Operating System Forensics

Foreword

For the past few years, there seems to have been regular overhauls in the operating systems used by everyday people. Microsoft and Apple have both begun to release new versions of their operating systems with increasing regularity, now having low or no cost upgrades available. While this can be exciting for users, it can create headaches for the Digital Forensic analyst trying to keep up with the evidence that is coming across their desk. Each operating system, be it an Apple OS X version, Windows, or Linux distribution, has sources of evidence specific to it. All this plus the fact that mobile versions of operating systems are generally at least as regular their desktop brethren. Until now, there has been no single definitive resource ...