With more forensic books hitting the shelves, I find myself prioritizing those by authors I know and trust. I have worked with Cory Altheide and he is an extremely talented forensic professional with a passion for open source tools. Not surprisingly, I would not categorize this as a beginner book. Open source tools require a higher level of interaction than their commercial counterparts, but are a great way to take your forensic skills to the next level. While teaching, I often see students frustrated that there is no one tool that can do it all. Such a tool does not exist, no matter how much you are able to pay for it. Free and open source tools fill large gaps in the capabilities of commercial forensic suites and will continue to do so in the foreseeable future.
The book begins with an excellent section on setting up your forensic workstation, using either Linux or Windows as a host. I was immediately impressed with how succinctly the authors were able to cover this topic. File system analysis is broken into three chapters covering Linux, Windows, and OS X. It is rare to find more than one of these operating systems covered, and references to all three continue throughout the rest of the book. This breadth does come at a cost; a fair amount of system knowledge is assumed. As an example, NTFS is covered in six pages and readers are assumed to have prior knowledge of concepts like NTFS attributes and resident versus non-resident files. Without a doubt, Digital Forensics with Open Source Tools (DFWOST) runs at a blistering pace. This is a boon for more advanced practitioners who do not want to rehash old concepts. However, there were several instances when “newer” artifacts like the Linux Logical Volume Manager (LVM) were discussed that I found myself wanting more. In other sections I found some of the best topic coverage in print. The discussion of image metadata in Chapter 8 is particularly comprehensive.
Of course the coverage of open source tools is why many will buy this book. In this regard it does not disappoint. I was pleased to find nearly all of my favorite tools covered along with many new ones. I found myself dog-earing pages to return back to when time permits. Harlan Carvey’s touch was evident in the coverage of Windows based tools. Tools are covered in conjunction with their related forensic artifacts, reinforcing key concepts and underscoring tool relevance. While coverage is ample, tools are not discussed exhaustively. Readers will need to work with the tools themselves to fully understand their capabilities – an approach which I agree with.
Overall, I found DFWOST to be a tremendous asset in an area with few published resources. If you are looking to push your forensic skills forward, I highly recommend this book.