RE: [sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7 /Autopsy 2.0.1

[Altheide, C. B. (IARC) <Alt...@nv...>]

"Inside Windows 2000" is probably your best bet for NTFS.
"Linux File Systems" is getting a little long in the tooth, but is a great
resource for the various Linux file systems (although reading the source
works too ;p)
The FAT32 specification is avaialable here:
http://www.microsoft.com/whdc/system/platform/firmware/fatgen.mspx

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
alt...@nv...


> -----Original Message-----
> From: sle...@li... 
> [mailto:sle...@li...] On 
> Behalf Of Fiscus, Kevin
> Sent: Friday, July 23, 2004 5:19 AM
> To: Altheide, Cory B. (IARC); dar...@li...
> Cc: sle...@li...
> Subject: RE: [sleuthkit-users] Problems Recovering EXT3 File 
> Sleuthkit 1.7 /Autopsy 2.0.1
> 
> 
> Along these lines, does anyone know of a good resource (book, 
> web site, etc.) that discusses various file systems and how 
> they operate?  Even better, is there a resource that does 
> that with forensics in mind?
>  
> Thanks,
>  
> Kevin B. Fiscus, CISSP