Commencez à lire Windows Forensic Analysis Toolkit sur votre Kindle dans moins d'une minute. Vous n'avez pas encore de Kindle ? Achetez-le ici Ou commencez à lire dès maintenant avec l'une de nos applications de lecture Kindle gratuites.

Envoyer sur votre Kindle ou un autre appareil


Essai gratuit

Découvrez gratuitement un extrait de ce titre

Envoyer sur votre Kindle ou un autre appareil

Désolé, cet article n'est pas disponible en
Image non disponible pour la
couleur :
Image non disponible

Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 8 [Format Kindle]

Harlan Carvey

Prix conseillé : EUR 53,75 De quoi s'agit-il ?
Prix éditeur - format imprimé : EUR 53,75
Prix Kindle : EUR 37,62 TTC & envoi gratuit via réseau sans fil par Amazon Whispernet
Économisez : EUR 16,13 (30%)

App de lecture Kindle gratuite Tout le monde peut lire les livres Kindle, même sans un appareil Kindle, grâce à l'appli Kindle GRATUITE pour les smartphones, les tablettes et les ordinateurs.

Pour obtenir l'appli gratuite, saisissez votre adresse e-mail ou numéro de téléphone mobile.


Prix Amazon Neuf à partir de Occasion à partir de
Format Kindle EUR 37,62  
Broché EUR 53,75  

Les clients ayant acheté cet article ont également acheté

Cette fonction d'achat continuera à charger les articles. Pour naviguer hors de ce carrousel, veuillez utiliser votre touche de raccourci d'en-tête pour naviguer vers l'en-tête précédente ou suivante.

Descriptions du produit

Revue de presse

"...technical detail is extensive here and those realworld examples mentioned earlier are worked through in intricate detail. You will definitely want to try this at home…" -Network Security, Nov 2014

Présentation de l'éditeur

Harlan Carvey has updated Windows Forensic Analysis Toolkit, now in its fourth edition, to cover Windows 8 systems. The primary focus of this edition is on analyzing Windows 8 systems and processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. Harlan Carvey presents real-life experiences from the trenches, making the material realistic and showing the why behind the how.

The companion and toolkit materials are hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, Second Edition, which focuses primarily on XP, and Windows Forensic Analysis Toolkit, Third Edition, which focuses primarily on Windows 7.

This new fourth edition provides expanded coverage of many topics beyond Windows 8 as well, including new cradle-to-grave case examples, USB device analysis, hacking and intrusion cases, and "how would I do this" from Harlan's personal case files and questions he has received from readers. The fourth edition also includes an all-new chapter on reporting.

  • Complete coverage and examples of Windows 8 systems
  • Contains lessons from the field, case studies, and war stories
  • Companion online toolkit material, including electronic printable checklists, cheat sheets, custom tools, and walk-throughs

Détails sur le produit

En savoir plus sur l'auteur

Découvrez des livres, informez-vous sur les écrivains, lisez des blogs d'auteurs et bien plus encore.

Commentaires en ligne

Il n'y a pas encore de commentaires clients sur
5 étoiles
4 étoiles
3 étoiles
2 étoiles
1 étoiles
Commentaires client les plus utiles sur (beta) 4.7 étoiles sur 5  10 commentaires
21 internautes sur 24 ont trouvé ce commentaire utile 
3.0 étoiles sur 5 Disappointing Update to Windows Forensic Analysis 30 avril 2014
Par Rob Lee - Publié sur
Format:Format Kindle|Achat vérifié
I am a fan of Harlan's books and we even carry them in the SANS bookstore at conference events as recommended reading by SANS instructors. His last book "Windows Forensic Analysis: Advanced Analysis Techniques for Windows 7" was a wonderful rewrite and included many new artifacts found on Windows 7 including jumplists, volume shadow copy, and many new registry keys.

This new book, is basically a reprint of his previous book based on Windows 7 with some brief mentions of Windows 8 artifacts. Harlan does mention this fact even in the book, but I feel the title is a bit misleading especially if you have a copy of his previous book.

If you have already purchased his 3rd edition book, I would pass on this book until more Windows 8 artifacts are detailed in full. Having read the book in full including the last two new chapters, it does include some brief new artifacts for Windows 8, but not enough to warrant spending the money to update your library at this point.

The book is great if the majority of your analysis is on Windows 7 systems. If you don't have a copy of the 3rd edition, then this book is a great addition to your forensics library. However, due the the misleading title "Advanced Analysis Techniques for Windows 8," I cannot rate the version of the book any higher.
3 internautes sur 3 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 Should be required reading for Forensic Examiners 20 mai 2014
Par Mari DeGrazia - Publié sur
This book is well written, full of tips, and teaches the methodology of forensic examinations rather than just “go look here for this artifact”. Case in point is the Timeline chapter. This chapter does a great job of explaining the benefits of creating a timeline, and even walks the reader through the process using a Windows XP image.

The chapter on report writing was extremely helpful. In my experience, this is one area that many examiners may struggle with, because without a way to communicate the findings, the analysis is for not. This chapter not only covers the report writing process with examples, but also covers how to take detailed case notes. Although I have been writing reports for a while, there were still quite a few “ah ha” moments for me.

If you have any of his previous books, and are wondering if the new edition is worth the extra expense and time, I would say a resounding “Yes”. There is new content such as the Correlating Artifacts chapter and the Reports chapter. It has also been updated with some real life case examples that help drive home the points. If you’re new to Harlan’s series, I think this book is a great place to start. In addition to the newer operating systems, this book also covers XP, Sever 2003 and Vista.

It may also be a minor point, but I also like that fact that Harlan uses the pronoun “she” and not always “he” when talking about examiners.

I do have to say that Windows Forensics Analysis 2E is still one of my favorites, but that is probably because it was one of my first forensic books and has all my notes still in it :-)
1 internautes sur 1 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 Excellent 10 septembre 2014
Par BB - Publié sur
Format:Broché|Achat vérifié
Excellent book! This should be on every DFIR consultants bookshelf.
5 internautes sur 8 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 It's Harlan's latest book. What else do you need to know? 21 avril 2014
Par Brett Shavers - Publié sur
Without reading any reviews, those analysts who buy Harlan’s books will keep buying his books with the full expectation of having a well-written (as in easy-to-read) book on Windows OS forensics. There is no need to read any further in this review if you fit in this category. This is Harlan’s new book. That is all you really need to know. But if you just want my opinion, read on…

This book is not "Windows 8 Forensics". And it's not really a "Windows Forensics Analysis Updated" either. It's a book on Windows OS forensics and covers a lot. Yes, the registry is covered here even through Harlan's registry book is still current. It's all here and like I mentioned, it's Harlan's latest book, so if you have anything to do with Windows OS forensics, this book has your name on it.

I have to say that Harlan asked me to be the tech editor, which I am still humbled and flattered to have been asked. It is a tough task to edit someone's work when much of the information is hot off the press, still in research mode, and just plain eye-opening fresh. But I found it to be an enjoyable experience being able to test Harlan's research on my own before the ink was dry (so to speak).

One key point I want to share from the book, is that sharing information is a strong concept that Harlan tries to get across. Without sharing, you'll never know what you don't know (because no one will ever tell you). Lots of information is shared in this book, you will have fun reading it.

I have a longer review on my blog ([...]) for more opinionated discussion...but in short, if you have looked in the registry or made timelines of user activity or captured live memory lately, you most certainly will benefit from this book. And as I always believed, if I can get one good piece of information out of a book or class that saves me hours (days or weeks!) of work, then my and money was well spent. This book is money well spent.
5 internautes sur 8 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 I'll take Brett's advice. 26 avril 2014
Par Frank Shells - Publié sur
I bought the book before I read Brett Shavers' review, but if I hadn't, I would have taken his advice and bought it anyway. I have not completely read this book as it is about five notches higher on the technical scale than I am at this point and takes me a little longer to thoroughly read. But, I have read most of Mr Carvey's prior books and enjoy his writing style. I also bought this book because I saw Brett Shavers was attached as a tech editor. There are a few DF authors that I will read without hesitation and these two names are on the list of books I will read as soon as I get my pre-ordered book delivered. I am already waiting for the next Harlan Carvey or Brett Shavers' book to come out.

Even as I thumb through the pages that I have yet to read, I can say that this book is informative and entertaining to read. Also, not surprisingly, I have found Syngress books to be better on average than other publishers in this niche field. Many technical books are written as if designed for either a 9th grade high school class or a PhD program, neither of which will benefit the actual forensic examiner. Syngress seems to have filled this void with great authors, book titles, and editing while other books seem to be written to fit the classroom and not on an examiner's desk.
Ces commentaires ont-ils été utiles ?   Dites-le-nous

Discussions entre clients

Le forum concernant ce produit
Discussion Réponses Message le plus récent
Pas de discussions pour l'instant

Posez des questions, partagez votre opinion, gagnez en compréhension
Démarrer une nouvelle discussion
Première publication:
Aller s'identifier

Rechercher parmi les discussions des clients
Rechercher dans toutes les discussions Amazon

Rechercher des articles similaires par rubrique