The second edition of this successful book shows how the contents of computer systems can be recovered for criminal evidence, even when hidden or subverted. Coverage includes Windows XP/2000 file systems, fast drives, new encryption technologies, and personal organisers.

In the second edition of this very successful book, Tony Sammes and Brian Jenkinson show how the contents of computer systems can be recovered, even when hidden or subverted by criminals. Equally important, they demonstrate how to insure that computer evidence is admissible in court. Updated to meet ACPO 2003 guidelines, Forensic Computing: A Practitioner's Guide offers: methods for recovering evidence information from computer systems; principles of password protection and data encryption; evaluation procedures used in circumventing a system's internal security safeguards, and full search and seizure protocols for experts and police officers. The book discusses file system technologies encountered in such operating platforms as Windows XP and 2000, and considers modern fast drives, new encryption technologies, the practicalities of "live" analysis, and the problems inherent in examining personal organisers. Numerous case studies and worked examples illustrate the text.

From the reviews of the second edition:

"This book was the product of an 'arms race'. ? It is now listed as the standard text around which all the Forensic Computing courses at Cranfield and some other universities are based. ? It is filled with good practical advice and is especially good on interpreting partition tables. ? All in all this is a useful ? guide to the discipline. ? Truly the forensic computing expert is living in interesting times." (Alikelman, June, 2009)