File System Forensic Analysis

This book explains how to analyze data structures that partition and assemble storage volumes as well as the data structures in a volume that are used to store and retrieve files. After examining PC-based and server-based partitions, the author describes file allocation table (FAT), NTFS, and Unix file systems, and illustrates the manual analysis of example disk images. The information will help security experts identify where a file existed on disk and the various data structures that need to be in sync to view it.
Check Catalog