EnCase Computer Forensics (2012)
Chapter 4: Acquiring Digital Evidence
Chapter 7: Understanding, Searching For, and Bookmarking Data
Chapter 8: File Signature Analysis and Hash Analysis
Chapter 9: Windows Operating System Artifacts
Appendix A: Answers to Review Questions
Appendix B: Creating Paperless Reports
Appendix C: About the Additional Study Tools