The Computer Forensic Examiner Quick Reference Guide, revision 2.2.
A 50 page, pocket sized guide containing charts for file systems, Windows artifacts and more. A sample of the guide content is available for preview:
CF Quick Ref Guide v2.2 (6.9 MiB)
The guide is C6 paper size, portrait and spiral bound on the short edge. The individual pages are laminated for durability. Content wise, it has 12 pages of NTFS including a breakdown of commonly encountered $MFT attributes. There are 3 pages dedicated to FAT including short and long filename breakdowns. exFAT, HFS+ and Ext2/3/4 file systems have been added, spanning 9 pages. The following Windows artifacts have been included: Windows Registry, Internet Explorer, and various Windows Artifacts (total of 11 pages) as well as a page on dates and times and file signatures. ASCII table complete with conversions to Decimal, Hexadecimal, Octal and Binary. The back page has the IACIS first responder guide for handling electronic evidence.
