Book Review - File System Forensic Analysis by Brian Carrier
If you have a need to thoroughly understand computer file systems for whatever reason, you need this book... File System Forensic Analysis by Brian Carrier. It just doesn't get any more detailed than this.
Part 1 - Foundations: Digital Investigation Foundations; Computer Foundations; Hard Disk Data Acquisition
Part 2 - Volume Analysis: Volume Analysis; PC-based Partitions; Server-based Partitions; Multiple Disk Volumes
Part 3 - File System Analysis: File System Analysis; FAT Concepts and Analysis; FAT Data Structures; NTFS Concepts; NTFS Analysis; NTFS Data Structures; Ext2 and Ext3 Concepts and Analysis; Ext2 and Ext3 Data Structures; UFS1 and UFS2 Concepts and Analysis; UFS1 and UFS2 Data Structures; The Sleuth Kit and Autopsy; Index
The working concept of the book is that the reader needs to understand file systems in order to do forensic analysis. For instance, they need to recover content that's been deleted or hidden on the drive. And while it's true that this information will definitely address that need, it's really a detailed reference work for anyone who has a need to deeply understand the disk structure of a computer. Developers working on disk utility software come to mind right away.
I was surprised that file systems such as FAT and NTFS really don't have published specifications that can be easily found. Carrier often talks about how few of the detailed parts of the system are documented, so this book is one of the few places you'll find all the information gathered in a single location. On top of that, there are copious diagrams and file dumps that help to take the information from theory to reality. Another part of the material talks about how forensic software tools are used to analyze the disk information. Carrier does primarily talk about forensic software that he helped develop, but it's not (in my opinion) a detriment to the book. I didn't get the impression I was reading a 550 page advertisement (which I've seen on occasion).
Very detailed and complete, and this is the first title you should look at if you need to understand disk structures.