Computer Forensics: A Real World Guide
暫譯: 電腦取證：實務指南

Defining the present state of the field, this work demonstrates the need for computer forensics. Explaining all necessary steps, it presents the required equipment and tools for gathering evidence. It shows how to frame a problem and conduct a thorough search. The book looks at the advantages and disadvantages of available technology, exploring the uniqueness of different systems (including Windows, Linux, Mac, and UNIX) and discussing how they require different approaches to evidence collection. This text also provides guidelines for the efficient presentation of data to build the most complete and compelling case.