File System Forensic Analysis

This is an advanced cookbook and reference guide for digital forensic

practitioners. File System Forensic Analysis focuses on the file system and disk.

The file system of a computer is where most files are stored and where most

evidence is found; it also the most technically challenging part of forensic

analysis. This book offers an overview and detailed knowledge of the file

system and disc layout. The overview will allow an investigator to more easily

find evidence, recover deleted data, and validate his tools. The cookbook

section will show how to use the many open source tools for analysis, many of

which Brian Carrier has developed himself.