File System Forensic Analysis - Brian Carrier (Addison-Wesley, 2005)