File System Forensic Analysis

by Brian Carrier

The Definitive Guide to File System Key Concepts and Hands-on Techniques Most digital evidence is stored within the computer's file system, but understanding how file systems work is one of the most technically challenging concepts for a digital investigator because there exists little documentation. Now, security expert Brian Carrier has written the definitive reference for everyone who wants to understand and be able to testify about how file system analysis is performed. Carrier begins with an overview of investigation and computer foundations and then gives an authoritative, comprehensive, and illustrated overview of contemporary volume and file Crucial information for discovering hidden evidence, recovering deleted data, and validating your tools. Along the way, he describes data structures, analyzes example disk images, provides advanced investigation scenarios, and uses today's most valuable open source file system analysis tools―including tools he personally developed. Coverage includes When it comes to file system analysis, no other book offers this much detail or expertise. Whether you're a digital forensics specialist, incident response team member, law enforcement officer, corporate security specialist, or auditor, this book will become an indispensable resource for forensic investigations, no matter what analysis tools you use.

Genres: Technical, Reference, Computer Science, Nonfiction, Technology, Computers, Programming

600 pages, Paperback

First published March 17, 2005

Reviews

[Stephen Hargrove · Rating 5 out of 5]

This is more than anyone could ever possibly need or want to know about file systems. Ever.

[Dan · Rating 5 out of 5]

Every computer forensic investigator must have it on their desk. Great reference, though it must be noted that some changed were introduced to NTFS since the book was published.

[Jason]

This is a reference book for any competent computer forensic investigator.

[Mick Petzold · Rating 5 out of 5]

Great book on file systems and file system analysis, typically using The SleuthKit. Brian Carrier is THE expert!

[David · Rating 5 out of 5]

excellent reference, for older filesystems such as FAT.

[Jeff Stewart · Rating 4 out of 5]

Very in depth, but also very dry.

[Mark · Rating 5 out of 5]

could benefit from an update for the filesystems in common use today... ext4, jfs, xfs, zfs and btrfs. otherwise great.

[Aoibh Wood]

Excellent reference