Publications
Writing and teaching artifacts from a career spent turning technical evidence into understanding.
Network Forensics
Network Forensics: Tracking Hackers Through Cyberspace remains a cornerstone work in the field: a practical treatment of how network evidence can be collected, interpreted, and used to understand adversary activity.
The book’s continuing relevance is not only in the tools. It is in the discipline: packets as artifacts, traffic as behavior, and evidence as a path from observation to explanation.
Current intellectual thread
Network forensics as digital archaeology: artifacts, context, correlation, interpretation, and the humility to distinguish what is known from what is merely plausible.
Related work
Additional talks, course materials, scripts, and historical references are preserved in the resources area where they remain useful to students and colleagues.