My books

Placing the Suspect Behind the Keyboard, Vol. 3

DFIR Investigative Strategies

This is my current book in progress. It is intended to be practical, actionable, and directly useful for DFIR casework. The focus is investigative strategy: how to think through evidence, uncertainty, competing explanations, and decisions during an investigation.

Whether you are new to DFIR or have been doing this work for years, the goal is to provide methods you can apply immediately in real cases.

Placing the Suspect Behind the Keyboard, Vol. 2

DFIR Investigative Mindset

This book focuses on the judgment, discipline, curiosity, skepticism, and decision-making needed in DFIR investigations. It is not a tool manual. It is about how investigators think, decide, test assumptions, and avoid avoidable mistakes.

Lee Harris served as technical editor. Chad Gish and Graeme Horsman wrote the forewords.

Placing the Suspect Behind the Keyboard, Vol. 1

Using Digital Forensics and Investigative Techniques to Identify Cybercrime Suspects

This was my first book. Troy Larson wrote the foreword, and Harlan Carvey served as technical editor.

I consider this the first volume in the Placing the Suspect Behind the Keyboard series.

X-Ways Forensics Practitioner’s Guide, Second Edition

This is the second edition of the X-Ways Forensics Practitioner’s Guide. It expands and improves the first edition and remains the edition I recommend for those who want a practical reference for using X-Ways Forensics.

X-Ways Forensics Practitioner’s Guide, First Edition

This was my second book. I asked Eric Zimmerman to co-author it because X-Ways Forensics needed to be explained in a practical and usable way. The book went on to become an award winner.

Hiding Behind the Keyboard

This was my third book, co-authored with John Bair. It was intended as an extension of Placing the Suspect Behind the Keyboard.

WinFE: Windows Forensic Environment

I have also written shorter guides and booklets, including WinFE: Windows Forensic Environment. These were created for training courses and practitioner reference.

If you use WinFE, this guide can help prevent build errors, support report writing, and provide a reference if you ever need to explain or testify about your use of WinFE.

Technical Editing

I have technically edited several books, including Paul Sanderson’s SQLite Forensics. Some technical books age quickly. This one has remained highly useful for forensic practitioners working with SQLite databases.

Ghostwriting

I have ghostwritten an entire digital forensic book and written chapters for other digital forensic books. Those projects were published under other authors’ names, as ghostwriting works that way.

I no longer ghostwrite. I now write under my own name, with my own opinions, experience, and voice attached to the work.