The essential handbook for every Computer Forensic Examiner.
A 26 page, pocket sized guide containing clearly laid out reference material. A sample of the guide content is available for preview:
CF Quick Ref Guide v1.1 (4.7 MiB)
The guide is C6 paper size, portrait and spiral bound on the short edge. The individual pages are laminated for durability. Content wise, it has 12 pages of NTFS including a breakdown of commonly encountered $MFT attributes. There are four pages dedicated to FAT including short and long filename breakdowns. An ASCII table complete with conversions to Decimal, Hexadecimal, Octal and Binary has been included. There are also file location guides for the Windows Registry and Internet Explorer which visually represent exactly where the many, many hive files and index.dat files reside on a Windows system. Finally, the back page has the IACIS first responder guide for handling electronic evidence.
