1
Part I — Foundations
6 chapters- Part I — Foundations
- Chapter 1: Two Disciplines, One Technical Foundation — What Data Recovery and Digital Forensics Share, and Where They Diverge
- Chapter 2: How Data Is Stored — Bits, Bytes, Sectors, Clusters, and the Physical Reality of Digital Information
- Chapter 3: Storage Technology — Hard Drives, SSDs, Flash Media, RAID, and How Each Stores (and Loses) Data
- Chapter 4: File Systems — The Software Layer That Organizes Everything
- Chapter 5: The Forensic Process — Acquisition, Preservation, Analysis, and Reporting
2
Part II — Data Recovery
9 chapters- Part II — Data Recovery
- Chapter 6: Logical Recovery — Deleted Files, Formatted Drives, and Corrupted Partitions
- Chapter 7: File Carving — Recovering Files Without File System Metadata
- Chapter 8: Hard Drive Recovery — Mechanical Failures, Head Crashes, and the Clean Room
- Chapter 9: SSD and Flash Recovery — The Unique Challenges of Solid-State Storage
- Chapter 10: RAID Recovery — Rebuilding Arrays and Recovering from Multi-Disk Failures
- Chapter 11: Mobile Device Recovery — Smartphones, Tablets, and the Data You Can't Reach Through the Screen
- Chapter 12: Ransomware Recovery — When Your Files Are Encrypted by Criminals
- Chapter 13: The Data Recovery Business — Pricing, Customer Management, and Building a Recovery Practice
3
Part III — Digital Forensics
12 chapters- Part III — Digital Forensics
- Chapter 14: Forensic Acquisition — Imaging Drives, Preserving Evidence, and Maintaining Chain of Custody
- Chapter 15: Live Response and Triage Forensics — Capturing Volatile Evidence Before You Pull the Plug
- Chapter 16: Windows Forensics — Registry, Event Logs, Prefetch, and the Artifacts Windows Leaves Behind
- Chapter 17: macOS and Linux Forensics — APFS Snapshots, Unified Logs, and Unix Artifacts
- Chapter 18: Browser and Internet Forensics — Web History, Cache, Cookies, and the Digital Footprint
- Chapter 19: Email, Chat, and Social Media Forensics — Recovering Communication Evidence
- Chapter 20: Photo, Video, and Document Forensics — Metadata, Manipulation Detection, and Content Analysis
- Chapter 21: Timeline Analysis — Reconstructing Events from Timestamps Across Multiple Sources
- Chapter 22: Memory Forensics — Analyzing RAM for Evidence That Never Touched the Disk
- Chapter 23: Network Forensics — Packet Captures, Log Analysis, and Tracing Activity Across the Wire
- Chapter 24: Mobile Device Forensics — Extracting Evidence from Phones and Tablets
4
Part IV — Legal Framework and Reporting
5 chapters- Part IV — Legal Framework and Reporting
- Chapter 25: The Legal Framework — Warrants, Consent, Corporate Authority, and When You're Allowed to Look
- Chapter 26: The Forensic Report — Writing Findings That Withstand Legal Scrutiny
- Chapter 27: Expert Testimony — Presenting Digital Evidence in Court Without Getting Destroyed on Cross-Examination
- Chapter 28: Ethics in Data Recovery and Digital Forensics — What to Do When You Find What You Weren't Looking For
5
Part V — Advanced Topics
8 chapters- Part V — Advanced Topics
- Chapter 29: Encrypted Device Forensics — BitLocker, FileVault, LUKS, VeraCrypt, and the Encryption Challenge
- Chapter 30: Anti-Forensics — How People Try to Hide Evidence (and How to Detect That They Tried)
- Chapter 31: Cloud Forensics — Investigating Data That Lives on Someone Else's Servers
- Chapter 32: Malware Forensics — Analyzing the Weapon After the Attack
- Chapter 33: Cryptocurrency Investigation — Tracing Bitcoin, Ethereum, and Digital Assets on the Blockchain
- Chapter 34: IoT, Vehicle, and Embedded Device Forensics — Smart Homes, Cars, Wearables, and the Internet of Evidence
- Chapter 35: AI-Assisted Forensics and Deepfake Detection — Machine Learning at Investigative Scale, and the Synthetic-Media Problem
6
Part VI — Tools and Career
6 chapters- Part VI — Tools and Career
- Chapter 36: The Forensic Toolkit — Autopsy, FTK, EnCase, Cellebrite, and Choosing the Right Tool for the Job
- Chapter 37: Building a Forensic Lab — Hardware, Software, Storage, and the Environment for Professional Work
- Chapter 38: The Capstone Investigation — A Complete Case from Assignment to Courtroom
- Chapter 39: Certifications and Professional Development — EnCE, GCFE, GCFA, CCE, CFCE, and the Alphabet Soup of Forensic Credentials
- Chapter 40: The Forensics and Recovery Career — From Junior Examiner to Lab Director: Paths, Pay, and the Work
7
Appendices
14 chapters- Appendices
- Appendix A — File Signatures Reference
- Appendix B — Python Forensics Toolkit
- Appendix C — Tool Reference
- Appendix D — Forensic Artifact Locations
- Appendix E — Legal Frameworks Reference
- Appendix F — Chain of Custody and Report Templates
- Appendix G — File System Reference
- Appendix H — Command-Line Reference
- Appendix I — Certification Roadmap
- Appendix J — Practice Images and Lab Setup
- Glossary
- Bibliography
- Answers to Selected Exercises
Explore Related Books
More open-access textbooks from our library
Advanced COBOL 40 chapters · ~67h Advanced Data Science 39 chapters · ~57h AI Ethics 39 chapters · ~82h AI Literacy 21 chapters · ~27h AI & ML for Business 40 chapters · ~80h AI Engineering 40 chapters · ~53h Algorithmic Addiction 40 chapters · ~71h American Government 40 chapters · ~77h Applied Psychology 40 chapters · ~52h Assembly Language 40 chapters · ~27h Blockchain & Crypto 40 chapters · ~68h Calculus 40 chapters · ~51h Automotive Sales 40 chapters · ~73h College Football Analytics 28 chapters · ~18h Creator Economy 41 chapters · ~57h Pattern Recognition 43 chapters · ~92h Cybersecurity 40 chapters · ~84h Data & Society 40 chapters · ~72h Data Viz with Python 35 chapters · ~52h Discrete Mathematics 40 chapters · ~75h Ethical Hacking 41 chapters · ~58h Fandom 44 chapters · ~70h Forensic Science 40 chapters · ~74h Grant Writing 35 chapters · ~36h History of Appalachia 42 chapters · ~69h How Humans Get Stuck 40 chapters · ~36h Handling Confrontation 40 chapters · ~80h How to Learn Anything 38 chapters · ~54h How Your House Works 40 chapters · ~66h IBM DB2 37 chapters · ~53h Insurance Underwriting 40 chapters · ~71h Intermediate COBOL 54 chapters · ~44h Intermediate Data Science 36 chapters · ~39h Intro CS Python 27 chapters · ~28h Intro to Data Science 36 chapters · ~55h Introductory Economics 40 chapters · ~28h Introductory Statistics 28 chapters · ~48h Learning COBOL 42 chapters · ~64h Prediction Markets 42 chapters · ~60h Linear Algebra 40 chapters · ~60h Metacognition 28 chapters · ~52h Media Literacy 41 chapters · ~80h Music Production 40 chapters · ~84h NFL Analytics 28 chapters · ~16h Nuclear Physics 35 chapters · ~60h Organic Chemistry 40 chapters · ~43h Pascal Programming 40 chapters · ~43h Photography 40 chapters · ~85h Physics of Music 48 chapters · ~75h Political Analytics 41 chapters · ~67h Popular Psychology 40 chapters · ~21h Practical Philosophy 38 chapters · ~63h Basketball Analytics 31 chapters · ~30h Soccer Analytics 30 chapters · ~43h Propaganda 40 chapters · ~80h Python for Business 40 chapters · ~40h Quantum Mechanics 40 chapters · ~66h RegTech 40 chapters · ~59h The Science of Cooking 40 chapters · ~70h Science of Seduction 45 chapters · ~60h Sports Betting 42 chapters · ~63h Database Fundamentals 40 chapters · ~34h Technical Writing 40 chapters · ~70h Architecture of Surveillance 40 chapters · ~54h Science of Luck 40 chapters · ~72h Eastern Cultures 40 chapters · ~47h Western Culture 40 chapters · ~30h Vibe Coding 42 chapters · ~58h Video Game Design 40 chapters · ~77h Why They Watch 40 chapters · ~48h Working with AI 42 chapters · ~58h