This excerpt from Chapter 5 of File System Forensic Analysis is posted with permission from Addison-Wesley Professional. The last chapter provided an overview of volume analysis and why it’s important ...

Disk space is allocated in clusters of a certain size. When a file is written to disk and the file size is smaller than the cluster(s) allocated for it, there is an unused portion of varying size ...

When I am dead, I hope it is said, ‘His sins were scarlet, but his books were read’. -Hilaire Belloc When I am dead, I hope it is said, ‘His sins were scarlet, but his books were read’. -Hilaire ...