Lecture Overview

Physical analysis looks at the contents of the media from a raw perspective.  So instead of viewing files in allocated space (logically), we can also view system space (e.g., root directory, FAT, Master File Table, etc.), and also recover unallocated and slack space.  

Video

• Physical analysis (right click and Save As)

Textbook

• Nelson Chapter 10

Additional Readings 

• P. Craiger, Computer forensics methods and procedures. In H Bigdoli, (Ed), Handbook of Information Security, New York, John Wiley, Vol 2., pp. 736-755, 2006.

Tools

• Forensic Cheat Sheet