller but more current tome. Technical data changes too fast to be current, but the historical perspectives, conceptual diagrams and figures, and how-to techniques that reference online data sources would be invaluable.

Having used previous editions for over ten years, my appreciation and usage of this book has increased to the point that I keep this book readily available. The historical backgrounds are especially invaluable in understanding the current state of computer hardware and how we got there. This information is probably available on the Internet by searching multiple sites, but in this book it is already all there in one place in a very easy to understand format. The time saved from this convenience can not be overstated.

To supplement this book Scott Mueller still has a forum website (http://forum.scottmueller.com) for updated information, questions, and comments related to all aspects of the book. In addition the Que Store book reference page also has excellent free DVD videos, resources, and articles to supplement this book (that are updated daily).

From prior personal experience with Upgrading and Repairing PCs, I have always found the content to be very accurate, informative and useful. I have never read an entire book, but I know what is available and where to find it, and when you need the information it is very satisfying to know that you have it readily accessible. I very strongly recommend it as a learning, self help, and reference tool and I have no doubt that anyone who wants to know more about computers will also find this book equally valuable. It's excellent for a computer technician, but a little too large and too extensive for the average person.
1865356
This slim volume presents a series of testing techniques, dubbed

 "attacks", that target common software errors. The list is based on an

 empirical analysis of a large number of bugs found in commercial

 software by the software testing labs at the Florida Institute of

 Technology. Each attack is illustrated with an actual bug found in

 everyday software. The analysis and the examples are mostly drawn from

 Microsoft software.
3722790
This book details the first known nation-state attack against another country's physical infrastructure. The story of how malware researchers uncovered the techniques used by the designers of Stuxnet  widely believed to be the US and Israel  is a fascinating tale of sleuthing, aided by minuscule mistakes of the attacking organizations. I highly recommend this book to any reader interested in the subject. I have already recommended it to former colleagues whose professional experience includes cyber-defense of industrial infrastructure
3443389
Clear, concise and to the point examples back up a well thought through and sensibly paced book.
I liked the way that win32 issues were clearly dealt with - no'more trying to work out why your UNIX based examples don't  work.
This book is excellent value for the $$ - you'll easily recoup in  saved time the cover price.
Tom
3550798
The book has 20 hacker scenarios, the writer provides log samples and information regarding each incident, and you need to determine who,when,what and where. Each scenario has answer/solutions section to each incident where the forensic analyst provides their insight into each. I do security as my profession so Im always looking for more examples of intrusions and how they are analyzed. I will most likely buy the rest in the series, this book was fun.
2293748
I run a technical support web site, and this is a book I'd wish I'd written. Since Allen got to it first, I expect I'll be pointing people to it frequently as I answer their questions.

One of the major reasons Windows becomes unstable over time is something I've heard referred to as "software rot". Do nothing but use your computer in normal ways, and over time, it will slow down, and possibly even become unstable. The system will "rot" out from underneath you.

Cleaning Windows XP for Dummies is a great step-by-step guide to not only "cleaning up" your Windows programs, data, processes, disks and more, but more importantly, keeping your system clean and preventing that rot from happening. It's as much about slightly altering how you use your computer to keep it clean, as much as it is about that initial remedial clean-up.

Advanced topics include how Windows uses memory, getting a handle on Security, Windows Networking, the Windows Registry and more. The book closes with 4 "Top Ten" lists ranging from troubleshooting ideas to online resources.

The book is an easy read, and targeted at the novice or less experienced user. There are plenty of examples, as well as warnings along the way when you might venture into areas that require caution.

I've always been a little leery of the "for dummies" types of books. I've been concerned that they would take too simplistic an approach for the material to actually be useful in the long run. I'm happy to say that Cleaning Windows XP for Dummies is not only a useful how-to book for the average user interested in getting the most out of Windows XP, but will also serve as a handy reference for the life of your Windows XP installation.
4864619
Whenever someone asks me about computer security, I try to differentiate between two concepts defensive security (Cisco, McAfee, Checkpoint, Policies, Procedures, Rules, etc) and offensive security (Pen-testing, ethical hacking, etc). This book is an absolute guide for IT & network professionals who wish to explore the offensive security world. Especially those who have prior knowledge and experience with information security concepts or hold basic certification like Security + or CISSP. Today, many penetration testing courses offer the insights of offensive security through BackTrack operating system, not just because it is a hacking platform but it also leverages the process of penetration testing in a systematic order. The book begins with a brief history, description, installation and configuration of BackTrack 4. It also explains how to handle various types of installations (Virtualization, HDD, USB), and how to start-up and running your own BackTrack 4 copy in just few steps.

Reading through the initial chapters you will encounter the core pen-testing concepts and descriptions of various assessment methodologies. They are explained very clearly and precisely as a whole. You will also find explanations of best security assessment tools, their options usage and results interpretation, and pen-testing project management and reporting guidelines. What I most like about this book is that the tools are well-organized in penetration testing methodology shown with practical examples and best yet, compatible with BackTrack 5 too. I hope the authors will take out an update of this book for BackTrack 5 soon. It is a great addition to my information warfare arsenal.
2163377
I am new to the Security field studying a master and found this book very useful for a Term Project. It is pretty much updated and gave a very good insigth on some of the best hacking techniques.

Jose
2517394
If you run Windows XP and you're annoyed by the number of things you can't do (or so says Microsoft), you'll love this book...  Windows XP Hacks & Mods For Dummies by Woody Leonhard.

Contents:

Part 1 - The Nuts & Bolts of Hacks & Mods: Windows XP - What's Not to Love?; Tools of the Hacking Trade; A Quick XP Makeover

Part 2 - Controlling the Look and Feel of Windows XP: TweakUI, the Power User's PowerToy; Pinning Down the Start Menu; Taking On the Taskbar; Decking Out the Desktop

Part 3 - Adjusting Everyday Activities: Reining In Windows Explorer; Cool Keyboard Hacks and Menu Mods; Searching on the Desktop; Switching to Better Online Software; Pulling Off Pictures

Part 4 - Modding to Monitor and Manage: Seeing What's Happening; Decoding IDs, Accounts, and Passwords; Using Remote Assistance; Retooling Disks

Part 5 - Protecting Yourself (And Your PC): Changing (In)Security Settings; Taking the "Mal" out of Malware; Keeping Your Privates Private

Part 6 - Entertaining Yourself: Making the Most of Media Player; Buying Music and Videos; Trading Music and Videos; Getting Games to Work

Part 7 - The Part of Tens: Ten Steps to Mastering the Registry; Ten Speed-Up Hacks - Maybe

Index

This was one of the most entertainingly informative books I've had the pleasure of reading in awhile.  Leonhard is not at all a fan of Microsoft and his cynicism drips on every page.  Things I normally take for granted as "that's just the way it works" are dissected, and ways to hack around them are outlined.  For instance, perhaps you don't like the way that the roller wheel on your mouse scrolls more than one line at a time.  Woody shows you how to download the TweakUI powertoy from Microsoft, which has the ability to tweak that setting and seemingly a hundred more.  He also suggests a number of other software packages (non-Microsoft, of course) to allow you to have a more safe and secure computing experience.  Substitute Firefox for IE.  Switch out MSN for Trillian or Gaim.  Basically, you'll find dozens of gems in these chapters that will quickly pay back your investment in time and dollars with the book.  Plus, you'll have fun reading it.  Leonhard's a great writer...

Definitely a recommended volume to have at hand for your Windows XP computing experience...
3589921
An appreciation by Phillip Taylor MBE and Elizabeth Taylor of Richmond Green Chambers

It's been a while since we reviewed the first edition of this excellent book- seven years to be precise. It remains a massive support source for those of us involved in adducing identification (`ID') evidence in mainly criminal and some civil proceedings. Jordans have taken over publication and Paul Bogan QC is joined by the distinguished academic, Andrew Roberts, for this new second edition.

This subject area is top heavy with case law and, as the authors observe, the Court of Appeal decisions represent a significant proportion of appellate business so their fair share of unsafe convictions does reflect the special place ID evidence occupies in the investigation and prosecution of crime.

The structure of the books has remained much the same with an introduction followed by Parts on investigation, Trial and Scientific Evidence. What is new is the much expanded text on the psychology of ID evidence, and the changes in Part 1 of the book covering Code D.

The other principal change is the provision of more detailed guidance on the procedures for obtaining evidence of recognition from images. Bogan and Roberts provide an outline of the prospective legislative reform of what they describe as the on-going jurisprudential saga over the retention and use of fingerprint and DNA samples involving unconvicted suspects- as we have seen, this issue will run and run.

The effect of the 2003 CJA on hearsay and bad character have led to the reworking of the main chapter in Part 2 looking at admissibility and exclusion of evidence at trial and this will be of great assistance to Defence Counsel. The digest of recent case law is particularly helpful here.

With the continued advances in forensic science, the law has not stood still so the chapters in Part 3 have been revised. Of significance is the rewritten text of the DNA chapter giving us a greater understanding of the science, the forensic techniques, the statistical analysis of the findings and the potential shortcomings which we have with ID evidence.

As the authors say, the contribution of two minds rather than one, combining academic and practical expertise, gives the practitioner assistance in the original aim of the book which is to provide a better understanding of the law and practice relating to identification.

In just under 600 pages with 18 chapters and six important appendices, the criminal practitioner is given a thorough insight into this area of criminal practice.  We said of the first edition that this is a gem of a book for practitioners because it brings together all the difficulties associated with adducing ID evidence on both sides. It still is and a fundamental title for your criminal practice library!
3596636
PGP: Pretty Good Privacy

Simson Garfinkel

ISBN: 1-56592-098-8

Although out-of-print and out-of-date by technology standards,

I decided to read this book to get a perspective of security from the point of view of the 1990's. I found the book to be an excellent historical reference. Obviously, the author did not originally write the book as a history lesson, but because PGP and encryption in general have advanced the book now appears this way.

For those interested in the history of computer technology, this book is fun and although out-of-print, fairly easy to acquire.

The book is well-written and easy to read.

I recommend O'Reilly's "PGP and GPG" for those looking for a modern reference on using PGP in a practical setting.
1271889
Excerpt from C# Online. NET Review (wiki. CSharp-Online. NET):

"I have read many Sgt. Joe Friday accounts of Windows security--"Just the facts, Ma'am"--; but, Windows security remained an occult subject to me. However, this book enables me to program security functions and to understand what I am doing. The book explains the user-based security of Windows operating systems based on Windows NT including Windows 2000, Windows XP Professsional, and Windows Server 2003."
154184
With a constantly changing world in the specialized world of Digital Forensics, one thing is the basics don't change.  Criminal elements and terrorists reign strong in this Digital realm.  This book gives us an understanding into making an impact via Forensics into this realm.  Everyone who reads this book will gain great insight - not just those in the warfighter theater.  Stephen Pearson and Richard Watson do an excellent job in making the model for Digital Forensics understandable and useable.  A must read for anyone concerned with doing Forensics right!
4251881
This is a great book for those wanting a bit more context surrounding security and forensic analysis or those curious about how attacks are constructed. Each chapter is capable of being read on its own so you can cherry-pick subjects that interest you. As can be expected, it's full of Python code which provides useful and fun examples. You do not have to be a very advanced python programmer as te book includes enough information to help even those who have never coded in Python before. To me, having an intermediate knowledge of security matters, the topics covered were enlightening and I'm sure readers from differing backgrounds will find valuable lessons. For those interested in the Wireless Mayhem chapter be aware that it does require purchase of a Hawking Hi-Gain wireless 150N Network Adapter; this was available in my area but may not be in yours. The anecdotes in the "From the Trenches" side bars and the books practical nature were particularly appealing. Editors of this book did let the author down quite a bit. There are many poorly constructed sentences and even some I could not decipher at all. Never-the-less the topics covered are so interesting that I tolerated the flawed writing and found it an enjoyable read. This will certainly get you thinking about refining your strategy for security in the products you develop and the environment you work in.
2923206
As you can find in their individual reviews, each book received high marks on its own merit.  Put together and this set of three books cannot be beat in the area of system and network forensics.

Although not entrenched in the area of forensics, I do feel that I have a strong technical background upon which to build.  I found this series of books refocusing me to think more like a forensics investigator.  Not only did I have the opportunity to dig deeper into specific technology areas, but it also reinforced the concepts through scenarios.

Not for the faint of heart, this practical set of books expects you to have a decent technical background to make the best use of it.  If you are interested in taking your forensics know-how to the next level, this is a great reference set to be added to your library.
621675
Covers almost all Internal Windows systems.  Get both volumes!  This is a critical resource if you must reverse engineer malware, or write kernel level code in Windows!