Sunday, March 20, 2011


SANS has issued a promotional code for the Computer Forensic Investigations - Windows In-Depth class that I’ll be teaching at SANS New Jersey 2011 in May. Use the code COINS-EH for a ten percent discount on the class. If you are a state or local law enforcement officer, you can use the code locallaw50 for a fifty percent discount.

Windows Registry Analysis

I posted my five star review of Harlan’s Windows Registry Forensics book on Amazon. The executive summary is that if you couple the book with his previous Windows Forensic Analysis, 2nd Edition, you get Windows Forensic Analysis: The Director’s Cut. It’s a fine book and will make for a great addition to your digital forensics library. I’ve added it to my “Learn Digital Forensics” Amazon guide.

Digital Forensics Framework

Version 1.0.0 of the Digital Forensics Framework has been released. I wasn’t even aware that there was a Digital Forensics Framework until I read on my Twitter feed this week that this version had been released. It looks fascinating and I’m looking forward to downloading it and seeing what it can do.

EnCase Version 7

The Guidance Software marketing machine has been spinning up in support of the next version of EnCase. Guidance is offering sneak peaks at a variety of locations around the world over the next couple months. I’m going to try and make the event that will be held in NYC on April 15th. Joseph Shaw attended one of these sessions recently and put out a considerable amount of great information on his Twitter feed.

Must. Watch. The. Footy.

Okay, so you can stop reading at this point if you came here, oddly enough, expecting just to read about digital forensics. I know I have quite a few international readers as well as quite a few people in England who read the blog so I’m going to engage in some wanton self-indulgence and talk a bit about football. It won’t be something you’ll have to endure on a regular basis, I promise.

For whatever reason, I’ve recently fallen under the spell of English Premiere League football. Since I played both as a full back and a goalkeeper competitively during school, I think it was a latent and pre-existing condition that has been inflamed by some of my English digital forensics friends. To be frank, I place the blame squarely on the heads of Simon Steggles and Lee Whitfield of Disklabs because of they tend to Tweet while watching their favorite teams play. I resisted as long as I could, but after becoming curious about what all of the fuss was that caused them to Tweet so much about it, I became hooked.

Here’s why I am bringing this out on the blog. I’m very curious about how people come to support their favorite football club.  I figure in England, it’s just like it is here in the United States when it comes to NFL football. I love the NFL and I’m a Chicago Bears fan. I’ll be a Bears fan for life and that’s partially because of family and geography. I’d love to hear from my English readers to see if it’s the same for them when it came to picking their favorite club. I’d especially like to hear from are the people outside of England who have a favorite English football club that they support and how they came to pick that club. Feel free to respond via my email that you can find on the right hand side of the blog.

Personally, I think if you are new to watching a league like the EPL, you can’t just arbitrarily pick a team. Well, you can, but it’s just not something I can see myself doing. I think you have to have a team pick you. It’s also apparent to me that the wonderful promotion and relegation system means if you are an international fan and are serious about picking a club to support, you have a limited number of teams realistically available.  Fox Soccer has offers a small number of EPL games each week and if your team gets relegated, you are unlikely to be able to see their games on television until they get promoted again. Thus, if you are serious about being able to watch and support your club, you’re going to want to select one that has a low chance of being relegated. Let me know if you disagree and why.