File System Forensic Analysis

ISBN: 0321268172
EAN: 2147483647

Year: 2006
Pages: 184

Authors: Brian Carrier

BUY ON AMAZON

Part I: Foundations

Digital Investigation Foundations

• Digital Investigation Foundations
• Digital Investigations and Evidence
• Digital Crime Scene Investigation Process
• Data Analysis
• Overview of Toolkits
• Summary
• Bibliography

Computer Foundations

• Computer Foundations
• Data Organization
• Booting Process
• Hard Disk Technology
• Summary
• Bibliography

Hard Disk Data Acquisition

• Hard Disk Data Acquisition
• Introduction
• Reading the Source Data
• Writing the Output Data
• A Case Study Using dd
• Summary
• Bibliography

Part II: Volume Analysis

Volume Analysis

• Volume Analysis
• Introduction
• Background
• Analysis Basics
• Summary

PC-based Partitions

• PC-based Partitions
• DOS Partitions
• Analysis Considerations
• Apple Partitions
• Removable Media
• Bibliography

Server-based Partitions

• Server-based Partitions
• BSD Partitions
• Sun Solaris Slices
• GPT Partitions
• Summary
• Bibliography

Multiple Disk Volumes

• Multiple Disk Volumes
• RAID
• Disk Spanning
• Bibliography

Part III: File System Analysis

File System Analysis

• File System Analysis
• What is a File System?
• File System Category
• Content Category
• Metadata Category
• File Name Category
• Application Category
• Application-level Search Techniques
• Specific File Systems
• Summary
• Bibliography

FAT Concepts and Analysis

• FAT Concepts and Analysis
• Introduction
• File System Category
• Content Category
• Metadata Category
• File Name Category
• The Big Picture
• Other Topics
• Summary
• Bibliography

FAT Data Structures

• FAT Data Structures
• Boot Sector
• FAT
• Directory Entries
• Long File Name Directory Entries
• Summary
• Bibliography

NTFS Concepts

• NTFS Concepts
• Introduction
• Everything is a File
• MFT Concepts
• MFT Entry Attribute Concepts
• Other Attribute Concepts
• Indexes
• Analysis Tools
• Summary
• Bibliography

NTFS Analysis

• NTFS Analysis
• File System Category
• Content Category
• Metadata Category
• File Name Category
• Application Category
• The Big Picture
• Other Topics
• Summary
• Bibliography

NTFS Data Structures

• NTFS Data Structures
• Basic Concepts
• Standard File Attributes
• Index Attributes and Data Structures
• File System Metadata Files
• Summary
• Bibliography

Ext2 and Ext3 Concepts and Analysis

• Ext2 and Ext3 Concepts and Analysis
• Introduction
• File System Category
• Content Category
• Metadata Category
• File Name Category
• Application Category
• The Big Picture
• Other Topics
• Summary
• Bibliography

Ext2 and Ext3 Data Structures

• Ext2 and Ext3 Data Structures
• Superblock
• Group Descriptor Tables
• Block Bitmap
• Inodes
• Extended Attributes
• Directory Entry
• Symbolic Link
• Hash Trees
• Journal Data Structures
• Summary
• Bibliography

UFS1 and UFS2 Concepts and Analysis

• UFS1 and UFS2 Concepts and Analysis
• Introduction
• File System Category
• Content Category
• Metadata Category
• File Name Category
• The Big Picture
• Other Topics
• Summary
• Bibliography

UFS1 and UFS2 Data Structures

• UFS1 and UFS2 Data Structures
• UFS1 Superblock
• UFS2 Superblock
• Cylinder Group Summary
• UFS1 Group Descriptor
• UFS2 Group Descriptor
• Block and Fragment Bitmaps
• UFS1 Inodes
• UFS2 Inodes
• Directory Entries

Summary

• Summary

Bibliography

• Bibliography

Bibliography

• Bibliography