The latest edition of the Computer Forensic Examiner Quick Reference Guide, revision 2.3.
A 52 page, pocket sized guide containing charts for file systems, Windows artifacts and more. A sample of the guide content is available for preview:
CF Quick Ref Guide v2.3 (10.3 MiB)
Please note: This item is currently available for purchase and immediate dispatch from Amazon. The button below will redirect you to the corresponding item on Amazon.com. The message below stating this item is out of stock, refers only to stock on this website. Please visit Amazon for stock levels. Thank you 🙂
The guide is C6 paper size, portrait and spiral bound on the short edge. The individual pages are laminated for durability. Content wise, it has 12 pages of NTFS including a breakdown of commonly encountered $MFT attributes. There are 3 pages dedicated to FAT including short and long filename breakdowns. exFAT, HFS+ and Ext2/3/4 file systems have been added, spanning 9 pages. The following Windows artifacts have been included: Windows Registry, Internet Explorer, and various Windows Artifacts (total of 11 pages) as well as a page on dates and times and file signatures. ASCII table complete with conversions to Decimal, Hexadecimal, Octal and Binary. The back page has the IACIS first responder guide for handling electronic evidence.
