Download EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting
Also we talk about guides EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting; you may not locate the printed books right here. Numerous collections are offered in soft data. It will precisely give you more advantages. Why? The initial is that you could not have to carry the book anywhere by fulfilling the bag with this EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting It is for the book is in soft documents, so you could wait in gizmo. Then, you can open up the gadget all over as well as review the book effectively. Those are some few benefits that can be got. So, take all advantages of getting this soft documents book EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting in this website by downloading and install in web link offered.
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting
Download EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting
Spend your time even for simply few minutes to read an e-book EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting Reading a publication will certainly never ever lower and also squander your time to be useless. Checking out, for some people become a requirement that is to do on a daily basis such as hanging out for eating. Now, what concerning you? Do you prefer to check out a book? Now, we will certainly show you a new e-book entitled EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting that can be a new way to discover the knowledge. When reviewing this publication, you can obtain one thing to always bear in mind in every reading time, even detailed.
Yet, what's your issue not too liked reading EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting It is a fantastic task that will consistently give great advantages. Why you come to be so weird of it? Lots of things can be reasonable why individuals don't prefer to review EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting It can be the uninteresting activities, guide EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting collections to check out, also lazy to bring nooks anywhere. Today, for this EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting, you will certainly begin to like reading. Why? Do you understand why? Read this web page by finished.
Starting from visiting this site, you have aimed to start loving reviewing a publication EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting This is specialized site that offer hundreds compilations of publications EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting from whole lots sources. So, you won't be burnt out more to choose the book. Besides, if you also have no time to look the book EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting, just sit when you remain in office and also open the browser. You could discover this EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting inn this internet site by connecting to the web.
Obtain the link to download this EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting and begin downloading and install. You can want the download soft documents of the book EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting by going through various other activities. And that's all done. Now, your count on check out a book is not always taking and carrying guide EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting everywhere you go. You can save the soft data in your gadget that will never ever be away as well as read it as you such as. It is like reviewing story tale from your device then. Currently, start to enjoy reading EnCase Computer Forensics, Includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, By Steve Bunting and also get your brand-new life!
EnCE certification tells the world that you've not only mastered the use of EnCase Forensic Software, but also that you have acquired the in-depth forensics knowledge and techniques you need to conduct complex computer examinations. This official study guide, written by a law enforcement professional who is an expert in EnCE and computer forensics, provides the complete instruction, advanced testing software, and solid techniques you need to prepare for the exam.
Note: CD-ROM/DVD and other supplementary materials are not included as part of eBook file.
- Sales Rank: #1228133 in Books
- Published on: 2007-12-05
- Original language: English
- Number of items: 1
- Dimensions: 9.30" h x 1.40" w x 7.50" l, 2.19 pounds
- Binding: Paperback
- 648 pages
From the Back Cover
Fully revised for the very latest EnCE exam and EnCase software
EnCE certification tells the world that you've not only mastered the use of EnCase Forensic Software, but also that you have acquired the in-depth forensics knowledge and techniques you need to conduct complex computer examinations. This official study guide, written by a law enforcement professional who is an expert in EnCE and computer forensics, provides the complete instruction, advanced testing software, and solid techniques you need to prepare for the exam.
Key topics include:
-
Understanding Computer Hardware. Understanding computer components, boot processes, partitions, and files systems, so you can explain them to a jury
-
First Response. What to do and how to follow procedures when first entering a scene
-
Acquisition of Digital Evidence. Creating EnCase boot disks; booting with EnCase boot disks; and drive-to-drive, network cable, FastBloc, Linen, and Enterprise acquisitions
-
EnCase Forensic Software Overview. Tour of EnCase environment including software, menus, and capabilities
-
Report Writing. Sample reports from real-life cases (names changed)
-
EnCase Legal Journal. Essential information on operating within the law and giving expert testimony
Look inside for complete coverage of all exam objectives.
About the Author
Steve Bunting, EnCE, CCFT, is a Captain with the University of Delaware Police Department where he is responsible for computer forensics, video forensics, and investigations involving computers. With over 30 years of experience in law enforcement, Steve has conducted computer forensic examinations for local, state, and federal agencies and has testified in court on numerous occasions as a computer forensics expert. He is coauthor of Mastering Windows Network Forensics and Investigation (Sybex).
Most helpful customer reviews
44 of 45 people found the following review helpful.
For help with EnCase in book form, start here
By Richard Bejtlich
I decided to read and review three digital forensics books in order to gauge their strengths and weaknesses: "File System Forensic Analysis" (FSFA) by Brian Carrier, "Windows Forensics" (WF) by Chad Steel, and "EnCase Computer Forensics" (ECF) by Steve Bunting and William Wei. All three books contain the word "forensics" in the title, but they are very different. If you want authoritative and deeply technical guidance on understanding file systems, read FSFA. If you want to focus on understanding Windows from an investigator's standpoint, read WA. If you want to know more about EnCase (and are willing to tolerate or ignore information about forensics itself), read ECF.
In the spirit of full disclosure I should mention I am co-author of a forensics book ("Real Digital Forensics") and Brian Carrier cites my book "The Tao of Network Security Monitoring" on p 10. I tried to not let those facts sway my reviews.
In terms of overall book value, ECF is the weakest of the three previously mentioned -- but it is the only book on EnCase. As such it is the one independent book which will help you understand the king of the commercial forensics world. I was particularly interested in using the accompanying DVD, which offered a demo version of EnCase. I did encounter the same limitations as mentioned in previous reviews, but I was able to at least perform most of the numbered exercises in the text. I thought the fairly crippled version of EnCase packaged with the book was a drawback, but I know Guidance Software is paranoid about even discussing their product outside of their training environment.
As far as covering EnCase goes, ECF is a pretty good book. I am an EnCase newbie, but I was able to follow most of the book's discussion of the product's interface. Since the lead author is a police officer, I also thought that perspective was valuable. His mindset appeared in the chapter where securing the crime scene was discussed. The inclusion of short case studies also kept the tone lively and relevant.
I had two major problems with ECF, hence the three star review. First, a book that includes a demo copy of EnCase and sample evidence files should use them throughout the text. When introducing EnCase's interface, use a sample evidence file from the DVD so the reader can follow along. While the book's exercises use the DVD evidence files, the textual explanation of the interface seldom do. That was frustrating. The authors should have either said "You need a fully license copy of EnCase to follow along" or they should have run all their examples as if they were a reader using the sample DVD. They would have learned you can't "Add Devices" using the DVD version and you can't save bookmarks -- argh.
The second major problem I found with ECF involved indications of technical misunderstandings and questionable vernacular. Examples follow. "BSD" is not "a Linux variant" (p 91). There is no such thing as "BSD Linux" (p 231). The authors' faith in MD5 should be positioned against research from the last few years. The "approved solution" for shutting down a Unix server ("synch; synch; halt") plus lack of non-Windows material made me question the relevance of the book to non-Windows platforms. On the language side, I didn't like reading about "NIC cards" (p 381) and "RAM memory" (p 381). These are the sorts of issues that make me wonder if I'm reading another book about "the Windows," thereby undermining my faith in ECF's recommendations.
On the operational forensics side, the book is strongly in the traditional "pull the plug, image the hard drive, grep for strings" camp. This model dominated host-centric forensics for decades, but it has been largely inadequate for the past 10 years. For example, there's nothing really useful on live analysis or memory forensics. NTFS is barely addressed, unlike FAT -- another sign of being somewhat backward. I think a second edition of this book would be a lot stronger -- and it would catch the error of using the word "Sudy" on the cover in place of "Study".
Still, because this is the only book on EnCase, it does share plenty of helpful suggestions on using that software. One possible use case for the book would be using it to apply EnCase to data provided on the DVD we ship with "Real Digital Forensics," looking for Windows artifacts described in WF, based on your understanding of hard drives from Brian Carrier's FSFA.
0 of 0 people found the following review helpful.
Four Stars
By Amazon Customer
Very good indepth book
10 of 10 people found the following review helpful.
Highly recommended
By ForensicFocus.com
Steve Bunting is the head of the police computer forensics unit in Delaware and, together with co-author William Wei, a computer crime detective in New Jersey, has written an outstanding book which should find a place on every computer forensic examiner's bookshelf - even the bookshelves of those who rarely, if ever, use EnCase as a forensic tool.
This is a fairly thick book at 500 plus pages and a quick flick through reveals that the text is satisfyingly dense and interspersed with a generous number of screenshots. This is certainly not one of those technology books which tries to impress by its sheer physical size but disappoints once opened to reveal a large font and too much white space!
Although the title bills this book as "The Official EnCE EnCase Certified Examiner Study Guide" there is a huge amount of information contained within which will be of use to both the experienced investigator and keen student regardless of their forensic tool of choice. Bunting starts with a concise yet remarkably clear and in depth discussion of computer hardware in chapter 1. After covering a wide range of components he moves on to the boot process, then partitions and filesystems (in general). Even at this early stage it is clear that Bunting can write, and write well. In addition to the depth of knowledge he displays his tone is engaging and he possesses a remarkable ability to describe somewhat complicated technical subject matter with great clarity. Each chapter ends with a summary and an overview of those aspects of the EnCE exam covered, together with a set of review questions (provided, along with many of the "real world scenario" sections, by co-author William Wei). The suggested answers for these questions are included directly afterwards - much better than having to find them at the back of the book!
A more in depth discussion of filesystems takes up chapter 2 with the first real discussion of forensic procedures coming in the third chapter, "First Response". This reviewer was pleased to see "planning and preparation" given first priority in this section, an area sometimes overlooked by authors too keen to start with evidence handling procedures. In depth coverage of EnCase proper begins in the fourth chapter with coverage of the different acquisition tools and methods (boot disks, DOS acquisitions, network acquisitions, FastBloc etc.) Bunting's real-world experience shows, as it does throughout the book, and the coverage is comprehensive with discussion of the pros and cons of each method being given. The next chapter looks closely at the EnCase evidence file format and covers essential concepts such as verification and hashing.
Chapter 6 marks the start of the section of the book which will be of most use not only to those looking to pass the EnCE exam but to anyone using EnCase in a real world setting. This chapter looks at the EnCase environment and explains the form and function of the various EnCase window panes. Those coming to EnCase for the first time, or indeed those upgrading from an earlier version, will find this essential reading. Chapter 7 concentrates on understanding and searching for data, namely binary, hex, ASCII and Unicode. The next chapter covers file signature and hash analysis with a discussion of how EnCase utilises hash sets and hash libraries.
Chapter 9, "Windows Operating System Artifacts", covers a lot of ground and is one of the best explorations of Windows artifacts I have read. Starting with dates and times (and the need to adjust for time zone differences during an investigation) it goes on to cover the Recycle Bin, link files, cookies, temporary and history folders, the swap file, print spooling and more. Common ground for experienced investigators to be sure but covered in sufficient detail to warrant a read through for those practical tips which Bunting supplies in abundance. Those new to computer forensics will find a huge amount of very useful information here.
The final chapter - although not the last useful section of the book, see below for details of the appendix - covers "Advanced EnCase". Here we find information on locating and mounting partitions, registry analysis, use of EnScripts, email, the EnCase Decryption Suite and more. The appendix which follows this chapter contains details of a template created by Bunting - based on an earlier template from Roy Rector - which aims to help with the creation of presentation-quality web page reports. The methodology looks sound but as of the date of writing I have not followed the procedure in practice.
Does the book have any areas which could be improved upon? Overall the book achieves exactly what it sets out to do but if I have one criticism it would be the number of examples included on the companion DVD. The DVD includes an EnCase demo with a number of evidence files which can be used when reading later chapters to give some practical hands on experience but further examples to accompany earlier chapters would be welcome. There are instances in those early chapters where practical exercises require use of EnCase but a fully working version with accompanying dongle is required. No doubt the majority of readers will have access to licensed versions of EnCase in the workplace but it is not always possible to maintain that access at home or while travelling where I suspect many will use the book. Beyond that there are a very small number of typos but they are far fewer than those often encountered in similar works. No doubt these will be picked up in future editions and they certainly do not detract from the book as a whole (in fact even mentioning them feels like nitpicking).
Overall, this is a book with a great deal of practical information which is also a genuine pleasure to read. Highly recommended.
[...]
See all 35 customer reviews...
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting PDF
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting EPub
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting Doc
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting iBooks
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting rtf
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting Mobipocket
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting Kindle
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting PDF
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting PDF
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting PDF
EnCase Computer Forensics, includes DVD: The Official EnCE: EnCase Certified Examiner Study Guide, by Steve Bunting PDF
