Incident Response and Computer Forensics, 2nd Ed. “IRCF2E” is one of the few books in print where the word ‘forensics’ deserves to be on the cover. Watch for Real Digital Forensics to be published next year, which walks readers through case-based evidence to teach how to collect, interpret, and analyze host- and network-based data. The book lays much of the groundwork for doing cases, and it’s a good example for investigators to use in operational environments.”]
Source: https://taosecurity.blogspot.com/2003/10/review-of-second-edition-of-incident.html