Bates, Jim. "File Deletion in MS FAT Systems." September 23, 2002. http://www.computer-investigations.com/arts/tech02.html.
Brouwer, Andries. "The FAT File System." September 20, 2002. http://www.win.tue.nl/~aeb/linux/fs/fat/fat.html.
Carrier, Brian. "FAT Undelete Test #1." Digital Forensic Tool Testing, February 2004a. http://dftt.sourceforge.net/.
Carrier, Brian. "FAT Volume Label Test #1." Digital Forensic Tool Testing, August 2004b. http://dftt.sourceforge.net/.
Casey, Eoghan. "Tool ReviewWinHex." Journal of Digital Investigation, 1(2), 2004.
Landis, Hale, "How It Works: DOS Floppy Disk Boot Sector." May 6, 2002. http://www.ata-atapi.com/hiwdos.htm.
Microsoft. "FAT: General Overview of On-Disk Format." FAT32 File System Specification, Version 1.03, December 6, 2000. http://www.microsoft.com/whdc/system/platform/firmware/fatgen.mspx.
Microsoft. "Last Access Date." MSDN Library, February 2003a. http://msdn.microsoft.com/library/en-us/win9x/lfn_5mg5.asp?frame=true.
Microsoft. "How to Fix Cross-linked Files." Microsoft Knowledge Base Article83140, May 10, 2003b. http://support.microsoft.com/default.aspx?scid=kb;en-us;83140.
Microsoft. "MS-DOS FORMAT Does Not Preserve Clusters Marked Bad." Knowledge Base Article103548, May 6, 2003c. http://support.microsoft.com/default.aspx?scid=kb;en-us;103548.
Microsoft. "Description of NTFS Date and Time Stamps for Files and Folders." Microsoft Knowledge Base Article 299648, July 3, 2003d. http://support.microsoft.com/default.aspx?scid=kb;en-us;299648.
Microsoft. "Detailed Explanation of FAT Boot Sector." Microsoft Knowledge Base Article Q140418, December 6, 2003e. http://support.microsoft.com/kb/q140418/.
Microsoft. "Encodings and Code Pages." Global Development and Computing Portal, 2004a. http://www.microsoft.com/globaldev/getWR/steps/wrg_codepage.mspx.
Microsoft. "How to Cause ScanDisk for Windows to Retest Bad Clusters." Microsoft Knowledge Base Article127055, December 16, 2004b. http://support.microsoft.com/default.aspx?scid=kb;en-us;127055.
Microsoft. "Windows 2000 Server Operations Guide (Part 1)." n.d. http://www.microsoft.com/resources/documentation/windows/2000/server/reskit/en-us/serverop/part1/sopch01.mspx.
Wilson, Craig. "Volume Serial Numbers & Format Verification Date/Time." Digital Detective White Paper, October 2003. http://www.digital-detective.co.uk/documents/Volume%20Serial%20Numbers.pdf.
Part I: Foundations
Digital Investigation Foundations
Computer Foundations
Hard Disk Data Acquisition
Part II: Volume Analysis
Volume Analysis
PC-based Partitions
Server-based Partitions
Multiple Disk Volumes
Part III: File System Analysis
File System Analysis
FAT Concepts and Analysis
FAT Data Structures
NTFS Concepts
NTFS Analysis
NTFS Data Structures
Ext2 and Ext3 Concepts and Analysis
Ext2 and Ext3 Data Structures
UFS1 and UFS2 Concepts and Analysis
UFS1 and UFS2 Data Structures
Summary
Bibliography
Bibliography