I wrote a few books, and writing a few more.  I tech-edited books for others. I've written an entire book as a ghost-writer and written chapters for books as a ghost writer.  Here is the breakdown of the books.

 

 

Stepping into the Breach

This book is in progress right now. Tons of research. Lots of interviews. Amazingly difficult to write.  The book is a storytelling based on Mark Spencer's incredible forensic case of government corruption, national upheaval, political prisoners, and political refugees. I am just the storyteller to this incredible case.  

This book will be published in 2024 by a major publisher and will be unlike most any other forensic book that you have read. An incredibly experienced forensic expert as tech editor (Craig Bowling) is seeing the book's technical writing is double-checked accurate. 

An edge-of-your-seat digital forensic book.  Have you ever heard of such a thing?  You will in 2024.

 

Placing the Suspect Behind the Keyboard

My first book ever.  Legend Troy Larson was the tech editor and his wisdom made the book all the better.

But don't buy it.

I'm publishing a new edition in 2024 that will far surpass what this book has.  In fact, if you buy the new edition when it comes out, I'll give you the PDF of this book for free.

You can be the first to know when the new edition is available by following this book's "X" account at: https://twitter.com/PSBK2E 

 

X-Ways Forensics Practitioner's Guide

This was my second book.  I asked Eric Zimmerman to be a co-author to help cull X-Ways into a meaningful chunk of data.  This book became an award winner.

But don't buy this book.

The second edition was published in 2022 and is better with more content.  Buy the second edition instead.

 

Hiding Behind the Keyboard

This was my third book. I asked John Bair to be a co-author.  This book was meant to be an extension of the Placing the Suspect Behind the Keyboard.

But don't buy this book.

Much of the content of this book will be encompassed and updated in the 2nd edition of Placing the Suspect Behind the Keyboard.

 

X-Ways Forensics Practitioner's Guide, Second Edition

This is the second edition of the X-Ways Forensics Practitioner's Guide.  It will be the last X-Ways Forensics Practitioner's Guide written in this format of describing what the checkboxes and half-checks do.  

The third edition will be a comprehensive casework flow, probably published in 2024 or 2025 at the latest.  The third edition will have chapters like, "Working a CSAM Case" where I will show how to use X-Ways Forensics to work a CSAM case from start to end.  Then another chapter on "Working an IP Theft Case" and so on.

The second edition will be helpful to have as a reference to the third edition since no more explaining what the checkboxes do.

 

I've written booklets, like "WinFE: Windows Forensic Environment" and a few more.  These were written to be given out at training courses and as references.  The WinFE guide probably will not be updated again since this current book shows "the way" to build and use WinFEs. There is not much more to be said about WinFE as this guide includes thorough testing, building, references, and case use.

You should have this book if you use WinFE as it will prevent build errors, help in your report writing, and be useful as a reference if you ever need to testify to your use of WinFE.

 

 I have tech edited several books, like Paul Sanderson's SQLite Forensics.  Some are outdated now, but this book probably won't be outdated for a very long time.  You probably already have this book. You should have it if you do forensic work.  This is a mandatory item to have.

 

I was once hired to write an entire digital forensic book as a ghost writer.  And then I was hired to write multiple chapters for more digital forensic books.  All of these for different authors.  As a ghost writer, my name isn't in the books and all credit is to the book authors.

I don't do this anymore because I would like to talk about the things that I have written...

 

The DFIR Investigative Mindset

This book is in progress. In my opinion, this book will be the silver bullet in becoming a great DFIR investigator (aka: analyst). There is no other book like it, nor anything close to it. I just completed helping Graeme Horsman with an academic journal on this topic that was accepted for publication.

This book takes the academics out of the topic and lays it out for practitioners in direct, immediate, and effective content that you can put to use before you even finish the book.

Lee Harris, an amazing law enforcement investigator is my tech editor and Graeme Horsman is writing the foreword.  

Placing the Suspect Behind the Keyboard, Second Edition, Vol 1

This will be the book to have in 2024. The contributors to this book have over a century of experience to share. I have geared this book to be the end-all be-all in working a "cyber" case from start to finish.

For the newly assigned DFIR investigator, this book lays out the roadmap that you need to know.  For the experienced DFIR investigator, you will find more than a few new techniques, motivators, and procedures to crack cases that you couldn't break and break cases open faster than ever before.

There are bonuses in the book that more than make up for every penny and every minute spent on this book. Nothing else like it anywhere.