Browse Books

Reviewer: Panagiotis Louridas

This book is nominally about forensic data analysis, but, arguably, its real subject matter is different, and worthy of a larger audience; this might not be obvious from the book's title, or its first few chapters. The book starts with the very basics: an explanation of the forensic analysis of digital data, and an introduction to the fundamentals of computers and hard disk storage. Readers might or might not be interested to know that "the heart of a modern computer is one or more central processing units [CPUs]," but the pace is swift, so they will not tire of such trivia. The book's real subject is disk storage. Carrier follows a layered approach, describing volumes and partitions first, and then file systems. He talks effortlessly about disk operating system (DOS) partitions, Apple partitions, Berkeley software distribution (BSD) partitions, Solaris slices, globally unique identifier (GUID) partition table (GPT) partitions, and redundant array of independent disks (RAID) and disk spanning, before moving smoothly to file allocation table (FAT), new technology file system (NTFS), second extended file system (Ext2), third extended file system (Ext3), Unix file system 1 (UFS1), and Unix file system 2 (UFS2). A comparative reading of the material is a rewarding experience, especially since, these days, savvy computer professionals are more likely than not to work with a multitude of operating systems. After introducing a topic, the author illustrates it by means of open source tools (he is the author of a popular Unix-based forensic toolkit, The Sleuth Kit). This reads like "Disk Storage Illustrated," and it is, to the book's advantage. It is easy when describing such topics as file systems to remain at the level of boxes and arrows, but Carrier drills down, and shows how the overall architecture is reflected in the real data saved. It is at this point that forensic analysis kicks in. We find out what we should expect to find in our disks, and how we should find it. The author graces us with intriguing details on where data may remain hidden, and there are many nuggets on where to look for (or where to hide) information. This is an engaging and well-written book that manages not to be simplistic while it takes nothing for granted. Although its intended audience is security-related professionals, anybody who needs a refresher in, or an overview of, file system concepts would enjoy reading it. Online Computing Reviews Service

Reviewer: Radu State

Digital forensics is a relatively new science (and art), aimed at recovering evidence from security-related incidents. Such incidents arise mostly when a vulnerable machine is compromised, and starts to host malware and unacceptable files (copyright protected software and/or offensive content). Recovering digital evidence from such a compromised machine requires from an investigator both adequate software and the necessary knowledge. Reading this book is a journey to the bits on your hard disk. The journey starts with an introduction to the foundations of digital investigation: existing toolkits, search and preservation methods, and data analysis methods. The computer science foundations required to perform digital forensics are presented in the next chapters, covering mostly hard disk technologies, disk reading, and hexadecimal and binary number representation. This section might seem to be a simple and basic overview, but several slipped-in details, like host protected area (HPA) and basic input-output system (BIOS) versus direct data access, can also be appreciated by more experienced readers. The second part of the book addresses the analysis of different types of data partitions. The four chapters making up this part cover personal computer (PC)/Apple partitions, BSD/Solaris partitions, and multiple disk volumes. I found the chapter on redundant array of independent disks (RAID) to be very interesting and informative, and wished I'd had this book a year ago, when my RAID server crashed. File system analysis is the focus of the third part of the book. The main three file systems (file allocation table/new technology file system (FAT/NTFS), second extended filesystem/third extended filesystem (Ext2/Ext3), and Unix file system 1/Unix file system 2 (UFS1/UFS2)) are described, and their digital forensic analysis is shown and illustrated with great detail. I liked this comprehensive approach, focusing on the all-important file systems without narrowing in on only one particular operating system. This approach is in accord with what an investigator might be confronted with, since Microsoft Windows machines use FAT/NTFS, Linux uses Ext2/Ext3, and UFS1/UFS2 is found on FreeBSD, OpenBSD, and most other Unix-derived operating systems. The author does an excellent job of addressing his topic, illustrating key concepts with practical examples, and using several open source toolkits, among which is the well-known Sleuth Kit, which he authored. The examples are well chosen, and the writing style is clear and sharp. Readers are assisted in their journey by many illustrations, tables, and chapter-based reference sections for further reading. Although several other books address digital forensics, this is the first book dedicated entirely to the analysis of file system related data. These issues are addressed in great depth, and the author goes into the innermost details of file systems and their analysis. As such, the book successfully meets the challenge, to be a complete reference for a security investigator, and to be the most comprehensive introduction to the most important file systems used. I consider this book to be highly relevant to at least four reader categories. The first two parts of the book are of immense value to readers interested in computer file systems. Graduate and undergraduate students taking an operating systems class will find in this part the essence of file systems, and their implementation. For those readers working on data rescue and recovery projects, this book contains all of the low-level details required to recover lost data due to hardware failures or accidental erasures. A third category would be security investigators: this book can serve as a very valuable reference for the analysis of digital data. Finally, readers willing to learn how file systems are implemented, and how to perform digital forensics on file systems, are more than encouraged to read this book. Overall, this long-awaited book on the digital forensics of file systems is very informative, relevant, and well written. Addressing a large category of technical readers, it meets all of the prerequisites to become "the" reference for the digital forensics of file systems. Online Computing Reviews Service