Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.

  • Apple
  • Android
  • Windows Phone
  • Android

To get the free app, enter your mobile phone number.
Download to your computer
Kindle Cloud Reader

File System Forensic Analysis 1st Edition

by
Brian Carrier (Author)
› Visit Amazon's Brian Carrier Page
Find all the books, read about the author, and more.
See search results for this author
Are you an author? Learn about Author Central
Brian Carrier (Author)
4.7 out of 5 stars 59 customer reviews
ISBN-13: 978-0321268174
ISBN-10: 0321268172
Why is ISBN important?
ISBN
This bar-code number lets you verify that you're getting exactly the right version or edition of a book. The 13-digit and 10-digit formats both work.
Scan an ISBN with your phone
Use the Amazon App to scan ISBNs and compare prices.
Trade in your item
Get a $11.50
Gift Card.
Trade in
Learn More
Have one to sell? Sell on Amazon

Sorry, there was a problem.

There was an error retrieving your Wish Lists. Please try again.

Sorry, there was a problem.

List unavailable.
Facebook Twitter Pinterest <Embed>
Rent On clicking this link, a new layer will be open
$19.81 On clicking this link, a new layer will be open
Buy used On clicking this link, a new layer will be open
$30.32 On clicking this link, a new layer will be open
Buy new On clicking this link, a new layer will be open
$53.47 On clicking this link, a new layer will be open
More Buying Choices
37 New from $44.87 44 Used from $19.76
81 used & new from $19.76
See All Buying Options
Free Two-Day Shipping for College Students with Prime Student Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student

The Amazon Book Review
The Amazon Book Review
Author interviews, book reviews, editors picks, and more. Read it now
$53.47 FREE Shipping. In Stock. Ships from and sold by Amazon.com. Gift-wrap available.
click to open popover

Frequently Bought Together

  • File System Forensic Analysis
  • +
  • Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, 3rd Edition
Total price: $105.76
Buy the selected items together

Customers Viewing This Page May Be Interested In These Sponsored Links

  (What's this?)
NO_CONTENT_IN_FEATURE
New York Times best sellers
Browse the New York Times best sellers in popular categories like Fiction, Nonfiction, Picture Books and more. See more

Product Details

  • Paperback: 600 pages
  • Publisher: Addison-Wesley Professional; 1 edition (March 27, 2005)
  • Language: English
  • ISBN-10: 0321268172
  • ISBN-13: 978-0321268174
  • Product Dimensions: 7 x 1.2 x 9 inches
  • Shipping Weight: 2 pounds (View shipping rates and policies)
  • Average Customer Review: 4.7 out of 5 stars  See all reviews (59 customer reviews)
  • Amazon Best Sellers Rank: #146,132 in Books (See Top 100 in Books)

    •  Would you like to update product info or give feedback on images?

Customers Viewing This Page May Be Interested In These Sponsored Links

  (What's this?)

Customer Reviews

Top Customer Reviews

5.0 out of 5 starsexcellent coverage of the area, high quality writing
By jose_monkey_org on August 30, 2005
Format: Paperback
It's easy to think that computer filesystems are relatively simple things. After all, if 'dir' or 'ls' don't show what you're looking for, maybe an undelete program will work. Or will it? To be a decent, trustworthy expert in forensics (a requirement if you plan to participate in any criminal investigations), you'll have to learn how filesystems really operate, how tools like undelete and lazarus work, and how they can be defeated.

Carrier's book isn't a legal book at all, and it doesn't pretend to offer much insight into the law surrounding forensics. Instead it focuses on technical matters, and is sure to be the gold standard in its field. This is important, because it comes at you expecting you to have some knowledge, even if only informal, of what a filesystem contains. With a basic understanding of data structures, you'll get a wealth of information out of this book, and it will be a good reference long after you've first studied it.

File System Forensic Analysis is divided into three sections. These are arranged in the order that you'll want to study them to maximize the benefit you can hope to achieve, namely an understanding of how to examine filesystems for hidden or previously stored data. The first three chapters cover a fundamental series of topics: Digital Investigation Foundations, Computer Foundations, and an introduction to Hard Disk Data Acquisition. While they start at a basic level (e.g. what hexadecimal is), they quickly progress to more developed topics, such as the types of interfaces (SATA, SCSI, IDE), the relationship of the disk to the computer system as a whole, and how data is stored in a file and filesystem at a basic level.Read more ›
1 Comment 42 people found this helpful. Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse
5.0 out of 5 starsMust Have Resource for Digital Forensics
By D. Baker on May 5, 2005
Format: Paperback
Brian Carrier has written a solid book that should be on the reference shelf of anyone in the Digital Forensics field that conducts analysis of file systems. The book is well organized into three parts, each with multiple chapters.

The first part discusses the foundations necessary to understand digital evidence, computer functions and acquiring data for analysis. This part is intentionally at a higher level, yet still provides the necessary foundations for the subsequent parts. A good explanation of host protected area (HPA) and device configuration overlays (DCO) is included, as well as methods by which one can test for such areas on volumes.

The second part discusses volume analysis. Brian takes this topic and divides it into four chapters addressing basic volumes, personal computer volumes, server volumes and finally multiple disk volumes. He provides detailed information on a variety of common partition types, even including both SPARC and i386 partition information for Sun Solaris.

Finally the third part discusses file system analysis, and the last 10 chapters are dedicated to covering general information, and then detailed descriptions of concepts, analysis and data structures for FAT, NTFS, Ext2, Ext3, UFS1 and UFS2 file systems. The detailed information provided well-documented explanations and included analysis scenarios. For instance, in his discussion of NTFS analysis, an image of a damaged disk is evaluated, and he provides meaningful explanations of reconstructing the damaged tables to allow analysis of the data. He provides many such examples throughout.Read more ›
Comment 11 people found this helpful. Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse
5.0 out of 5 starsAccept no substitutes -- THE book to read on file systems
By Richard Bejtlich on October 9, 2006
Format: Paperback
I decided to read and review three digital forensics books in order to gauge their strengths and weaknesses: "File System Forensic Analysis" (FSFA) by Brian Carrier, "Windows Forensics" (WF) by Chad Steel, and "EnCase Computer Forensics" (ECF) by Steve Bunting and William Wei. All three books contain the word "forensics" in the title, but they are very different. If you want authoritative and deeply technical guidance on understanding file systems, read FSFA. If you want to focus on understanding Windows from an investigator's standpoint, read WA. If you want to know more about EnCase (and are willing to tolerate or ignore information about forensics itself), read ECF.

In the spirit of full disclosure I should mention I am co-author of a forensics book ("Real Digital Forensics") and Brian Carrier cites my book "The Tao of Network Security Monitoring" on p 10. I tried to not let those facts sway my reviews.

FSFA has received lengthy and glowing reviews, so I will keep my comments brief. Of the three books I cited earlier, FSFA was the only one which really grabbed my attention. I am a network-centric security practitioner, but Brian Carrier's organization, thoughtfulness, and delivery really hooked me. I very much appreciate authors who define a framework and explain potentially complicated topics within that framework.

For example, Brian is very keen to promote the scientific method. His emphasis on hypotheses and looking for evidence to refute them made me take a second look at my own practices. Brian differentiates between "essential" and "nonessential" data, where the former must be accurate in order for a user to access data and the latter not necessarily needing to be accurate. Again, this is a great way to think about digital evidence in any form.Read more ›
Comment 13 people found this helpful. Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse

Most Recent Customer Reviews

3.0 out of 5 starsNot an easy read but good resource

My understanding is that this book is going to be updated and if so, would be welcome. I read a ton of reviews that praised this book and while I'm sure they are correct, it's not... Read more

Published 4 months ago by M. Bradley
5.0 out of 5 starsStill relevant in 2016

Great book. Very informative and content is still relevant despite the book's age.
I was able to write a large amount of PowerShell code using the information in this book and... Read more

Published 5 months ago by David H
5.0 out of 5 starsBest book on file systems

Lost my old copy. Best book on file systems,

Published 6 months ago by william a schroeder
5.0 out of 5 starsFive Stars

Excrutiatingly detailed yet readable and well formatted. THE file system reference for the forensically minded.

Published 9 months ago by M. S. Bush
5.0 out of 5 starsEssential

I've not completed reading this book yet but let me tell you this is absolutely the book that needed to be written on this subject. Read more

Published 9 months ago by Aaron
5.0 out of 5 starsGreat

Great

Published 13 months ago by Daniel
5.0 out of 5 starsFive Stars

Excellent product

Published 13 months ago by Arenzo Lee Jefferson III
5.0 out of 5 starsFive Stars

Great reference book to any computer library.

Published 16 months ago by Luis Fretz
5.0 out of 5 starsFive Stars

A mandatory resource for anyone interested in computer forensics.

Published 20 months ago by Philip B Catzen
5.0 out of 5 starsGood product

Perfect State, didn't take long to arrive.

Published 20 months ago by Lucas Brilhante

Set up an Amazon Giveaway

File System Forensic Analysis
Amazon Giveaway allows you to run promotional giveaways in order to create buzz, reward your audience, and attract new followers and customers. Learn more about Amazon Giveaway
This item: File System Forensic Analysis
Set up a giveaway

There's a problem loading this menu right now.

Learn more about Amazon Prime.