Hi everyone
I just started doing a degree in Applied Science and Forensic Investigation. I have an interest in Computer forensics, but I don't really know where to start. I'm thinking of changing my course if my interest grows, but I want to read more on it. Are there any good books which anyone can recommend as I don't really know where to start. I know File System Forensic Analysis is supposed to be a good read to start off with. But are there any other books that can help me?
Thanx
Rave
Welcome from another newbie! The book recommended to me on my recent arrival and which I will recommend to you is Forensic Computing A Practitioner's Guide, by Tony Sammes and Brian Jenkinson. You can find it
KP
FSFA is certainly good but might be a little overly technical/dry as a first read if you're coming from a non-computing background. I agree with the two choices suggested by KP and debaser_ and would probably recommend the Casey book first and then the practitioner's guide if your appetite is suitably whetted.
Jamie
I've found Forensic Discovery by Dan Farmer, Wietse Venema a very good read also Chad Steel's Windows Forencis also good read.
Chris
> 've found Forensic Discovery by Dan Farmer, Wietse Venema a very good read
This is a very good read, and there is an excellent section on moving away from the traditional CF approach to obtaining and using live response data as evidence.
> also Chad Steel's Windows Forencis also good read.
It's a good start, and covers some stuff that useful to know for imaging purposes, but doesn't go into nearly the amount of detail you need to do a thorough examination of a Windows system.
"It's a good start, and covers some stuff that useful to know for imaging purposes, but doesn't go into nearly the amount of detail you need to do a thorough examination of a Windows system"
I agree with that. That's why I purchased your book -), and "Real Digital Forensics"
Thanks for purchasing my book…but even RDF is limited. It's about on the same level as WF, by Steel, in many respects (regarding the Windows information only).