Okay, by now, you've probably/likely decided to write that book, and that you've opted to do so through a publisher to get it on the bookshelves and onto Kindles and other ereaders. Remember, this isn't the only way to get something published, but it is one of the only ways to get your book published and have someone else take care of getting it on shelves and in front of your intended audience through Amazon, etc. Your alternatives include self-publishing through sites like Lulu.com, or simply writing your "book" and printing your manuscript to a PDF file, rather than a printer. There are advantages and disadvantages to each approach, but we're going to go with the assumption that you'll be working with a publisher.

Working with the publisher
When you're working with the publisher, don't set your expectations (at all, or too high) of what that's like ahead of time. Remember, the publisher's staff are people, too, and may be working with multiple authors. You very likely won't be the only author that they're working with, nor the only schedule. In addition, remember that in the current economy many people are wearing multiple hats in their jobs...so the editor you're dealing with may not get your email because they're traveling or at a book show. I've worked with staff who, in 2009/2010, do not have remote access to their email (can you imagine that??), so I won't hear back from them for weeks at a time.

While working with the publisher, I've had editors and even editors assistants changed part way through the writing process. The result was that chapters that I had sent in for review could no longer be found. I know this sounds like a bit much, but keep track of what you send in, when, and to whom. This can really help...particularly in instances where you have to resend things.

One of the things I've run into several times is that I've submitted what I thought was everything...DVD contents, revised chapters, etc...and asked the staff I was working with if everything was received, and if I needed to provide anything else. I'd been told, no, that's everything...only to be contacted three weeks later and told that something else was needed (review the proofs, provide a bio, etc.). The key to this is to see what's in other books, and keep a list of what you've provided...have you written a preface yet? A bio? How about that acknowledgment or the dedication page?

In short, be flexible. Focus on meeting your schedule in the contract. If you're not going to meet the schedule for some reason, do the professional thing and let them know ahead of time. Don't worry about what anyone else does or is doing. In the long run, it'll help.

Working with reviewers
When you're working with reviewers, keep in mind what their role is in the process. They're generally there to review your work, so don't take what they say or comment on personally.

There are generally two kinds of reviewers...those who do the grammar, spelling and formatting review for the publisher (they tend to work for the publisher), and those who are supposed to review your work from a technical perspective, to ensure that it's accurate (although why you'd put that amount of time into writing something that is completely off base, I have no idea). Generally speaking, whatever the grammar/spelling reviewer suggests is probably advisable to accept. However, this won't always be the case, particularly when you've written a turn of phrase that you really want to use, or are using acronyms specific to your field. I remember that I had an issue with the acronym "MAC"...did it refer to file "MAC" times, or to a NIC's "MAC" address? Kind of depended on the chapter and context.

As far as your technical reviewers go, that's another story. There's no reason that you have to accept any of their proposed changes, or follow what their comments say. Hey, I know that's kind of blunt, but that's the reality of it. In every book I've worked on, to my knowledge, the technical reviewer has had no prior contact with me, my book proposal, or my thought process prior to getting my draft chapters. Therefore, they are missing a great deal of context...and in some cases, their comments have made little sense when you consider the overall scope and direction of the book.

For some reason, the publishing process seems to be something of a maze of Chinese walls. You get an author who's writing a technical book, working with a publisher who knows publishing, but not the subject that's being addressed. One person reviewing the book and working for the publisher knows spelling, grammar, and formatting, and that's good...but often times, the technical reviewer may not know a great deal about the subject being addressed, and knows nothing at all about the author, the goals and direction of the book, or much in the way of overall context. In my mind, this is just a short-coming of the process, and something that you need to keep in mind. I've worked with a LOT of folks with respect to writing technical reports, and there are generally two things that most folks do with suggested changes and comments...they either accept them all unconditionally, or they delete and ignore them. I would suggest that when you are going through the document that you receive back from the technical reviewer, make your changes and add your own comments to theirs, justifying your actions. Then save the document, copy it, and (if it's written in MSWord) run the copy through the document inspection process, accepting the edits and removing comments. That way, you have a clean copy to send back, but you also have a clear record of what was suggested and what you chose to do about it.

Another thing to keep in mind is that people have varying schedules...if you submit a couple of chapters and you feel that you aren't getting much in the way of a review, or one that's technical, get in touch with the editor and request someone else. Or, suggest someone to them up front...after all, if you really know the subject that you're writing about, you will likely know someone else in the field who (a) knows enough about it to review your work, (b) has the time to do a good review, and (c) has the interest in working with you. I've had folks offer to review my work completely aside from the publisher...that's okay, too, but it also means you may submit a chapter and not hear back at all. Remember, in the technical field, you don't make enough money to support yourself writing books, so neither writing nor reviewing books is a full-time job, and people have day jobs, too.

Working with co-authors
Writing a book as the sole author can be tough, as it is a lot of work...but I think that writing a book as multiple authors, particularly when none of the authors ever actually sit in a room together, is much harder. There are a lot of decisions that need to be made and coordinated ahead of time, and continually revisited throughout the process. Again, writing books in this field is NOT a full-time job...as such, people's day jobs and lives tend to take precedence. Family illness, holidays, vacations, etc., all play a role in the schedule that needs to be worked out ahead of time.

Another thing to consider is that someone has to take the lead on tone...or not. You need to decide early on what the division of labor will be (split up chapters or sections), and whether or not you feel it's important to have a single tone throughout the book. There will be times when it makes sense to have a single tone, and there will be other times when it's pretty clear that you aren't going to have a single tone, as the various authors take the lead on the chapters for which they have the most expertise in the subject matter.

Providing Materials With Your Book
I'm one of those folks who writes some of my own code, and I tend to create my own tools, whether they be a batch file or a Perl script. As such, it's helpful to others if I make those tools available to them in some manner, and this is often done by putting those tools on a CD or DVD included with the book. I think that a lot of times, this increases the value of the book, but it can also be a bit difficult to deal with...so how you provide the materials is something to consider up front. Another item that a lot of folks find interesting and very valuable is "cheat sheets"...if you list or explain a process in your book, and it covers a good portion of a chapter, it might be a good idea to provide a cheat sheet that the reader can print out (perhaps modify to meet their own needs) and use. How you intend to provide these, and other materials (i.e., videos that show the viewer how to do something step-by-step, etc.) is something that you need to consider ahead of time.

The point is that if there are materials you're going to refer to in your book, you have to figure out ahead of time how you're going to provide them. In my experience, there's two ways you can do this...provide the materials on the DVD that comes with the book, or provide them separately. I have usually opted to provide the materials on a DVD, but after having written a couple of books, I think I'm going to move to something completely separate, and provide the materials online.

I have decided to do this for a couple of reasons. One is that there's always someone out there who ends up purchasing a copy of the book that mysteriously doesn't have a DVD. Or they loose the DVD. Or they leave it at home or at work, when they need it in the other location. Then there's the folks who purchase ebooks for their Kindle or other ereader, and never got the email that says, "...go here to download additional content." Or they did, but the publisher modified their infrastructure so now the instructions or path aren't valid. And, of course, there's always the person who's going to contact you directly because they want to ensure that they have the latest copy of the materials.

My thinking is that a lot of these issues can be avoided if you choose a site like Google Code or something else that is appropriate (and relatively stable/permanent) for hosting your additional materials. That way, you can control what's most up-to-date and not have to rely on someone else's schedule for that. You can refer to the actual tools (and other materials) in the book, so that having the book itself makes the tools more valuable, but by providing them on the web, you can include "here are the absolute latest, newest, most up to date copies" on the page where the reader will go to download those tools.




Self-Marketing
Blogging is a great way to get started and get the feel for writing, without the constraints of editing (and things like spelling, grammar, etc.). Face it, some folks don't take criticism of any kind well, and don't put a great deal stock in checking their own spelling and grammar...so blogging is sort of a way to get into writing without having someone looking over your shoulder. It's also a great way for some folks to realize how important that sort of thing is.

Blogging is also a great way to self-market your book, prior to and following publication. It's a great way to start talking about the book, to answer questions that you get about your book and materials, address errata, etc. In some ways, a blog can also lay the groundwork for a second edition, or even just for your next effort, as you get feedback, read reviews, post new ideas, etc. For example, if you start to see that your book on forensic analysis is linked to another blog on malware reverse engineering, with that author making comments about what you've written (positive or negative), that could be a good indicator for you...what do you need to improve on, expand on, and what were you dead on with in your book?

Take the lead on marketing your book. Present the publisher with ideas, and take the lead on getting the word out there (assuming that that's what you want). When WFA 2/e was coming out, I was excited because this was the first book in a new direction that Syngress was going, something that was exemplified by the new cover design. That summer, the SANS Forensic Summit was going to be in Washington, DC, and I was attending as a speaker. As I looked more and more into the conference, and who was speaking and attending, I counted almost half a dozen Syngress authors who would be there, all of whom had the work "forensics" in their book title. I contacted the publisher to find out if they'd have a bookstore...I thought, between sessions I could answer questions about the book. Well, it turns out that they had NO PLANS for a bookstore!! I thought (and said to them), you've GOT to be kidding me! Here's a conference with "forensics" in the title, and all these authors of "forensics" books will be there...to me, it was a total marketing coup. The short story is that the editor was there with books on a table and it was a huge success for everyone.

Final Thoughts...
And now, some final thoughts as I close out this series of posts.

I hope that in reading these posts, you've enjoyed them and at the same time gotten something out of them. I tend to take something of a blunt approach, in part because I don't want to sugarcoat things for someone who's considering writing a technical book. Yes, it is hard...but if you know up front what you may be facing, you're less likely to let it slow you down. One of the hardest things about writing books is that you're rarely, if ever, face-to-face with anyone from the publisher's staff when discussing your book. In fact, you're rarely face-to-face with anyone throughout the process.

One of the misconceptions a lot of folks who have never written a book have about authors is that they retain some modicum of control over what happens with the book once it's submitted to the printer. Nothing could be further from the truth. When WFA 1/e was released by Syngress, a PDF version of the book was available...for the first couple of weeks, it was provided with each copy of the book purchased through the Syngress web site. After that, it was available for purchase. Later, Syngress was purchased by Elsevier, a company out of Europe that produced all e-format versions of its books EXCEPT PDF. The author's role in any of that, particularly in the availability of a PDF version of their book, is zero. And I say that only because there's nothing less than zero.

Another misconception that I've run across is that most folks think that book authors have access to endless resources, or that somehow, the publishing company will provide those resources. This simply isn't the case. When I submitted the proposal for the Registry forensics book, all of the reviews came back saying that I needed to include discussion of the use of commercial tools, such as EnCase and FTK. Well, the short answer was "no"; the long answer was that I neither have access to, nor have I been able to obtain a temporary license for either...and none of the reviewers was offering such a license. In all fairness, I will say that I was offered a temporary license to one of the commercial tools, but by the time that offer was available, I was too far into the writing process to go back and add that work and material into the book. I would have been particularly time consuming because I don't use those tools regularly. Anyway, my point is that when I have written my books, I tend to do so based on my own experiences, or those interesting experiences that others have shared. I tend not to write about ediscovery, because I've never done it. I likely won't be writing about Registry analysis of a Windows-powered car or Windows 7 phone, because I neither own nor have access to either, nor do I have the tools available to work with either. Like most authors, I don't have access to massive data centers for testing various operating systems and application installations across numerous configurations.

Keep in mind that your book is not going to be everything to everyone. You're going to have critics, and you're also going to have "armchair quarterbacks". You're going to have people who post to public forums that you "should've done this...", and not once have a good thing to say about your work. You're going to have folks who will email you glowing commendations for what you've done, but not post them publicly...even when they purchased your book based on a publicly-posted review. Don't let any of this bother you. One of my good friends who's also written a book has received some not-so-glowing criticism, to which he's responded, "...come see me when you've published a book." In short, don't let criticism get you down, and don't let it be an obstacle that prevents you from writing in the first place.

Finally, I want to say once again that writing technical books is tough. It's tough enough if you're a single person and not at all used to writing. If you're married (particularly newly married) and/or have small children, it can be logarithmically harder, and it will require even more discipline to write. However, it can also be extremely rewarding. Seeing your work published and sitting on a bookshelf is very rewarding. Think about it...you've completed and achieved something that few others have attempted. If you've put the effort in and done the best you can, you should take pride in what you've done...and don't let the little things becomes insurmountable obstacles that prevent you from even trying.

At this point, if you're still following and reading this series, you're likely interested in writing a book, particularly (but not exclusively) in a technical field. Now that we're to the point where we've at least considered a publishing medium...or an actual publisher...let's talk about the actual writing.

Determine your audience and writing style
So, now that you have a topic, and your detailed outline, who are you going to be writing the book for? Who is your intended audience? In many ways, your audience can also dictate your writing style. Are you going write from/to a more academic perspective, or do you want to reach as wide an audience as possible? Do you want to sound more clinical, or do you want to be a bit more free flowing?

From my own perspective, I think that over the books I've published, I've progressed a bit and so far, I've received the most and best comments regarding the writing style with respect to WFA 2/e...keep your eyes out for the Registry book, as I think that you'll notice an improvement along those lines.

One of the best ways to determine your writing style is to read. Seriously. What books have you read that you really enjoyed reading? Now, think about why you enjoyed them? Were the characters authentic, did they seem real? Was the writing and its tone enjoyable and easy to digest, or did the author bore you to death (hey, you should read my master's thesis!)?

Also, what other things do you enjoy? When I was originally working with Syngress to publish WFA 1/e and we were working up the title, I immediately agreed with the publisher that if the title had "Windows" and "forensics" in it, I would immediately pull it off the bookshelf to take a look at it. That made sense to me, because that's exactly what I did when I went to the bookstore. From then on, I started to look at those things that I liked about certain books, or didn't like, and tried to emulate them. Over time, I've tried to add more of those things...sidebars, use cases, etc...that people have told me that they want to see more of, in most cases because I wanted to see more of them, as well.

As to the audience, I would like to reach a wide range of folks within the community. I find a lot of books that aren't specifically about IR and digital forensics to be very valuable (such as the Malware Analyst's Cookbook), so my hope is that besides those directly involved with responding to and analyzing Windows systems, others find my books useful as well. Within the community, I'm hoping to provide something useful or valuable to a wide range of analysts, from those new to the field (or just interested in it) to those who have been in a while, from active responders to those taking university or community college courses, to LE, etc. It's probably something of a lofty goal, I know, but that's the direction I'm going.

Be thorough in your writing
Deciding on your overall audience will also have an impact on the level of technical ability that you assume. For example, when describing a technique that uses an open source tool (say, written in Perl), how far do you want to go in explaining the tool? Do you want to go into detail explaining how to install Perl (or Python, or Cygwin, or whatever), or are you going to assume that reader can figure that out themselves?

Sometimes, writing "run the tool" (in magazines like 2600, you'll see 'run nmap' and little else...) doesn't often work very well. Providing a complete command line and relevant output from the command gives the reader something that they can hold on to. Many times, screen captures also help a great deal. However, the caveat about screen captures is that they have to be clear enough to see and understand...I've opened many books where I couldn't read the screen captures at all.

Also, when providing screen captures, be sure to specify what system or systems you're running the tool on, so that the output makes sense. I've met a LOT of folks who think that the major OSs that they have to address are Linux, MacOSX, and Windows. As someone who works with Windows systems, I'd strongly suggest to you that there's a major difference between Windows XP and Windows 7...but that's something to get into later. The fact of the matter is that in some cases, you're going to get different output based on a number of variables...version of the OS, version of Python or Perl installed, etc. Specify what you're working with when you write your book.

If something's important, it's okay to repeat it
Sometimes, this is the case. You don't have to repeat it verbatim, or even in the same chapter. If there's an important concept or technique that you've presented in your book, returning to it later in the book will help the reader see that its important, and perhaps even understand the importance.

When I was an instructor in the military, we'd do that...a lot. We had things that we did to signify to the (usually dozing) students that something was important. One really easy way to do this is to think about it when you're developing your outline, and find places where you can tie concepts or techniques together, where you expound or expand on something...and if you need to, highlight them on the outline in different colors. Some of us that talk about IR mention things like "Locard's Exchange Principle" (I do, and I know that Chris Pogue does, as well...)...so when you talk about it, find places in the book, such as during exercises or case studies, where you can clearly demonstrate the concept. If it's important, use it.

Be consistent
One of the things I learned about report writing that is also true in books is that you need to be consistent in how you write and present things. For example, lets say you're writing a report based on your analysis of three acquired images. When you discuss the analysis of the first system in your report, you describe the AV scans you ran, the Registry analysis you conducted, etc. Then for the second system, you first discuss AV log analysis, Event Log analysis, and you leave the AV scan results to the end and do not even mention your Registry analysis. The discussion of your analysis of the third system continues to be disjointed.

So, what do you think that the reader will walk away with after reaching the end of your report? Will she think that you did a thorough job in locating the malware? Not likely. It's more likely that she'll remember the inconsistencies, because the technical information you presented was lost in the "noise" of those inconsistencies.

The same can be said about writing books. Let's say you're writing a book on analyzing different image (JPG, TIFF, etc.) formats; providing a consistent structure for each image format will allow the reader to form comparisons and contrasts in their minds, whereas an inconsistent approach will leave the reader's mind similarly tangled and confused. Further down the road, the reader will have to search for important references in your book; however, if you've presented the material consistently, they're more likely to turn right to it, particularly if they're comparing information between two or more formats.

Getting Started
Regardless of the decisions you've made up until now, or how much discussion you've had with others about your ideas, nothing is going to actually happen until you start writing. That's right...write something. Anything. Because it's easier to change something that's already written, whereas if you're just sitting there starting at a blank page, you'll just keep staring...and that's hard.

When I was in the military and was writing fitness reports, I found it much easier to start early, consult my platoon commander's notes, and write something. I've found that 17 yrs later, the same things apply, and apply very well. As I develop my outline, I take notes...in a notebook, on stickie's, etc. I start pulling them all together, and start writing.

You're Not Gonna Be Perfect
What first comes out isn't pretty, and it may not be what I end up going with, but it's something to start with. When I was writing my first book, I sent chapter 1 in for review early on in the process...when it came back, I couldn't believe that I'd actually written what was there, and that it was only 8 pages! I really had to look at it, because in the process of working with one of the reviewers, I'd learned so much about writing from the other chapters that I had a hard time believing that I'd actually submitted what was in chapter 1! In the end, I ended up completely re-doing the entire chapter.

As much as you want what you're writing to be just right, understand that it's not going to be perfect. Sometimes, that becomes the excuse we use for not writing, or not submitting what we've written. Just know that it's not going to be perfect...but if you've put your best effort into it, it will be good and something that you can be proud of. Also, remember that in a group of people, you're never going to please everyone...keep that in mind. You're going to need a tough skin, because whenever you put something out there for public consumption, you're going to get positive as well as negative feedback...you're going to have critics.

All that matters is that you're doing this for the right reasons, and that at the end of the day, how do you feel when you look up at your bookshelf, or at the bookshelf at the bookstore (or on someone's iPad...) and see your book there?

So far, the first post in this series seems to have done well. Next, we'll talk about something that's very important toward getting a book published...the publisher.

Finding/choosing a publisher
Once you've gotten through the recommendations in my first post in this series, it's time to start thinking about a publisher. Remember what I said, though...as much as those of us in technical fields hate writing (some to the point of doing it badly so that they don't have to do it...), doing those things that I mentioned in the previous post are only going to help you in the long run. This is, in part, due to the fact that the publisher is going to make you do it anyway. Now, I'm sure that this is also going to be where most folks falter in their efforts...not realizing how much effort is required (I say "effort" instead of "work", due to the fact that a lot of what goes into this process is outside the norm and comfort zones of what most of us do...), some folks will start down the road and not just stop, however unintentionally, when asked to provide something else. Consider it something akin to special operations forces evaluation or assessment programs...the publishers really want to know who has the desire to stick with the process. They aren't throwing up ridiculous obstacles...they're just stating the needs of their process, and I'm sure it weeds out a lot of the folks that aren't serious and would just consume a great deal of their time and resources.

Some publishers, such as Syngress, actively advertise for authors. When I say "actively", I mean on their web site, as well as on social media sites such as LinkedIn, Facebook, and Twitter. We'll talk later about how you can use those sites, as well...but suffice to say for the moment that some publishing companies are taking full advantage of social media sites.

Now, I've only worked with two publishing companies, and for the most part, there were really no significant differences between the initial contracts (more about that later in the post) for either one of them. The only real difference was in the advance payment amount. Remember, you don't get into writing technical books to make money...and the advances come out of your initial royalties. After publishing my first book, I had another idea (to take the things I learned from writing that first book and write something a bit better), and had to provide my first publisher with their right of first refusal (this was stated in the contract) for the new concept. Once this was done, I moved on to Syngress, and through chance and circumstance, I opted to remain with Syngress in part due to some positive experiences with some of the staff, as well as the fact that by proving I wasn't a one-trick pony, I was able to get a bit better percentages in my royalties.

When looking for a publisher, also consider what you're interested in. Who's going to market your book, and how are they going to do that? Will a marketing campaign consist of some mass emailings, or will there be more involved? What can you do to assist, or pick up the slack? Also, besides the actual book itself, in what other formats will the book be available? When the first edition of Windows Forensic Analysis came out, there was a PDF version of the book available. By the time I had written the second edition, Syngress had been purchased by Elsevier, and the second edition was available in several e-book formats...but not PDF. If this is something important to you, be sure that you ask the questions.

Remember, self-publishing is an option. However, before you go that route, be sure you thoroughly research what is involved. How much will you need to know about desktop publishing? How much effort do you need to put in and what will you get in return?

Another thing to consider if you self-publish is, how do the books get on the shelves? Hey, providing review copies to luminaries in your field is easy, thanks to FedEx. But if you handle the marketing of your book and generate hype, and then get some really amazing reviews from notable people in your profession, how do you then get the book to the people who want to buy it, or to those who don't yet know that they want to buy it?

I know someone who wrote a book, self-published through Lulu.com, and provides all proceeds from the book to benefit a fallen comrade. This was the route he chose, and he's happy with it. This may be a route that you will want to go...or it may not. On another note, I was in one of the Family Christian Bookstores recently and found a pamphlet on one of the shelves for Westbow Press...I know someone who feels led to write about an experience in her life, and this may be an approach that she can use to get her book published and share what she's learned with others.

That being said, let's get on with it...

Working with your publisher
Working with the publisher is going to be a new experience for many, unless you're used to working as a contractor, of sorts. What I'm going to share with you now is some things I saw and learned with respect to working with two specific publishers, in writing technical books. As such, if you're going another route, such as writing children's books or non-technical books, YMMV.

The contract
The contract will usually specify the schedule. This may be an area where you will want to negotiate...take a look at your outline and anything else you've written, and correlate it with the schedule. Is it attainable? Is it something you can manage, or will you have to give up weekends and take a "vacation" to complete the book? This effort is going to be enough of a challenge, without having to meet some arbitrary schedule...so see if what's proposed makes sense, and don't get locked into something that's going be really hard on you.

A word about royalties...again, you're not going to make money to the point of retiring if you're writing for a niche market, like forensics. That's just how it is. Therefore, that's usually not the reason that folks get into writing books, particularly technical books in this market. If your contract specifies an advance, remember that advance means "advance"...which means that whatever you're given in your advance comes out of your royalties checks. So don't get disappointed if during the first quarter or six months your book seems to be doing really well, and your first royalties check is 0, or negative.

The keys to any contract are:
1. Read it thoroughly and make sure you understand it. Discuss anything you don't understand or have a problem with.

2. Don't expect that the publisher has it all locked on and is doing everything right...publishers are people, too, and we all make mistakes, like send the wrong contract or don't include things that had been discussed.

3. Make sure you understand and agree with the schedule. If you don't agree, get on the phone with the publisher and work it out. Publishers have schedules for when they'd like to get the book out, so try to work with them on that.

4. If you have questions about anything, or don't understand something...ask. Before you sign.

Formats/templates
When working with the publisher, you'll likely be provided with a template that specifies how the chapters should look. I've had templates that were really loose, while others were really stringent and specified a certain number of sidebars per chapter (among other things). It will help you a great deal in the long run if you get to know the template up front, and begin using it and abiding by it right away. Believe me, I know from experience that going back and restructuring an 80+ page chapter is NOT a pleasurable experience. Using and following the template from the beginning is going to be helpful to not just your overall writing experience, but also for everyone else involved.

However, that doesn't mean that as you're putting your detailed outline together, you can't start writing. In fact, I highly recommend that you do...start putting something down on paper. Throughout my time in the military...whether I was writing my master's thesis, or fitness reports, or whatever...I always found it much easier to write something and change it as I needed to, rather than sitting there staring at a blank page, waiting for the perfect turn of phrase to come to mind (which is a fancy way of saying "writer's block"). Even now, I have snippets written down for a project I have in mind...returning to those snippets will likely be the push I need to get that project off the ground and completed.

Reviewers and reviews
At some point, your chapters are going to have to be reviewed by someone; in many cases, several someones. There will be a reviewer who works for the publisher who will review your format (to ensure that it is in accordance with the template), grammar, spelling, etc. This reviewer will likely pick up things such as unfinished sentences, your horrific spelling, etc. It usually makes good sense to accept what they say (particularly if you're not too terribly good at spelling or grammar), and make most of the changes that they suggest. However, take a really close look at technical acronyms, and consider the reviewer's suggestions...acronyms specific to your field might be easily confused. I had an issue with "MAC"...depending upon the context, it could refer to the file "MAC" times, or to a "MAC" address.

There will also be someone who is a "technical reviewer", who is perhaps someone in your field and hopefully has some knowledge about your subject matter. Their job is to take a look at what you've written and see if it's correct and makes sense. Now, just because the technical reviewer makes a comment or suggestion, that doesn't mean that you have to make the change. I've had some really good reviewers, and some really bad ones. The bad ones were easy to recognize as they provided nothing of value to what had been written, and I would usually suggest to the publisher that they replace the reviewer. In fact, if you can, and you know someone that you can trust to be honest with you, provide their name to the publisher, rather than letting the publisher pick someone out for you. I've also had really good reviewers who've run every tool and every command I mention, noted differences in platforms, etc. However, if you get technical reviews back that say nothing more than "needs work", or "hey, this is a cool idea...", it's probably best to find someone else.

Once your book is published, getting reviews from folks in the field is a great idea. When WFA 1/e was published, 101 copies were sent to folks deemed by the publisher to be "in the industry" (most of whom I did not recognize) with the expectation that many (or some) of them would write reviews. None did. When WFA 2/e was published, I provided a list of about 25 folks (that I had already contacted) to the publisher, and they were provided copies of the book. Almost all of them have written reviews.

Marketing
Marketing your book yourself is a great idea, and there's nothing to stop you from doing this...in some cases, you may be more familiar with industry and how to get "the word" out better than the publisher's marketing staff. In most cases, they have a set program that they follow, and you can follow a sort of "guerrilla marketing" plan. Using social networking sites and any lists you're on and forums you frequent, talk about your book and what's in it. Reference the publisher's page and the Amazon page for your book, and post the cover art graphic where it makes sense to do so.

Like I said, reviews are good, as they help with marketing your book. If you can get someone well-known and well-respected within the community to write a review of your book, and it's positive (yeah, no kidding, right?), then that's going to be the little push that gets someone who's heard about your book and is sitting on the fence to purchase it. If the reviews are posted to Amazon, that's a great site to reference. Blogging and posting links to reviews on other sites is also good. Several years ago, Richard Bejtlich noted and documented a favorable shift in the "Amazon Bestsellers Rank" for his book following a review being posted on Slashdot.

Think about something that you've been interested in...a car, an e-reader, or anything else. If you have a choice, how does the recommendation of a trusted friend weigh in your decision? This is how reviews work. However, much like the technical review I mentioned above, a review that says, "hey, this is a good book" and little else really isn't much of a help. One way to get some of these really useful reviews is to establish relationships through professional networking before writing your book, or early on in the process of writing your book. Lots of folks out there are known to "trade" books and reviews with other authors...and really, there's nothing wrong with this. In fact, it's a great idea. I recently reviewed the Malware Analyst's Cookbook, which was not only a fount of information, but excellent for cross-pollination between what I do and what the author's do.

I mentioned in an earlier post that I felt as if I wanted to share my experiences after having written five books, and been a minor co-author on a sixth.

First, I wanted to share a bit about my history of how I got involved in writing books, just to give you some perspective. I didn't start writing books; instead, I started reviewing books and book proposals. This seemed like a great way to see what was up and coming in the industry, as well as to make a little mad money on the side (or, if the remuneration was books, to stock my library). At one point, I was working on a review and completely disagreed with something the authors stated with respect to NTFS alternate data streams; not only did I disagree with it, but I offered up some text of what I thought the section should say. In the end, the authors agreed and accepted my contribution.

When the book was published, the publisher asked the authors if they knew of anyone who might be interested in writing a book. My name was offered up along with several others, and I accepted...and began the process of discovery that has led me to this point.

Further, I do have a long history of writing, albeit not books. Like many of us, I have a public school education. 'Nuff said, right? I wrote in college. I wrote during my first career as a military officer. I wrote a thesis for my graduate degree. I have written a lot of reports since I got out of the military and began pursing a career in the information security field. I can't say that I've enjoyed all of the writing, but it does provide both breadth and depth to my writing experience. In every case, there's some bad stuff that I didn't like and leave behind, and in most cases, there are some gems that have really benefited me that I can trace back to some of that early experience.

What I'd like to do now is provide something of a process but really more of my experiences and what I've learned in the process of writing books. My hope is that someone will take a look at this and perhaps decide to pick up their pen, as it were, and put it to paper. I know that there are some really smart folks out there with some really good ideas that need to be shared, and writing a book is a great way to do that.

Why write a book?
The first thing you need to think about is, why do you want to write a book? Some folks I have met want to write a book so that home users know what to do to secure their systems, or the members of their church know more about the Internet in general. Personally, I wanted to take all that stuff I had laying around in different locations and put it in one place...yes, that's right, I use my own book as a reference. ;-) After my first book, I wanted to prove to myself that I wasn't a one-trick pony and that this was something I could do again.

If you're in a technical field, do not expect to get rich writing a book, or even several books..so that's not a reason to write a book. It just it's going to happen. The technical field does not have the market that other genres tend to enjoy; in fact, the more technical and narrowly focused your book, the more of a niche market you'll be focused on and the less likely you will be to really "score".

There can be a number of reasons to write a book...those that I've mentioned above are just some of them. However, if you don't have a good reason or a goal that you'd like to reach, what's going to keep you going through the process?

Choose a topic
So, what do you want to write about? Clearly, if you're reading this blog, then you're interested in technical topics, including incident response and/or digital forensics. Okay, that's a good place to start. Can you narrow it down...or should you? Sometimes, taking a broad brush approach is a great way to get started on a topic. I've found that focusing very narrowly has proven to be the way to go for what I'm writing about...the narrow focus being forensic analysis of Windows systems.

However, I don't think that this process is really specific to just technical books. I think a lot of my experiences in writing books can be applied to other areas/genres, as well...such as writing children's books.

Research the topic
Look online and at bookstores to see if there are any current books that cover your chosen topic. If there are, you would have to determine how you would differentiate your book from the others. Will your book be more up-to-date, will you provide a different perspective somehow?

If there aren't any other books or resources that cover what you're interested in writing about...you may be home free.

Another aspect of this research what will benefit you greatly is to take a look at other resources, and not just those related to your chosen topic. Look at books in your chosen genre that you've enjoyed reading, and try to determine what it is you really enjoyed about them. One early example that I found that I really enjoyed is sidebars, little snippets that usually appear on the page in a grey box that tend to pertain to what you're currently reading, even if only tangentially. I recently reviewed the Malware Analyst's Cookbook, and I really like the idea of "recipes".

Create a detailed outline
Before you begin writing your book, outline it. Yes, just like you learned in grade school...and you thought you'd never use that again, like math. Begin with a simple outline, and begin adding to it. This allows you to begin to organize your thoughts with respect to writing your book, and begin preparing for the questions you're going to eventually encounter, such as how many chapters your book will have, what topics it will cover, etc. When I've put together outlines, I've found that just the act of writing the outline has led me to the idea that my chapters need to be restructured to make better sense, and that I needed to add additional chapters, as well.

A detailed outline helps me to organize my thoughts, and see where I need to include images, charts, figures, tables, etc. Would an image here make really good sense, and would a table here that encapsulates and summarizes the last three paragraphs really be useful to the reader?

Adding detail to your outline will only benefit you in the long run. Having a detailed outline keeps you on-point and on-track, provides some structure to what you're doing while you're doing it, and can be very beneficial, particularly if you've taken additional notes and written down some choice phrases that you'd like to use.

Just so you know, both publishers I've worked with thus far have asked for this research and work (i.e., outline) to be done and submitted as part of a proposal before going forward. So, you're going to *have* to do the work, and as much as I didn't want to do it the first time, I found out that going through the process...I mean, really going through it, not just doing it to get it done...made a difference.

Seek review
Most of us in the technical field do not like to have our written matter (when we do it) reviewed. I know that. You know it, too. But know that as you begin going down this road, you're going to get tunnel vision and you won't see the forest for the trees. To use another cliche and score a hat trick, you'll be too far down in the weeds and you'll need a reality check. Find someone you trust to give you honest, thoughtful criticism. When I was writing my very first book, I got a lot of that kind of criticism from Jennifer Kolde, and I've used what I learned through our exchanges to try and improve my writing with each book. As much as you won't want to, it will only benefit you to find someone (or someones, plural) to take a look at your ideas and give you a reality check.

Know that it will suck
That's right...simply accept the fact that this will be hard. Why? If you choose to write a book, you're going to have to write, which means you'll be adding a new activity that is going to replace an old activity in your life. You may have to give something up...at least, in part. My lovely wife, God bless her, says that when I was writing my first book, she had no idea that I was writing a book. That was because I rarely gave up our dates during that process...instead, taking her to dinner or a comedy show served as a much needed break.

Also, the truth is, most people don't like to write, especially technical people. Case notes, reports, you name it...most technical folks simply do not enjoy the act of writing.

However, with a little (okay, a lot) prior planning, you can make the process of writing a book much easier.