EnCase Computer Forensics: The Official EnCE : EnCase Certified Examiner Study Guide. includes DVD (Englisch) Taschenbuch – 30. November 2007

This book contains vast knowledge about not only encase but computer forensics in general. The author is obviously very experienced and well written. The book contains mostly academic how to information regarding case work, but the author sprinkles in some interesting war stories to keep you pumped up about forensics.

The sample test questions and flash cards are also helpful. I haven't taken the exam yet so I can't speak to how well it prepares you, but I would imagine feeling fairly confident going in with this under my arm.

I did have to drop my rating two stars because of the sample software included with the book. It is completely useless and is not much more than a screenshot of the software. Even worse the included case files don't even work with the sample software, so you will get no real world experience in using encase if you don't have access to the actual software.

The Wiley website has exercise files to download, but doesn't seem to offer a way to register in order to access them. Completely frustrating, and I would have been happier if they had just left the sample software out of the package.

I recently took and passed the written portion of the EnCE exam and I am waiting on the grade for the practical portion of the exam. I used this book, in conjunction with the Guidance Software EnCE-specific training class, and I have to say that the difference between what was presented in the Guidance Software class and this book is significant. While I cannot and will not go into testing details, I can say that there are several areas on the test/practical that are NOT covered in any detail in the book even though they are listed as key concepts to understand at the end of the chapters, while other areas receive undue attention. Also, the index at the back of the book is lacking. There are several keywords I would expect to exist in the index that do not, but can be found in the e-book version included on the CD if you do a find. This is especially tedious when you're trying to find a piece of information quickly and have to load the e-book to find it. It makes the physical book muck less useful.

**For investing only $3000+ more, you, too, can actually practice using EnCase with the case files found on the accompanying DVD.

With that said, Steve Bunting provides a well-written, easy-to-understand, thorough tour of EnCase. Chapter review questions help guage your learning curve as you progress through the book. Step-by-step exercises familiarize you with the basics and many facets of EnCase--unfortunately, you can't actually perform the tasks, unless you fork over the aforementioned fortune to Guidance Software. Additionally, Steve covers globally applicable basic and advanced digital forensic skills. I would give the book five (*****) stars and the included software one (*) star.

If you have trouble with the book or DVD, feel free to contact Wiley Publishing by visiting their website. Don't try to call the phone numbers listed in the product; they are defunct. You can chat live with a Wiley representative after 4 p.m. (when the pseudo-tech finishes his day job and slips into his favorite grey sweatpants and Linux-logo t-shirt, fires up his Xbox, and starts chugging cases of Mountain Dew). Or, if you actually need to contact them during normal business hours, you can leave a question for them via their web interface. They are quick to respond and comfort you with a compassionate pat on the shoulder and a "There. There." and send you on your way. I have provided my exchange with their tech support, below. (Note the "...unusable with some of the exercises in the book..." comment. I found it unusable with MOST of the exercises.)

==========================================
MY PROBLEM SUBMISSION TO WILEY PUBLISHING:

I have purchased a brand new copy of Steve Bunting's EnCE: The Official EnCase Certified Examiner STUDY GUIDE, Second Edition. I am able to access the eBook on the accompanying disc. Using the provided EnCase software, I cannot perform several of the steps outlined in the book's exercises. The EnCase version is: 6.7.2.1.

Examples of limitations follow: (See attached screenshot)
1) I cannot create a new case as specified in Exercise 6.1, Step 3. I use a workaround by directly opening the Navigation.E01 file on the CD via Explorer. I am, then, prompted for new case info.
2) I cannot Add Evidence.
3) I cannot view items in the Viewing Pane in Text view, per the exercises.

I am stunned that this extremely watered-down, unusable version of EnCase was included with this book. I cannot practice the material and become proficient as is the author's intent.

Please, be so kind as to provide a solution to this. I spent good money on this product and would like to use it.

==========================
WILEY PUBLISHING RESPONSE:

Thank you for contacting Wiley Technical Support.

I apologize for your frustration with the bonus software.

The version of EnCase provided with the book is a demonstration version provided to us by Guidance Software. We understand that some of the features in the software are disabled, rendering it unusable with some of the exercises in the book.

Please see the description of the EnCase Forensics Software and Evidence Files on page 580, which outlines some of the limitations between the demonstration version and the fully licensed product.

Tim S.
Wiley Technical Support

==========================

Thanks, Wiley, for your stellar marketing and failing support.

The author was not able to preview any of his excercises on the demo version of the software prior to publication. Most exercises simply don't work with the enclosed software. He wrote all of the exercises on licensed versions of EnCase. If you have a licensed version of EnCase, this book is great.

If you are dependent on the demo software do not buy this book until the publisher comes out with a fixed version of the demo software. Be careful on the Wiley web site as there is a fixed version 5 already there for Edition 1 of the book. Make sure that it is version 6, to reflect edition 2.

Other than the demo software, it's a good book. Some of my students complain about the labs being a little hard to follow.

Good nook