FTFM: Forensic Team Field Manual Book 2

by Alan J. White & Ben Clark

The Forensic Team Field Manual extends the BTFM series into dedicated digital forensics territory. Alan White and Ben Clark provide a comprehensive quick-reference for forensic examiners covering evidence acquisition, chain of custody procedures, file system analysis commands, registry forensics, browser artifact extraction, email analysis, and mobile device forensics. The manual includes commands for tools like FTK Imager, Autopsy, Volatility, RegRipper, and Eric Zimmerman's suite, organized by forensic task rather than tool. It covers both Windows and Linux forensic procedures, with sections on timeline creation, artifact correlation, and report writing. The 2025 edition reflects current forensic practices including cloud evidence collection, container forensics, and modern Windows artifact locations.