File system forensic analysis / Brian Carrier.

CONTENTS

PART I: FOUNDATIONS
Digital investigation foundations --
digital investigations and evidence
digital crime scene investigation process
data analysis
e.tc

Computer foundations --
data organizations
booking process
hard disk technology
e.tc

Hard disk data acquisition --
introduction
reading the source data
writing the output data
e.tc

PART II: VOLUME ANALYSIS

Volume analysis --
introduction
background
analysis basics
summary

PC-based partitions --
DOS partitions
Apple partitions
Removable media
Bibliography

Server-based partitions --
BSD partitions
sun solaris slices
GPT partitions
e.tc

Multiple disk volumes --
RAID
DISK Spanning
bibliography

PART III: FILE SYSTEM ANALYSIS
File system analysis --
what is a file system
file system category
content category
e.tc

FAT concepts and analysis --
introduction
file system category
content category
metadata category
e.tc

FAT data structures --
boot sector
FAT32 FSINFO
FAT
e.tc

NTFS concepts --
Introduction
Everything is a file
MFT concepts
e.tc

NTFS analysis --
file system category
content category
metadata category
e.tc

NTFS data structures --
Basic concepts
standard file attributes
index attributes and data structures
e.tc

Ext2 and Ext3 concepts and analysis --
Introduction
file system category
content category
metadata category
e.tc

Ext2 and Ext3 data structures --
superblock
group descriptor tables
block bitmap
Inodes
e.tc

UFS1 and UFS2 concepts and analysis --
Introduction
file system category
content category
metadata category
e.tc

UFS1 and UFS2 data structures --
UFS1 superblock
UFS2 superblock
Cylinder group summary
e.tc

Appendix A: The sleuth kit and autopsy.

Includes bibliographical references and index P. 547-569