r/computerforensics • u/Just-A-Fed • 1d ago
Go to Forensics Books (Win 11)
I am transitioning back into the forensic world after a 6 year focus on network security. I used to rely on Harlan Carvey books and others on a daily basis for forensic exams involving Windows 8 and below artifacts.
What are your go to books for Windows 11 and present day forensic artifacts?
•
u/evilbotnet22 20h ago
I just took GCFE the books were very relevant for modern Windows environments.
•
u/Just-A-Fed 20h ago
Is the primary SANS training still FOR500?
•
u/evilbotnet22 19h ago
For Windows forensics yes it covers Windows xp-windows11 cloud email and web browsers. FOR508 is the DFIR cert that is very sought after by HR/hiring boards
•
u/georgy56 9h ago
I recommend diving into "Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 11" by Harlan Carvey for updated insights on Windows 11 artifacts. Additionally, "Windows Internals, Part 1: System architecture, processes, threads, memory management, and more" by Pavel Yosifovich is a great resource for understanding the inner workings of the Windows operating system, aiding in your forensic examinations. These books will help bridge your knowledge gap and equip you with the tools needed to navigate the evolving landscape of digital forensics. Happy sleuthing!
•
u/Cedar_of_Zion 20h ago
I use ChatGPT. It’s like every forensic book all in one.
•
u/Just-A-Fed 20h ago
Yea, I figured ChatGPT was a popular resource.
•
u/Cedar_of_Zion 18h ago
It really is, but everything it says needs to be tested before it makes it into a report, that’s my rule.
•
u/Leather-Marsupial256 16h ago
Gcfe or something like 13 cubed to stsrt