Appendices

Reference material designed to live next to your keyboard. The lettered appendices (A–J) are quick-reference tools; the glossary, bibliography, and answers round out the book.

Quick-reference appendices

• Appendix A — File Signatures Reference — magic numbers (headers and footers) for carving common file types.
• Appendix B — Python Forensics Toolkit — reusable, commented scripts: hashing, carving, EXIF, timeline, SQLite parsing.
• Appendix C — Tool Reference — the open-source and commercial tools, what they do, and when to use each.
• Appendix D — Forensic Artifact Locations — where the evidence lives on Windows, macOS, and Linux (paths and registry keys).
• Appendix E — Legal Frameworks Reference — warrants, the Fourth and Fifth Amendments, eDiscovery, Daubert, the CLOUD Act, and GDPR.
• Appendix F — Chain of Custody and Report Templates — ready-to-use forms, labels, and a full forensic-report template.
• Appendix G — File System Reference — NTFS, ext4, APFS, and FAT/exFAT structures, and what deletion means in each.
• Appendix H — Command-Line Reference — imaging, hashing, file-system, carving, metadata, memory, and network commands with examples.
• Appendix I — Certification Roadmap — EnCE, GCFE, GCFA, CCE, CFCE, CHFI, and which fits which career path.
• Appendix J — Practice Images and Lab Setup — where to get practice images and how to build your lab.

Reference

• Glossary — key terms across storage, file systems, recovery, forensics, and the law.
• Bibliography — books, papers, standards, tools, and communities.
• Answers to Selected Exercises — worked solutions to the exercises marked (answer in Appendix).

Return to the book overview.