This practical and accessible textbook/reference describes the theory and methodology of digital forensic examinations, presenting examples developed in collaboration with police authorities to ensure relevance to real-world practice. The coverage includes discussions on forensic artifacts and constraints, as well as forensic tools used for law enforcement and in the corporate sector. Emphasis is placed on reinforcing sound forensic thinking, and gaining experience in common tasks through hands-on exercises.

This enhanced second edition has been expanded with new material on incident response tasks and computer memory analysis.

Topics and features:

Outlines what computer forensics is, and what it can do, as well as what its limitations areDiscusses both the theoretical foundations and the fundamentals of forensic methodologyReviews broad principles that are applicable worldwideExplains how to findand interpret several important artifactsDescribes free and open source software tools, along with the AccessData Forensic ToolkitFeatures exercises and review questions throughout, with solutions provided in the appendicesIncludes numerous practical examples, and provides supporting video lectures online

This easy-to-follow primer is an essential resource for students of computer forensics, and will also serve as a valuable reference for practitioners seeking instruction on performing forensic examinations.

Joakim Kävrestad is a lecturer and researcher at the University of Skövde, Sweden, and an AccessData Certified Examiner. He also serves as a forensic consultant, with several years of experience as a forensic expert with the Swedish police.

This textbook describes the theory and methodology of digital forensic examinations, presenting examples developed in collaboration with police authorities to ensure relevance to real-world practice. The coverage includes discussions on forensic artifacts and constraints, as well as forensic tools used for law enforcement and in the corporate sector. Emphasis is placed on reinforcing sound forensic thinking, and gaining experience in common tasks through hands-on exercises.

This enhanced third edition describes practical digital forensics with open-source tools and includes an outline of current challenges and research directions.

Topics and features:

Outlines what computer forensics is, and what it can do, as well as what its limitations areDiscusses both the theoretical foundations and the fundamentals of forensic methodologyReviews broad principles that are applicable worldwideExplains how to find and interpret several important artifactsDescribes free and open-source software toolsFeatures content on corporate forensics, ethics, SQLite databases, triage, and memory analysisIncludes new supporting video lectures on YouTube

This easy-to-follow primer is an essential resource for students of computer forensics, and will also serve as a valuable reference for practitioners seeking instruction on performing forensic examinations.

This book constitutes the refereed proceedings of the 20th International Conference on Critical Information Infrastructures Security, CRITIS 2025, held in Jönköping, Sweden, during October 21–23, 2025.The 22 full papers presented in this volume were carefully reviewed and selected from 38 submissions. They were grouped into the following topics: Methods & Practice; Power Grids; Security and Safety Large and Small; Vehicles; Methods; Knowledge, Skills and Education; AI and Critical Infrastructures; Security Frameworks.

This work introduces the reader to the world of digital forensics in a practical and accessible manner. The text was written to fulfill a need for a book that introduces forensic methodology and sound forensic thinking, combined with hands-on examples for common tasks in a computer forensic examination. The author has several years of experience as a computer forensics examiner and is now working as a university-level lecturer.

Guide to Digital Forensics: A Concise and Practical Introduction is intended for students that are looking for an introduction to computer forensics and can also be used as a collection of instructions for practitioners. The aim is to describe and explain the steps taken during a forensic examination, with the intent of making the reader aware of the constraints and considerations that apply during a fo

rensic examination in law enforcement and in the private sector. Upon reading this book, the reader should have a proper overview of the field of digital forensics, starting them on the journey of becoming a computer forensics expert.

This practical and accessible textbook/reference describes the theory and methodology of digital forensic examinations, presenting examples developed in collaboration with police authorities to ensure relevance to real-world practice. The coverage includes discussions on forensic artifacts and constraints, as well as forensic tools used for law enforcement and in the corporate sector. Emphasis is placed on reinforcing sound forensic thinking, and gaining experience in common tasks through hands-on exercises.

This enhanced second edition has been expanded with new material on incident response tasks and computer memory analysis.

Topics and features:

Outlines what computer forensics is, and what it can do, as well as what its limitations areDiscusses both the theoretical foundations and the fundamentals of forensic methodologyReviews broad principles that are applicable worldwideExplains how to findand interpret several important artifactsDescribes free and open source software tools, along with the AccessData Forensic ToolkitFeatures exercises and review questions throughout, with solutions provided in the appendicesIncludes numerous practical examples, and provides supporting video lectures online

This easy-to-follow primer is an essential resource for students of computer forensics, and will also serve as a valuable reference for practitioners seeking instruction on performing forensic examinations.

Joakim Kävrestad is a lecturer and researcher at the University of Skövde, Sweden, and an AccessData Certified Examiner. He also serves as a forensic consultant, with several years of experience as a forensic expert with the Swedish police.

This textbook describes the theory and methodology of digital forensic examinations, presenting examples developed in collaboration with police authorities to ensure relevance to real-world practice. The coverage includes discussions on forensic artifacts and constraints, as well as forensic tools used for law enforcement and in the corporate sector. Emphasis is placed on reinforcing sound forensic thinking, and gaining experience in common tasks through hands-on exercises.

This enhanced third edition describes practical digital forensics with open-source tools and includes an outline of current challenges and research directions.

Topics and features:

Outlines what computer forensics is, and what it can do, as well as what its limitations areDiscusses both the theoretical foundations and the fundamentals of forensic methodologyReviews broad principles that are applicable worldwideExplains how to find and interpret several important artifactsDescribes free and open-source software toolsFeatures content on corporate forensics, ethics, SQLite databases, triage, and memory analysisIncludes new supporting video lectures on YouTube

This easy-to-follow primer is an essential resource for students of computer forensics, and will also serve as a valuable reference for practitioners seeking instruction on performing forensic examinations.

This book constitutes the refereed proceedings of the 20th International Conference on Critical Information Infrastructures Security, CRITIS 2025, held in Jönköping, Sweden, during October 21–23, 2025.The 22 full papers presented in this volume were carefully reviewed and selected from 38 submissions. They were grouped into the following topics: Methods & Practice; Power Grids; Security and Safety Large and Small; Vehicles; Methods; Knowledge, Skills and Education; AI and Critical Infrastructures; Security Frameworks.

This work introduces the reader to the world of digital forensics in a practical and accessible manner. The text was written to fulfill a need for a book that introduces forensic methodology and sound forensic thinking, combined with hands-on examples for common tasks in a computer forensic examination. The author has several years of experience as a computer forensics examiner and is now working as a university-level lecturer.

Guide to Digital Forensics: A Concise and Practical Introduction is intended for students that are looking for an introduction to computer forensics and can also be used as a collection of instructions for practitioners. The aim is to describe and explain the steps taken during a forensic examination, with the intent of making the reader aware of the constraints and considerations that apply during a fo

rensic examination in law enforcement and in the private sector. Upon reading this book, the reader should have a proper overview of the field of digital forensics, starting them on the journey of becoming a computer forensics expert.