Digital Forensics with Open Source Tools

Working forensic professionals wrote this hands-on manual for examining computers and storage media with free, open source software. It shows how to carry out forensic work on Mac, Linux and Windows machines, treating the open source toolset as a complete platform for digital investigations. Established techniques appear alongside newer approaches, and the methods are demonstrated with both command-line and graphical tools across a wide variety of systems and artifacts.

The nine chapters move from setting up an open source examination environment to analyzing disks and file systems. They then cover artifacts left behind on Windows, Linux and Mac OS X systems, along with traces of internet activity, before ending with ways to automate analysis and extend the tools' capabilities. The emphasis falls on the core ideas and procedures behind forensic file system analysis.

The book is written with students and newcomers in mind, especially those who cannot afford commercial forensic software for every case. It is also aimed at incident response teams, computer forensic investigators, technicians working for legal, audit and consulting firms, and law enforcement agencies.