The Definitive Guide to File System Analysis: Key Concepts and Hands-on Techniques Most digital evidence is stored within the computer's file system, but understanding how file systems work is one of the most technically challenging concepts for a digital investigator because there exists little documentation. Now, security expert Brian Carrier has written the definitive reference for everyone who wants to understand and be able to testify about how file system analysis is performed. Carrier begins with an overview of investigation and computer foundations and then gives an authoritative, comprehensive, and illustrated overview of contemporary volume and file systems: Crucial information for discovering hidden evidence, recovering deleted data, and validating your tools. Along the way, he describes data structures, analyzes example disk images, provides advanced investigation scenarios, and uses today's most valuable open source file system analysis tools—including tools he personally developed. Coverage includes Preserving the digital crime scene and duplicating hard disks for "dead analysis" Identifying hidden data on a disk's Host Protected Area (HPA) Reading source data: Direct versus BIOS access, dead versus live acquisition, error handling, and more Analyzing DOS, Apple, and GPT partitions; BSD disk labels; and Sun Volume Table of Contents using key concepts, data structures, and specific techniques Analyzing the contents of multiple disk volumes, such as RAID and disk spanning Analyzing FAT, NTFS, Ext2, Ext3, UFS1, and UFS2 file systems using key concepts, data structures, and specific techniques Finding evidence: File metadata, recovery of deleted files, data hiding locations, and more Using The Sleuth Kit (TSK), Autopsy Forensic Browser, and related open source tools When it comes to file system analysis, no other book offers this much detail or expertise. Whether you're a digital forensics specialist, incident response team member, law enforcement officer, corporate security specialist, or auditor, this book will become an indispensable resource for forensic investigations, no matter what analysis tools you use.

Now in its second edition, Nuclear Forensic Analysis provides a multidisciplinary reference for forensic scientists, analytical and nuclear chemists, and nuclear physicists in one convenient source. The authors focus particularly on the chemical, physical, and nuclear aspects associated with the production or interrogation of a radioactive sample.

Statistical methods provide a logical, coherent framework in which data from experimental science can be analyzed. However, many researchers lack the statistical skills or resources that would allow them to explore their data to its full potential. Introduction to Data Analysis with R for Forensic Sciences minimizes theory and mathematics and focus

The Handbook of Forensic Drug Analysis is a comprehensive chemical and analytic reference for the forensic analysis of illicit drugs. With chapters written by leading researchers in the field, the book provides in-depth, up-to-date methods and results of forensic drug analyses. This Handbook discusses various forms of the drug as well as the origin and nature of samples. It explains how to perform various tests, the use of best practices, and the analysis of results. Numerous forensic and chemical analytic techniques are covered including immunoassay, gas chromatography, and mass spectrometry. Topics range from the use of immunoassay technologies for drugs-of-abuse testing, to methods of forensic analysis for cannabis, hallucinogens, cocaine, opioids, and amphetamine. The book also looks at synthetic methods and law enforcement concerns regarding the manufacture of illicit drugs, with an emphasis on clandestine methamphetamine production. This Handbook should serve as a widely used reference for forensic scientists, toxicologists, pharmacologists, drug companies, and professionals working in toxicology testing labs, libraries, and poison control centers. It may also be used by chemists, physicians and those in legal and regulatory professions, and students of graduate courses in forensic science. - Contributed to by leading scientists from around the world - The only analysis book dedicated to illicit drugs of abuse - Comprehensive coverage of sampling methods and various forms of analysis

"Android Forensics" covers an open source mobile device platform based on the Linux 2.6 kernel and managed by the Open Handset Alliance. This book provides a thorough review of the Android platform including supported hardware devices, the structure of the Android development project, and implementation of core services (wireless communication, data storage, and other low-level functions).

Harlan Carvey has updated Windows Forensic Analysis Toolkit, now in its fourth edition, to cover Windows 8 systems. The primary focus of this edition is on analyzing Windows 8 systems and processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. Harlan Carvey presents real-life experiences from the trenches, making the material realistic and showing the why behind the how. The companion and toolkit materials are hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, Second Edition, which focuses primarily on XP, and Windows Forensic Analysis Toolkit, Third Edition, which focuses primarily on Windows 7. This new fourth edition provides expanded coverage of many topics beyond Windows 8 as well, including new cradle-to-grave case examples, USB device analysis, hacking and intrusion cases, and "how would I do this" from Harlan's personal case files and questions he has received from readers. The fourth edition also includes an all-new chapter on reporting. - Complete coverage and examples of Windows 8 systems - Contains lessons from the field, case studies, and war stories - Companion online toolkit material, including electronic printable checklists, cheat sheets, custom tools, and walk-throughs

This book addresses every aspect of the analysis and reconstruction of the events surrounding a crime. Beginning with established protocols for crime scene processing, the authors outline their unique methodology for event analysis. This technique defines specific actions, discusses the order of those actions, and offers significant insight into determining what did or did not happen in the course of the incident under investigation. Using case studies and more than 200 color photos, the book demonstrates how the method can be used to explain clues that would otherwise be puzzling or ambiguous.