Other Topics

Table of contents:


Bates, Jim. "File Deletion in MS FAT Systems." September 23, 2002. http://www.computer-investigations.com/arts/tech02.html.

Brouwer, Andries. "The FAT File System." September 20, 2002. http://www.win.tue.nl/~aeb/linux/fs/fat/fat.html.

Carrier, Brian. "FAT Undelete Test #1." Digital Forensic Tool Testing, February 2004a. http://dftt.sourceforge.net/.

Carrier, Brian. "FAT Volume Label Test #1." Digital Forensic Tool Testing, August 2004b. http://dftt.sourceforge.net/.

Casey, Eoghan. "Tool ReviewWinHex." Journal of Digital Investigation, 1(2), 2004.

Landis, Hale, "How It Works: DOS Floppy Disk Boot Sector." May 6, 2002. http://www.ata-atapi.com/hiwdos.htm.

Microsoft. "FAT: General Overview of On-Disk Format." FAT32 File System Specification, Version 1.03, December 6, 2000. http://www.microsoft.com/whdc/system/platform/firmware/fatgen.mspx.

Microsoft. "Last Access Date." MSDN Library, February 2003a. http://msdn.microsoft.com/library/en-us/win9x/lfn_5mg5.asp?frame=true.

Microsoft. "How to Fix Cross-linked Files." Microsoft Knowledge Base Article83140, May 10, 2003b. http://support.microsoft.com/default.aspx?scid=kb;en-us;83140.

Microsoft. "MS-DOS FORMAT Does Not Preserve Clusters Marked Bad." Knowledge Base Article103548, May 6, 2003c. http://support.microsoft.com/default.aspx?scid=kb;en-us;103548.

Microsoft. "Description of NTFS Date and Time Stamps for Files and Folders." Microsoft Knowledge Base Article 299648, July 3, 2003d. http://support.microsoft.com/default.aspx?scid=kb;en-us;299648.

Microsoft. "Detailed Explanation of FAT Boot Sector." Microsoft Knowledge Base Article Q140418, December 6, 2003e. http://support.microsoft.com/kb/q140418/.

Microsoft. "Encodings and Code Pages." Global Development and Computing Portal, 2004a. http://www.microsoft.com/globaldev/getWR/steps/wrg_codepage.mspx.

Microsoft. "How to Cause ScanDisk for Windows to Retest Bad Clusters." Microsoft Knowledge Base Article127055, December 16, 2004b. http://support.microsoft.com/default.aspx?scid=kb;en-us;127055.

Microsoft. "Windows 2000 Server Operations Guide (Part 1)." n.d. http://www.microsoft.com/resources/documentation/windows/2000/server/reskit/en-us/serverop/part1/sopch01.mspx.

Wilson, Craig. "Volume Serial Numbers & Format Verification Date/Time." Digital Detective White Paper, October 2003. http://www.digital-detective.co.uk/documents/Volume%20Serial%20Numbers.pdf.

Part I: Foundations

Digital Investigation Foundations

Computer Foundations

Hard Disk Data Acquisition

Part II: Volume Analysis

Volume Analysis

PC-based Partitions

Server-based Partitions

Multiple Disk Volumes

Part III: File System Analysis

File System Analysis

FAT Concepts and Analysis

FAT Data Structures

NTFS Concepts

NTFS Analysis

NTFS Data Structures

Ext2 and Ext3 Concepts and Analysis

Ext2 and Ext3 Data Structures

UFS1 and UFS2 Concepts and Analysis

UFS1 and UFS2 Data Structures




File System Forensic Analysis
File System Forensic Analysis
ISBN: 0321268172
EAN: 2147483647
Year: 2006
Pages: 184
Authors: Brian Carrier

Flylib.com © 2008-2020.
If you may any questions please contact us: flylib@qtcs.net