Most Helpful Customer Reviews
7 of 7 people found the following review helpful:
5.0 out of 5 stars
The building blocks of forensic computing ..., 16 Jan 2007
This review is from: Forensic Computing: A Practitioner's Guide (Practitioner Series) (Paperback)
I read this book as part of a course on Forensic Computing. In initially I agreed with the other reviewer who said that it was out of date and basic in places. However as I progressed with the course, it became obvious that this book starts off with telling you what you NEED to know, it isn't that it is out of date, it is a historical reference to the way that things are now. All the modern computer systems are derived from things that were created 30 years ago now, and mostly are hacks and kludges to make them work with the newer hardware as it is created. A fundamental understanding of these details will set you in good stead for the later chapters which detail more ...
I would strongly disagree that this wouldn't be something that I would want to rely on in court, I like being able to explain why things are done the way they are rather than just regurgitating "Because that's what EnCase says ..."
There is a new edition of this book out soon, I would reccomend that anyone who is interested waits a few months if they can - there are all the basics there, but with more elaboration on the more modern issues.
The best book for a beginner, and I've read them all ... Get Brian Carriers File System Analysis _after_ this ...
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
5 of 6 people found the following review helpful:
5.0 out of 5 stars
The "A Reader" from the year 2000 review., 8 Sep 2007
The reader identified in the heading obviously does not have a clue and is probably just a point and click examiner. The other reviewers have this book spot on. It is not like most computer forensic books that tell you to "Run this and you will get this result" or "doing this process will help you find XYZ". Any monkey can follow instruction, when you are in court you need to know what you are talking about and that is what this book gives you "Knowledge".
This book first explains how the hardware works and why it does what it does. It then goes on to explain file systems and structures and about processes etc.. As for the comment about outdated file system information! The FAT file system is more popular now than ever. It is on every digital camera, most MP3 players and USB thumb drives and every kind of flash media. It is also the only file system that is visible to every operating system.
Amazon do appear to have made a mistake though. The book cover shown is for the latest release but these reviews are for the first edition!
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
23 of 30 people found the following review helpful:
1.0 out of 5 stars
As a "practitioner's guide" it's a disaster, 12 Sep 2000
By A Customer
This review is from: Forensic Computing: A Practitioner's Guide (Practitioner Series) (Paperback)
This book is a typical academic effort: out of date, superficial and idiosyncratic in emphasis. Three quarters of the text are devoted to "how a PC works" and how data get stored on disks. In spite of being published in Autumn 2000, this material concentrates exclusively on obsolete equipment: FAT16, BIOS I/O and DOS/16 bit operating systems, with a cursory nod in the direction of fast processors and SIMM memory. There is no mention even of long file names, FAT32 or NTFS, networks. or modern concealment techniques such as image steganography. None of this "technical" material would be sufficient to equip a newcomer to safely handle electronic evidence, but it should be commonplace to anyone professionally involved in forensic computing. The real reason one would buy the book (discussion of forensic treatment) is relegated to a single chapter of 21 pages (out of 288) on PCs and [...] 17 pages on electronic organisers. These small chapters are not quite as bad as the rest, but still emphasise obsolete technologies and make sweeping generalisations which leave the reader to make largely unassisted decisions. It is not helpful to be told "The integrity of ... data must be preserved; therefore we ... use non-intrusive examination techniques..." without such techniques being discussed in detail anywhere in the book. Nor do I believe that one and a half pages of text and five small photos are an adequate induction into probing the circuit board of a seized organizer, nor that such techniques could be deemed "non-intrusive" except when done by those skilful enough not to need this book. I would not like to have to rely in court on evidence gathered solely on the basis of this book. Definitely not worth the money: there are better books on PC and disk technologies, and the forensic techniques are too superficially described to be of any value. It was a big disappointment to me.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
|