Product: 1593277938

Compared to Linux Forensics by Philip Polstra, Practical Forensic Imaging is more detailed in its discussion of the many types of disks, file formats, and the tools used for their forensic acquisitions. I thought the Commands, Protocols, and Bridges section was interesting because you get to learn the different ways to communicate with storage media (read, write, report, etc.). The Securing an Image with Encryption section is especially useful. It goes over acquiring encrypted file systems such as: Microsoft BitLocker, Apple FileVault, Linux LUKS, and TrueCrypt and VeraCrypt. This is not a beginner’s manual; it’s intended for experienced Linux users.
Rating: 5
1593277938
Count: 7