This book explains how to analyze data structures that partition and assemble storage volumes as well as the data structures in a volume that are used to store and retrieve files. After examining PC-based and server-based partitions, the author describes file allocation table (FAT), NTFS, and Unix file systems, and illustrates the manual analysis of example disk images. The information will help security experts identify where a file existed on disk and the various data structures that need to be in sync to view it. Annotation ฉ2004 Book News, Inc., Portland, OR
Part 1 Foundation
Part 2 Volume Analysis
Part 3 File System Analysis
Appendix A The Sleuth Kit and Autopsy