Sammes, Tony, and Brian Jenkinson. Forensic Computing: A Practitioner's Guide. New York: Springer-Verlag, 2000.
T13. "Information TechnologyAT Attachment Interface for Disk Drives." X3T10, 791D Revision 4c, 1994. http://www.t13.org/project/d0791r4c-ATA-1.pdf.
T13. "Information TechnologyAT Attachment with Packet Interface6 (ATA/ATAPI-6)." 1410D Revision 3b, February 26, 2002. http://www.t13.org/docs2002/d1410r3b.pdf.
T13. "Information TechnologyAT Attachment with Packet Interface Extension (ATA/ATAPI-4)." 1153D Revision 18, August 19, 1998. http://www.t13.org/project/d1153r18-ATA-ATAPI-4.pdf.
T13. "Information TechnologyAT Attachment-3 Interface (ATA-3)." X3T13, 2008D Revision 7b, January 27, 1997. http://www.t13.org/project/d2008r7b-ATA-3.pdf.
Part I: Foundations
Digital Investigation Foundations
Computer Foundations
Hard Disk Data Acquisition
Part II: Volume Analysis
Volume Analysis
PC-based Partitions
Server-based Partitions
Multiple Disk Volumes
Part III: File System Analysis
File System Analysis
FAT Concepts and Analysis
FAT Data Structures
NTFS Concepts
NTFS Analysis
NTFS Data Structures
Ext2 and Ext3 Concepts and Analysis
Ext2 and Ext3 Data Structures
UFS1 and UFS2 Concepts and Analysis
UFS1 and UFS2 Data Structures
Summary
Bibliography
Bibliography