File System Forensics

Digital evidence is easier to assess when you can see what a forensic tool is actually reading. File System Forensics by Fergus Toolan connects the structures beneath files with the methods investigators use to examine them—and offers a step-by-step approach to recovering file content and metadata, then checking results against the underlying data.

Start with the foundations of an investigation

The book begins with digital-forensics principles and methodology, including preparation, preservation, acquisition, processing, analysis, reporting, quality assurance, and evidence return. Its early chapters also introduce Linux as a forensic platform and review the command-line tools and basic mathematics needed to work with raw data.

See how file systems store evidence

From disks, partitions, and partition tables to file-system structures and metadata, the material builds a foundation for understanding where information resides and how it is represented. Chapters examine file-system families including FAT, exFAT, NTFS, ext, XFS, Btrfs, HFS+, and APFS, giving readers a basis for comparing how different systems organize and record data.

Connect tool output to the underlying data

A defining focus is practical interpretation: readers are shown how file content and metadata may be recovered, and how to manually recreate and validate results produced by forensic tools. That emphasis makes the book useful not only for learning what a tool reports, but for understanding the structures and evidence behind its findings.

For focused study and professional reference

Exercises and discussion topics reinforce the technical material. The book is intended for graduate and senior undergraduate students in digital forensics, and is also relevant to digital forensic analysts and law-enforcement professionals who need a detailed reference on file-system examination.

For readers who want to move beyond tool output and understand the evidence underneath, Fergus Toolan’s File System Forensics offers a structured route from core concepts to file-system-specific analysis.