Mastering Windows Network Forensics and Investigation

Very good book for learning a lot of interesting security threats. It brings you through a quick review of network infrastructure, and then dives into how to exploit it, analyze it, and what to look for when conducting an investigation of a windows network environment.

I read this book to prepare for a computer forensics class. It is one of the best computer books I have read. It covers a lot of material that I wish was covered in my MCSA classes. This book really filled in a lot of holes in my knowledge. The authors make a point of emphasizing real-world skills and pitfalls to avoid. I highly recommend this book for all network admins and investigators.

This book skillfully combines real world network security with law enforcement investigative techniques to deliver a text which will enable you to make the right decisions based on the unique circumstances and facts of each event you are called on to investigate. I consider this book a must have for anyone in network administration, network security or on a computer emergency response team. The techniques and information contained within are, without a doubt, missing from almost all other books and training you have received.

As a law enforcement officer, I've often found myself frustrated by books that cover incident response, but never discuss law enforcement involvement, except as an afterthought. While I understand that it's important for corporate and internal investigators to have this type of information, it's refreshing to find a book that talks about the law enforcement response to an computer crime incident. I've had the privilege of attending classes instructed by both of these authors. One of the things that impressed me about their classes is that they were able to break down complicated technical concepts into terms that cops can understand. They continue to do that in this book. Computer crime investigators need to add this book to their libraries. I'd say it's a must have.

I have been a federal agent and computer forensic examiner for over 10 years and this is the first book I have found that covers the areas of network forensics and live analysis techniques. Most books will cover how to conduct a standard forensic exam of a stand alone computer, but this book goes into detail on how to conduct forensic exams on networks and find the evidence left behind. I really learned a lot through the excellent screen captures and "how tos" that walk you through the process. The authors cover the forensic exam as well as the invetigation which is very helpful. I highly recommend this book to anyone who works in the arena of computer crime, ecspecially intrusion investigations and computer forensics.