Apress

Forensic Computing

2nd Edition

By Anthony Sammes , Brian Jenkinson

Forensic Computing Cover Image

The second edition of this successful book shows how the contents of computer systems can be recovered for criminal evidence, even when hidden or subverted. Coverage includes Windows XP/2000 file systems, fast drives, new encryption technologies, and personal organisers.

Full Description

  • ISBN13: 978-1-8462-8397-0
  • 480 Pages
  • User Level: Students
  • Publication Date: August 18, 2007
  • Available eBook Formats: PDF
  • eBook Price: $89.95
Buy eBook Buy Print Book Add to Wishlist
Full Description
In the second edition of this very successful book, Tony Sammes and Brian Jenkinson show how information held in computer systems can be recovered and how it may be deliberately hidden or subverted for criminal purposes. 'Forensic Computing: A Practitioner's Guide' is illustrated by plenty of case studies and worked examples, and will help practitioners and students gain a clear understanding of: - how to recover information from computer systems in such a way as to ensure that its integrity cannot be challenged and that it will be accepted as admissible evidence in court the principles involved in password protection and data encryption - the evaluation procedures used in circumventing these safeguards - the particular legal issues associated with computer-generated evidence and how to ensure admissibility of such evidence. This edition is fully expanded and updated with treatment of metadata files, NFTS systems, CHS and LBA addressing, and alternate data streams.
Table of Contents

Table of Contents

  1. Forensic Computing.
  2. Understanding Information.
  3. IT Systems Concepts.
  4. PC Hardware and Inside the Box.
  5. Disk Geometry.
  6. The New Technology File System.
  7. The Treatment of PCs.
  8. The Treatment of Electronic Organisers.
  9. Looking ahead (just a little bit more).
  10. Appendices: Common Character Codes; Some Common File Format Signatures; A Typical Set of POST Codes; Typical BIOS Beep Codes and Error Messages; Disk Partition Table Types; Extended Partitions; Registers and Order Code for the INtel 8086; NFTS Boot Sector and BIOS Parameter Block; MFT Header and Attribute Maps; The Relationship between CHS and LBA Addressing; Alternate Data Streams
  11. a Brief Explanation.
Errata

If you think that you've found an error in this book, please let us know about it. You will find any confirmed erratum below, so you can check if your concern has already been addressed.

* Required Fields

No errata are currently published