Ch 1a: Guidance Software Encase Forensic Edition
Ch 1b: Forensic Toolkit, FTK, computer forensics software | AccessData
Ch 1c: San Francisco Police Blotter
Ch 2a: FireFly IDE and FireFly SATA write blockers
Ch 2b: Computer Forensics Evidence Collection with Helix: Live and static acquisition
Ch 2c: AccessData Product Downloads--Get FTK Imager Here
Ch 3a:ASCLD | The American Society of Crime Lab Directors
Ch 3b: FBI Uniform Crime Report
Ch 3c: IACIS | The International Association of Computer Investigative Specialists
Ch 3d: EnCase Certification Programs
Ch 3e: AccessData - ACE Certification Process.
Ch 3f: Computer Forensics Certification - CyberSecurity Forensic Analyst(CSFA)
Ch 4a: Sparsing - New technology set to revolutionise digital forensics
Ch 4b: Sparse image - Wikipedia
Ch 4c: Host protected area - Wikipedia
Ch 4e: Cold Boot Attacks on Encryption Keys
Ch 4f: New Passware Can Crack PGP and BitLocker-Protected Systems
Ch 4g: Engineer shows how to crack a \'secure\' TPM chip with an electron microscope
Ch 4h: Registry Hack to Disable Writing to USB Drives - How-To Geek
Ch 4i: VMware Hard Disk Format Specifications (pdf)
Ch 4j: Computer Forensics: DCFLDD Updates (v1.2.2)
Ch 4k: New BackTrack 4 Forensics Mode
Ch 4l: Accessing Forensic Images--excellent slides
Ch 4m: Helix-instructions
Ch 5a: Steve Jackson Games v. US Secret Service
Ch 5b: \'To Catch a Predator\' sex stings--issues of agents of law enforcement
Ch 6a: Master boot record - Wikipedia
Ch 6b: Exploring the insides of a .docx word document
Ch 6c: ZIP (file format) - Wikipedia
Ch 6d: Default cluster size for NTFS, FAT, and exFAT
Ch 6e: Encrypting File System - Wikipedia
Ch 6f: How to add an EFS recovery agent in Windows XP Professional
Ch 6g: Windows Vista startup process - Wikipedia
Ch 7a: Logicube Talon� - The Complete Data Capture System
Ch 7b: Voom Technologies, Inc.| Computer Forensic and Data Backup and Recovery products
Ch 7c: WinFS - Wikipedia
Ch 7d: ASR Data - SMART
Ch 7e: Raptor 2.0 - Forensic Live CD
Ch 7f: PDBlock--software write blocker for DOS (but not Windows)
Ch 7g: NIST Disk Imaging Documents
Ch 8a: Filesystems HOWTO: Macintosh Hierarchical Filesystem - HFS
Ch 8b: B-tree - Wikipedia
Ch 8c: B-Trees
Ch 8d: The Apple Examiner--Apple Forensic Tools
Ch 8e: BlackBag Technologies--Free 30-day trial of Mac forensic software here
Ch 8f: BlackBag Technologies Inc. Products, including Software Mac Write-Blocker
Ch 8g: Linux EXT2 File System Data Recovery
Ch 8h: Sticky bit - Wikipedia
Ch 8j: HFS Plus - Wikipedia
Ch 8k: Mac OS X File Systems
Ch 10a: Jeffrey\\\'s EXIF Viewer
Ch 11a: Forensic Memory Capture roundup
Ch 11b: Sysinternals Suite
Old Unsorted Links
List of Forensics Tools
HELIX is not used by police (2008)
Helix, EnCase, and FTK briefly discussed and compared
Guide to Computer Forensics and Investigations (1435498836) - Textbook Website
Know the Rules for Tech-Based Evidence
Erase Your Copy Machine\\\'s Hard Drive
PhotoRec -Recovers lost photos from camera\'s storage devices
Jeffrey\\\'s EXIF reader--finds metadata from images
New forensic technique for audio tape can detect tampering
How Linux works--excellent explanation
DiskDigger - Free Windows file recovery utility
CyberSecurity Institute - Computer Forensic Certification
Securely wipe your data with a hidden Windows 7 tool: CIPHER
Splunk -- recommended free log file consolidator
CyberSecurity Institute: The \\\"Tools Proven in Court\\\" Question
HxD - Freeware Hex Editor and Disk Editor | mh-nexus
Eraser--this can also be used to create a Boot and Nuke floppy
Edmonds Community College Digital Forensics And Information Security Programs
Free Computer Forensics Training - Computer Forensics Fundamentals
Luhn algorithm - Credit Card Validation
PayneGroup--MetaData Assistant--not free
Pinpoint Labs - Computer Forensics Software and Services--Free Metadata Investigator
WiebeTech Micro Storage Solutions - USB WriteBlocker-- Forensic in-line USB WriteBlocker ror $200
Voom Technologies, Inc.| Hardware disk duplicator
UltraBlock USB Write Blocker - $300
Digital Detective - Net analysis--Free 30-day trial version
MANDIANT Web Historian--Free tool, less powerful than Mandiant
CacheBack� - Internet Cache and History Analysis - Rebuild web pages in seconds!--recommended tool for child porn cases ($350)
Free Forensic Tools
How to use Cipher.exe to overwrite deleted data in Windows Server 2003
Erasing sensitive information from smartphones
DFI News -- Interesting News Portal
Autoruns and Dead Computer Forensics
Expert Witness: Effective Courtroom Testimony
Proj 2a: Master boot record - Wikipedia
An Introduction to Android Forensics | DFI News
RAM Slack Explained: a problem prior to Win 95 Version B
Hard Drive Password Password Removal Tool: Shinobi - Ji2
iPhone keyboard buffer retains months of typing
Decrypting Intellforms Data with FTK
A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony As An Expert Technical Witness -- Recommended book
Digital Corpora--Sample Forensic Images
Volatility | Memory Forensics | Volatile Systems
PhotoRec - Data carving to find images
Live View--boot a forensic image as a virtual machine
Sources of Forensic Data Images
Free Tools | HBGary -- Fastdump: forensic memory dump tool
Recurity Labs CIR Online--Free Cisco Core Dump Analysis for forensics
Computer Forensics - Unusual devices
Computer Forensics - Flash drives and acquisition
A Forensic Analysis Of The Windows Registry
Forensically interesting spots in the Windows 7, Vista and XP file system and registry (and anti-forensics)
Registry Key to check Windows Version
Registry: What are Control Sets? What is CurrentControlSet?
Registry: How to Determine the Current Control Set
Registry: Last user logged on key shown here for Win XP and Vista
Acquiring an Image with FTK Imager
Computer Forensics Experts--the value of certification
Free Tools | HBGary--FGET looks interesting--forensic image over the network
Digital Forensics 01--a course from another college, apparently based on the same textbook
Using VMWare for Forensic Analysis
iPhones can store a treasure trove of incriminating evidence
ProDiscover Basic Freeware Download
[SOLVED] How can I list my available hard drives? - Ubuntu Forums
How to steal stored Firefox passwords with memory forensics
BackTrack 4 Forensics Mode--better than Helix!
Virtual Disk Driver (VDK) amd64/em64t build
Virtual Disk Driver (VDK) for 32-bit systems
Instructions for VDK--mounting virtual disks write-blocked in Windows
Forensic Incident Response: Unsung tools - Raptor Forensics
How To--Digital Forensics Copying A VMware VMDK
New Version of FTK Imager
Free computer forensic tools
National Software Reference Library--hashes of known files
CAINE 2.0 -- NewLight -- another Ubuntu-based Forensics Live CD
Unsorted Links from 2011 & 2012
Free data recovery software, works on PCs and Macs (ty John)-- TestDisk - CGSecurity
Toggle Word Wrap :: Add-ons for Firefox--recommended to improve SleuthKit and Autopsy (ty Abraham)
Digital Forensics How-To: Memory Analysis with Mandiant Memoryze
2010-11-08: Joe Klein IPv6 Evil and Good
Digital Forensics How-To: Memory Analysis with Mandiant Memoryze
Ch 12a: Email forgery detected by ESMTP number--see page 4 (Munshani v. Signal Lake Venture Fund)
Ch 12b: What Email Headers Can Tell You About the Origin of Spam
Ch 12c: Ikitek - Home of Yahoo Message Archive Decoder
Ch 12d: How to use the Inbox Repair Tools to recover e-mail messages in Outlook
Ch 12e: Advanced Outlook Repair - Best Outlook recovery tool
Ch 13a: Police say IPhones can store a treasure trove of incriminating evidence
Ch 13b: IPhone Can Take Screenshots of Anything You Do
Ch 13c: iPhone Banking App Automatically Deposits Checks Via Photos
Ch 13d: iPhone Spy USB Stick Slurps Up Deleted Data from Any iPhone
Ch 12f: Splunk | Log Management
Ch 12g: Download Free Mobile Phone Forensics Software, Mobile Phone Forensics Software 2.0.1.5 Download
Ch 13h: Reveal iPhone Secrets with Ubuntu 10.04
Forensic Control - Free Computer Forensic Software
2010-11-21: iPhone Forensics white paper
Ch 15a: What does \\\"more prejudicial than probative\\\" mean?
2010-11-22: Information About Your Deposition | Law Offices of Gourwitz and Barr, PLLC
Ch 15c: Discovery (law) - Wikipedia
Volatility: Advanced Memory Forensics Tutorials
Expert Draft Reports Now Generally Excluded Under Rule 26
2010-12-10: WikiLeaks: DDoS attacks reflect \\
2011-01-04: iPhone Forensics - iXAM - Advanced iPhone Forensic Imaging Software
Detecting CMOS Clock Changes : Forensic 4cast
Certified Computer Examiner -- recommended for forensics work
Memory Forensics: How to Capture Memory for Analysis
PALADIN Forensic CD--Recommended as better than Raptor
2011-11-18: PC-3000 Flash Data Recovery Tool
Professional Data Recovery Tool for USB device not recognized -Flash Doctor -- not simple or easy
Memory Forensics: How to Pull Passwords from a Memory Dump
Memory Forensics: Pull Process and Network Connections from a Memory Dump
Detecting_Data_Theft_Using_Stochastic_Forensics --Excellent work
Defending Privacy at the U.S. Border: A Guide for Travelers Carrying Digital Devices Electronic Frontier Foundation
The Urban Legend of Multipass Hard Disk Overwrite
Download Ez7z for Mac - Easy-to-use p7zip archiver. MacUpdate.com
Let's decrypt a Master Boot Record
Elcomsoft iOS Forensic Toolkit Update: Acquisition of iPhone 4S and iPad 2 Devices
Forensics Boot - BackTrack Linux
The in-depth guide to data destruction
Finding the Last User Logged On Fails in Windows 7
How to wipe a hard drive clean in Linux
International Association of Forensic Computer Examiners - Forensic Examination Procedures
Free computer forensic software tools
Enter Bios Settings and Boot from CDROM with VMware Fusion
Ch 6h: Zone bit recording - Wikipedia
Oxygen Forensic Suite 2012 - Forensic Software for Cell Phones, Smartphones and other Mobile Devices
Ch 8l: CD-ROM - Wikipedia
Ch 8m: Host protected area - Wikipedia
Ch 8n: HPA-Host Protected Area - DATA RECOVERY SALON
Ch 9a Forensic Examination Procedures from International Association of Forensic Computer Examiners (IACIS)
Ch 9b: A Tale of Two Encryption Cases
Ch 11c: Order of Volatility - MacForensicsLab
Ch 11d: Best Practices In Digital Evidence Collection
Ch 11e: VMware vCenter Converter, Convert Physical Machines to Virtual Machines -- Does Network Acquisition
OSForensics LiveCD - Digital investigation for a new era by PassMark Software
2012-04-16: Forensic FOCA - Power of Metadata in digital forensics
Upgrading to BackTrack 5 R2
Memory Forensics: How to Capture Memory for Analysis
Win 8 Forensic Guide
Ch 16a: High Technology Crime Investigation Association Policy re: Defense Work
ProDiscover Free Basic Edition Download
NTFS Uses B-Trees
Digital Assembly - A smart choice for photo forensics
MFT Ripper -- recommended forensic tool
NTFS Time Stamps --file created in 1601, modified in 1801 and accessed in 2008!!
Last Access Time Stamps are Disabled in Vista and Windows 7
Modify NTFS Timestamps and Cover Your Tracks with Timestomp
Investigating In-Memory Network Data with Volatility
Autopsy Forensic Browser: Now cross-platform, using Java
grr - Forensic imaging for remote and cloud systems
Digital Assembly - A smart choice for photo forensics
ProDiscover Notes
What do Upclicker, Poison Ivy, Cuckoo, and Volatility Have in Common?
TeamViewer 8 Forensic Artifacts