Forensic Computing

Until 1984, Professor A. J. Sammes was a serving British Army Officer with the rank of Colonel, late of the Royal Corps of Signals. His present appointment is Professor of Computing Science, in the Faculty of Military Science, Technology and Management at the Defense Academy, Cranfield University, Shrivenham. His formal qualifications include a Bachelor of Science in Electrical Engineering, a Master of Philosophy in Computer Science and a Doctor of Philosophy in Computer Science, all degrees having been awarded by the University of London. He is also a Fellow of the British Computer Society and a Chartered Engineer. His department has been more or less solely responsible for training senior police officers in the UK in the art of forensic computing. His testimony as an expert witness has been called in countless cases, of some of great national importance.

Forensic Computing.- Understanding Information.- IT Systems Concepts.- PC Hardware and Inside the Box.- Disk Geometry.- The New Technology File System.- The Treatment of PCs.- The Treatment of Electronic Organisers.- Looking ahead (just a little bit more).- Appendices: Common Character Codes; Some Common File Format Signatures; A Typical Set of POST Codes; Typical BIOS Beep Codes and Error Messages; Disk Partition Table Types; Extended Partitions; Registers and Order Code for the INtel 8086; NFTS Boot Sector and BIOS Parameter Block; MFT Header and Attribute Maps; The Relationship between CHS and LBA Addressing; Alternate Data Streams - a Brief Explanation.