File System Forensics

File System Forensics, 1st Edition, authored by Fergus Toolan, is an academic reference that explains file system mechanics and demonstrates how digital forensic tools operate on specific disk structures. Designed primarily for graduate students and senior undergraduate students in digital forensics, the volume establishes fundamental technical principles required to evaluate low-level digital storage structures.

The core coverage encompasses Windows, Linux, and macOS environments, delivering specific technical analyses of FAT, ExFAT, and NTFS file systems. By systematically exploring these common operating formats, the work details how file allocation, directory entries, and system attributes are stored, organized, and maintained across distinct hardware and software configurations.

A central practical feature of the text is its step-by-step methodology for recovering file content and metadata. This procedural framework offers a clear approach for academic study, helping advanced students systematically search, extract, parse, and interpret stored digital artifacts during complex technical evidence evaluations.