All,
I recently spoke to an editor for the publishing company that produced my first book, as I'm working on a second one. When the editor spoke to others, the issue of visibility came up. Even though my book has been available for well over a year, and it's the only book that addresses Windows forensics and response as it's sole topic, there just doesn't seem to be much visibility.
Since many of the readers of this list are in Europe, and specifically the UK, I thought this would be a good place to ask…what are ways in which information (not just a book) can be made more visible?
I've posted to lists like this one. My book got Slashdotted shortly after being published (Nov '04, actually). Since then, I've published articles on USB device artifacts in the Registry, code for parsing various file formats, etc. Yet, just about every week, I run into people (online and in the real world) that say, "man, I wish I knew about this…", and I direct them to what I wrote.
My question is…how does one go about being more visible? I'm not talking about famous…I'm asking how, if you have something folks might want or find very useful, do you go about getting the information out there and available? I know that we're talking about different groups here…forensic analysts, LEOs, and I'm even going to throw sysadmins and college/university students, as well…but the question remains the same - how does one get information out there?
Thanks,
Harlan
I think what you offer as a community member is the best way to "spread the word". I enjoyed your book and have used it and passed it on. The fact that you are very open to others about your work is a testament to your dedication to the field.
Harlan,
Your work is already visible. However, one way to increase your visibility is to optimize your work for search engines. If I'm heading in the right direction with this, you need to get your name to be synonymous with windows and forensics/IR and the work you are doing. I'm no search engine geek, but I just did a quick search for windows forensics, and your book showed up in 3rd. Your work did not show up, just your book.
That said, your work and name are well known in the industry. When people ask me what resources to use to get started, I give them a list of three books and yours is one of them.
unasked for advice –
One of the contacts I have and respect told me once to stop trying so damn hard and it (it being visibility, success etc) will happen. You push your book an awful lot, and while it's a good book, the field is littered with them these days and books are only interesting to people that have time to read them. Your work needs to separate you from the field in order for people to value it. Incident response is a known field. Concentrate on all of the interesting things you've done in the past year and expand on them. The registry work is absolutely fascinating, the USB work was fascinating –NO ONE else had done it. The down side of academic work is that it's only interesting to academics.
In an instant gratification world that the internet has created, people want a tool that is simple, accurate, fast and that they could teach others to use, and they don't want to do anything with it other than use it.
Keep doing the work that no one else is doing, and preach it and the supporting tools you've created and your visibility will increase. Create a sourceforge project or two.
One example..
FSP –bring it out of the PoC phase and develop it. Make it so that people like those on this forum would be more likely to use it than they would WFT or other tools.
Another example –
You mentioned a timeline utility in your blog some time ago. Why not work on it?
Hope that helps.
You could submit further articles for publication here and include a link to your homepage or the relevant page at Amazon in the byline.
Jamie
> Your work is already visible.
Well, according to what I'm hearing from the publisher, evidently not enough. At least, what you see as "visibility" isn't mapping to book sales. The effect is that it hampers getting another book out…yes, I could self-publish but I'm not sure if I'm ready to engage in that big of an enterprise.
I know what you mean about some of the projects…but with the timeline one I actually was asking for help, but never got anything back. The problem with big projects like that is there are plenty of folks willing to say, "yeah, I would like something like that", but few are willing to actually step up and help.
Anyway, while I'm waiting on the editor to respond, I'm going to prioritize and complete some projects.
Thanks,
Harlan