Rafael August 26, 2013 7:56 pm

I am so much in agreement with you here. I awlays used to think that computer forensics positions were only available to the people who knew that level of detail about a system, or at least knew some level of detail and knew how to find out about the things they didn't know. Unfortunately, as I'm starting to find out, this awlays isn't the case. (I know there are people out there with this level of knowledge - but I have not been able to work with them yet)The problem I have run into is that the forensic investigators where I have worked have things like Encase certification and can follow the SOPs in regards to imaging a computer, etc, but if you ask them how things like the registry work, they'd have no clue. Do you have any suggestions in regards to this? I know your book and training is definitely a good place to go but what else out there can be used to get this kind of knowledge?