Description
Book SynopsisIn the second edition of this very successful book, Tony Sammes and Brian Jenkinson show how the contents of computer systems can be recovered, even when hidden or subverted by criminals. Equally important, they demonstrate how to insure that computer evidence is admissible in court. Updated to meet ACPO 2003 guidelines, Forensic Computing: A Practitioner's Guide offers: methods for recovering evidence information from computer systems; principles of password protection and data encryption; evaluation procedures used in circumventing a system’s internal security safeguards, and full search and seizure protocols for experts and police officers.
Trade ReviewFrom the reviews of the second edition:
"This book was the product of an ‘arms race’. … It is now listed as the standard text around which all the Forensic Computing courses at Cranfield and some other universities are based. … It is filled with good practical advice and is especially good on interpreting partition tables. … All in all this is a useful … guide to the discipline. … Truly the forensic computing expert is living in interesting times." (Alikelman, June, 2009)
Table of ContentsForensic Computing
Understanding Information
IT Systems Concepts
PC Hardware and Inside The Box
Disk Geometry
The New Technology File System
The Treatment of PCs
The Treatment of Electronic Organisers
Looking Ahead (Just a little bit more)
Appendices: Common Character Codes; Some Common File Format Signatures; A Typical Set of POST codes; Typical BIOS Beep Codes and Error Messages; Disk Partition Table Types; Ezxtended Partitions; Registers and Order Code for the INtel 8086; NFTS Boot Sector and BIOS Parameter Block; MFT Header and Attribute Maps; The Relationship Between CHS and LBA Addressing; Alternate Data Streams - a Brief Explanation
