Skip to Main Content
Operating System Forensics
book

Operating System Forensics

by Ric Messier
November 2015
Intermediate to advanced content levelIntermediate to advanced
386 pages
12h 50m
English
Syngress
Content preview from Operating System Forensics
Chapter 3

Data and File Recovery

Abstract

Investigation of the different types of data that may be stored in the file system, including locating files is strictly based on the header and footer values. Other locations for storing data both within and outside of the file system are covered.

Keywords

operating systems
forensics
operating environments

INFORMATION INCLUDED IN THIS CHAPTER:

Data carving
Slack space
Searching for data
Data hiding

Introduction

Once you understand the layout of the file systems you are working on, you can better understand how to go about retrieving information from the disk. There are a number of reasons you may need to go digging. One of the reasons is because someone may have deleted a file and it may not clearly ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Computer Forensics InfoSec Pro Guide

Computer Forensics InfoSec Pro Guide

David Cowen
Windows Forensics Cookbook

Windows Forensics Cookbook

Scar de Courcier, Oleg Skulkin
Malware Forensics Field Guide for Linux Systems

Malware Forensics Field Guide for Linux Systems

Eoghan Casey, Cameron H. Malin, James M. Aquilina

Publisher Resources

ISBN: 9780128019634