Forensic Examination of Windows-Supported File Systems

Elrick, Doug; Elrick, Drew

ISBN 10: 1497358353 / ISBN 13: 9781497358355

Published by Createspace Independent Publishing Platform, 2014

About this Item

Seller Inventory # LU-9781497358355

Bibliographic Details

• Title: Forensic Examination of Windows-Supported File Systems
• Publisher: Createspace Independent Publishing Platform
• Publication Date: 2014
• Language: English
• ISBN 10: 1497358353
• ISBN 13: 9781497358355
• Binding: Paperback
• Illustrator: Elrick, Drew
• Condition: New
• Weight: 1202 grams

About this title

Synopsis

Understanding the underlying system of how files are stored, what happens when they are deleted, and how to potentially recover them is essential to the digital forensic examiner. Today’s computer forensic tools automate the process of file recovery, but understanding what those tools are accomplishing and knowing whether they are providing accurate results requires an understanding of the information provided in this text. The FAT and NTFS file systems are the most commonly utilized information storage methods and while there are many other methods available, concentrating on these two lays the foundation for learning the others in the future. A brief introduction of ExFAT is included, as it is a relatively new file system used with larger flash drives. Forensic Examination of Windows-Supported File Systems will provide the basis for this knowledge and the practical expertise to begin the journey of becoming a digital forensic scientist.

About the Author

Doug Elrick has worked in the area of digital forensics for over twenty years. He instructs law enforcement and corporate security investigators in proper forensic methodologies and in the use of common computer forensic applications. Doug holds a Master's of Science in Digital Forensics from the University of Central Florida and has obtained the following digital forensic certifications: CFCE and CAWFE from IACIS, EnCE from Guidance Software, and ACE from AccessData.