TY  - BOOK
AU  - Carrier,Brian
TI  - File system forensic analysis
SN  - 0321268172 (pbk.)
AV  - QA76.9.A25 C37 2005
U1  - 004 22
PY  - 2005///
CY  - Boston, Mass., London
PB  - Addison-Wesley
KW  - Computer science
KW  - Forensic sciences
N1  - Digital investigation foundations -- Computer foundations -- Hard disk data acquisition -- Volume analysis -- PC-based partitions -- Server-based partitions -- Multiple disk volumes -- File system analysis -- FAT concepts and analysis -- FAT data structures -- NTFS concepts -- NTFS analysis -- NTFS data structures -- Ext2 and Ext3 concepts and analysis -- Ext2 and Ext3 data structures -- UFS1 and UFS2 concepts and analysis -- UFS1 and UFS2 data structures -- Appendix A: The sleuth kit and autopsy; Also available online
ER  -