Chapter 38 — Further Reading

This chapter integrates the whole book, so the best reading is whole-case reading — sources that show the lifecycle end to end and full scenario images you can work yourself.

Foundations (🔬 deeper)

• Brian Carrier, File System Forensic Analysis (Addison-Wesley). The bedrock under phases 4–5 and your timeline: NTFS $MFT` (`$SI vs $FN), partitions, unallocated space, and what "deleted" means structurally. When a cross-examiner presses on why the kernel's clock is more trustworthy than the user's, this is where the answer lives.
• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. The investigative lifecycle as a federal standard — collection, examination, analysis, reporting. Free PDF; read it as the official skeleton your twelve phases flesh out.
• Eoghan Casey, Digital Evidence and Computer Crime (Academic Press). Authoritative on integrity, interpretation, correlation, and the proportionality that separates "I found this" from "I can prove it and I will not overstate it" — the spine of phases 10–12.

Approachable explanations (everyone)

• Bill Nelson, Amelia Phillips & Christopher Steuart, Guide to Computer Forensics and Investigations (Cengage). A classroom-friendly walk through a complete case, assignment to testimony, pitched at exactly the newcomer's level — the closest single book to this chapter's arc.
• SANS DFIR posters and cheat sheets (free). The Windows Forensic Analysis poster, the Hunt Evil poster, and the SIFT/KAPE cheat sheets are one-page maps of the artifacts each phase touches; pin one beside the lifecycle map and work outward.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 SANS FOR508, Advanced Incident Response, Threat Hunting, and Digital Forensics. The course runs a full intrusion case end to end; its scenario discipline is the professional version of this capstone.
• 🛡️ NIST SP 800-61, Computer Security Incident Handling Guide. The compressed IR lifecycle — preparation, detection, containment, eradication, recovery, lessons learned — and where the responder's first ten minutes must already be evidence collection.
• 📜 SWGDE best-practice documents and The Sedona Conference eDiscovery commentaries. Process and admissibility from the standards bodies and the legal side; the language counsel and the court expect your report to honor.
• 💾🔍 Full scenario images with ground truth: Digital Corpora's M57-Patents and Lone Wolf cases, the NIST CFReDS images, and DFIR CTFs (Magnet Weekly, DFRWS, Ali Hadi's challenges). These are complete disks built to be worked end to end — the only way to practice integration rather than technique.

Reference (this book)

• Appendix F — Chain-of-Custody and Report Templates: the skeleton of the deliverable you assemble in the progressive project.
• Appendix J — Practice Images and Lab Setup: where to get a full scenario image to run the whole lifecycle on.
• The phase-owner chapters: Ch. 5 — The Forensic Process, Ch. 14 — Acquisition, Ch. 21 — Timeline Analysis, Ch. 26 — The Forensic Report, Ch. 27 — Expert Testimony, and Ch. 28 — Ethics.

Do, don't just read

• Work one full scenario image end to end. Take M57-Patents or Lone Wolf from assignment to a complete case file, then score it on the chapter's rubric and fix every row below 2. One integrated case teaches more than ten isolated labs.
• Run the morning-of-trial re-verification. Re-hash your working image against the acquisition value, log the result and tool versions, and write the single sentence you could say under oath about current integrity.
• Hold a mock trial. Have a partner cross-examine you on your finished report using the seven classic attacks; every question you cannot answer cleanly is a finding to strengthen, a limitation to state, or a corroboration to add.

Next: Chapter 39 — Certifications and Professional Development: turning the case file you just assembled into a credential employers and courts recognize — EnCE, GCFE, GCFA, GNFA, CCE, CFCE, CHFI — and how to choose a path and stay current.