I am a senior engineer for network security operations. I bought "Handbook of Computer Crime Investigation" (HoCCI) to expand my knowledge of incident response and digital forensics. While "Incident Response" by Mandia, Prosise, and Pepe remains my top pick, HoCCI contains enough original material to qualify as recommended reading.
HoCCI is a collection of 14 distinct chapters written by 17 authors. The book's main audience appears to be law enforcement personnel, and Academic Press markets the book as a title in its "Forensic Science" catalog. The introduction states the book is written for "forensic examiners" who testify in court, although anyone performing digital forensics will find useful sections.
Some of HoCCI's strengths include numerous case studies. Ch. 2 offers examples of "ineffective" and "effective" disclosure and production of digital records in legal proceedings. Chs. 12, 13, and 14 are dedicated to factual legal and incident response scenarios. Reading these anecdotes, I perceived most of the 17 authors to be extremely familiar with their field.
Beyond helpful case studies, HoCCI provides several strong technical chapters. Bob Sheldon's Windows section (ch. 7) is excellent, and Ronald van der Knijff's embedded systems essay (ch. 11) explains the cutting edge of digital forensics. His discussions of directly reading FLASH and EEPROM memory, and using power analysis to break passwords, are impressive. I enjoyed Steve Romig's explanation of using Cisco NetFlow logs in ch. 4, and found the descriptions of wireless systems in ch. 10 to be useful.
HoCCI is not without faults. Several chapters seem like product advertisements; EnCase is the focus of ch. 3, while NFR's IDS appears in ch. 5. The network analysis section (ch. 9) repeats the much-quoted myth that TCP sequence numbers count packets; they actually count bytes of application data.
Overall, HoCCI is a useful supplement to Foundstone's "Incident Response." HoCCI may spend too many pages describing how to search hard drives for remnants of illicit images, illegal software, or harassing emails. Fortunately, its technical content distinguishes it from "Computer Forensics" by Kruse and Heiser and "Incident Response: A Strategic Guide" by Schultz and Shumway.