This is an advanced cookbook and reference guide for digital forensic
practitioners. File System Forensic Analysis focuses on the file system and disk.
The file system of a computer is where most files are stored and where most
evidence is found; it also the most technically challenging part of forensic
analysis. This book offers an overview and detailed knowledge of the file
system and disc layout. The overview will allow an investigator to more easily
find evidence, recover deleted data, and validate his tools. The cookbook
section will show how to use the many open source tools for analysis, many of
which Brian Carrier has developed himself.