Lecture Overview

• Logical analysis looks at the contents of the media from the standpoint of files in allocated space.  Documents, emails, applications, system files, etc., are included in this space. What isn't included?  Any evidence in unallocated space, which includes deleted files and evidence in slack space.  

Videos:

• Windows Logical Analysis (introduction). 
• Logical Analysis

Textbook

• Nelson Chapter 9 

Additional resources 

• P. Craiger, Computer forensics methods and procedures. In H Bigdoli, (Ed), Handbook of Information Security, New York, John Wiley, Vol 2., pp. 736-755, 2006.

Tools

• Forensic Cheat Sheet