Need a list of digital forensic publications

Where have you looked so far?

Hi,

I think you haven't tried seriously. If you google there is plenty of information from the length and breath of the globe - try it. And if you still don't find then pm.

Brave Heart.

One of those very frustrating I didn't look anywhere type posts.

Need a list of digital forensic publications
Good material on Malicious Javascript, etc
Looking for whitepapers on Conditions/keywords
The difference b/t ntuser.dat and NTUSER.DAT

All questions within the first few google hits.

I'm beginning to like Doug's latest approach Where have you looked, if no response from the OP, then there should be no answer.

I'm beginning to like Doug's latest approach Where have you looked, if no response from the OP, then there should be no answer.

I do agree that it's a bit ridiculous some of the questions like "which programs should I use" etc. BUT the line has to be drawn in the sand somewhere with the "did you try looking?" approach. Case in point, forums are for information sharing.

Conceivably 99% of questions that anyone could ask have been answered at least once somewhere on the internet. As a troll, it's frustrating to to see every thread end with "did you look?" That's not information sharing that's being unfriendly. The old adage "if you don't have something nice to say…" comes to mind. This isn't unique to just this forum or industry, but rather something everyone feels is necessary on forums.

And yes, I'm also aware that it is frustrating as a reader/contributer to see the same questions asked over and over that have already been answered. It's pretty easy to just skip over these though, or provide a link to the thread where it's already been discussed.

Don't want to hijack this persons thread any more, but just food for thought… next time, if no one responds to a post, you can assume they started looking for themselves elsewhere wink

And in all fairness you have been here 2 months and have 11 posts.
As you say just skip over threads, you could be also asked to do the exact same thing.

The arguments you make, can be used without changing anything, against you, using the same logic.

I think you may be missing a lot of the points which have been made regarding these type of posts, but what about all the very good posts which get bumped off pages in favor of a "I'm too lazy to use Google or the search feature thread"

To your point of information sharing, what do the OP's provide in this "information sharing" process? Most of the time they only post questions, no updates.

This is an investigative field, it reflects incredibly poorly on an individual when they can't find something in the first few hits of Google, or in a search function. I go back to pondering (as I've said in previous posts) how good of a job can someone be doing who doesn't have the basic talents to research and investigate.

Notice that a lot of frequent posters or people who have been around a long time don't post those type of questions because like you said the information is out there, and it's found and used.

I'm pretty sure it's no loss if I leave the forum, heck several people would probably hold the door and then be happy to slam it for me. However, already some people are heading out because of the number of posts where people in a profession which requires thinking, investigating, problem solving, and all that goes with it just deciding it's easier to say "I need to know where the index.dat is" I've complained about it in the past, I'm in the minority, but I sure would hate to see this forum turn into a CFW forum as I've dedicated a bit of time and years here.

I'm beginning to like Doug's latest approach Where have you looked, if no response from the OP, then there should be no answer.

I do agree that it's a bit ridiculous some of the questions like "which programs should I use" etc. BUT the line has to be drawn in the sand somewhere with the "did you try looking?" approach. Case in point, forums are for information sharing.

Conceivably 99% of questions that anyone could ask have been answered at least once somewhere on the internet. As a troll, it's frustrating to to see every thread end with "did you look?" That's not information sharing that's being unfriendly. The old adage "if you don't have something nice to say…" comes to mind. This isn't unique to just this forum or industry, but rather something everyone feels is necessary on forums.

And yes, I'm also aware that it is frustrating as a reader/contributer to see the same questions asked over and over that have already been answered. It's pretty easy to just skip over these though, or provide a link to the thread where it's already been discussed.

Don't want to hijack this persons thread any more, but just food for thought… next time, if no one responds to a post, you can assume they started looking for themselves elsewhere wink

http//en.wikipedia.org/wiki/Computer_forensics#Related_journals

scroll down once you get to this page. It shows computer forensic journals and magazines.

L

I have been uber reactive in my posts such as that because a lot of posts have been

What tool/book to by?
What cert should I get?
I did something and 2 + 2 doesn't equal 4. Why?

It is the way the question is posed that becomes frustrating because there is no context.

When posting questions it does help (if allowed-is discoverable) to post as much of the background as possible

Here is my problem.
Hardware, OS, versions, partitions, files system, etc.
Here was my approach.
Here is what tool(s) I used.
Here is why I used it/them.
Here is how I understand the tools work.
Here are the parameters of my findings so far.
Here is where else I have looked.
Here is what I don't understand.

Jobs/certs
Background, experience, goals

Books/blogs/websites/mags
Here is what I found
Here is where I looked
Here is what I think about them

To even get to the question stage you would have inherently go though some searching to see that there might have been something posted here or elsewhere that could be added to your methodology or thought processes first before asking.

This is a field that requires critical thinking, problem solving skills, resourcefulness and the ability to question yourself first about the actions taken to come to a conclusion. If you are not liking or understanding the results, then it is possible that you are not looking at everything or flawed in another part of your methodology.

I might look like a link w***e or a little b**t-kissy to others with some of my posts, but it is to only show that it is important to step back, take a breath and realize that the answers to many questions are probably out there already. There are people in the field that have done valuable research for no fame or money and it is a disservice to them to want easy answers. Most of the time you will see that there was a level of reasoning and methodology to their findings. Even if you are looking at one area of analysis, your results can be improved by understating how other areas work as well. IMO learning the methodology to how the conclusions are derived is important information and the basis to the forensic science.

I'd like to weigh in on this topic.

First off, I agree completely with Mr. Brush. Sometimes these types of inquiries come off sounding to me like, "Please spoon feed me the answers. I don't want to do the research". It's an insult to those who have made their bones, who have put in the effort.

I seldom (if ever) post questions. Frankly, I'm intimidated by some of the "Where have you looked so far" responses that occur so often. BUT!!!! what I have learned is that when I anticipate that kind of response and dig deeper…the Internet is a magnificent resource…I usually end up finding the answer on my own. And then some. I think it's made me a better examiner and increases my confidence in being able to solve problems on my own.

IMHO the proper way to post a question like this is I'm looking at a list of forensic magazines and publications. I have found

a
b
c
d
e
Can someone here offer an opinion on which would be the most valuable for someone with my level of experience.

Thanks for hearing me out.

I understand the frustration of the more experienced members here, but I do think no answer at all would be better. The way things are going the answer to where have you looked could soon be "I searched the forums and read dozens of threads where the question was asked, but was never answered as the discussion turned to whether it's more spoon feed someone an answer or make them look for it themselves."

I do think it's a good idea for people to search for the answers on their own, but I think this tactic does more harm than good by polluting the search results and making it harder for those that are searching on their own.

Hope I'm not alienating myself by disagreeing with the more senior members, but just wanted to add my $.02.

7