Nelson Higher Education

Higher Education

Guide to Computer Forensics and Investigations, 6th Edition

  • Bill Nelson
  • Amelia Phillips
  • Christopher Steuart
  • ISBN-10: 1337568945
  • ISBN-13: 9781337568944
  • 688 Pages | Paperback
  • Previous Editions: 2016, 2010, 2008
  • COPYRIGHT: 2019 Published
Request a Copy for Review


About the Product

Providing authoritative information, powerful instructor resources and real-world student applications, Nelson/Phillips/Steuart's GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS, Sixth Edition delivers the most comprehensive forensics resource available. This proven author team's wide-ranging areas of expertise mirror the breadth of coverage in the text, which focuses on techniques and practices for gathering and analyzing evidence used to solve crimes involving computers and other digital devices. Providing clear instruction on the tools and techniques of the trade, it introduces readers to every step of the computer forensics investigation--from lab setup to testifying in court. It also details how to use current forensics software and provides free demo downloads of popular tools like FTK Imager for use with Case Projects and Hands-On Projects. MindTap Computing is also available.


  • Offering thorough explanations of how to use the most popular forensics tools, GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS equips readers with the skills they need to launch and conduct a successful digital investigation.

  • Extremely practical, it provides specific guidance on dealing with civil and criminal matters relating to the law and technology.

  • Up-to-date discussions detail how to manage a digital forensics operation in today's complex business environment.

  • Review Questions, Hands-On Projects and Case Projects give readers plenty of practice applying what they learn in real-world contexts.

  • Running case studies include weblinks to digital forensics demoware and free software that give readers additional opportunities to test their new skills as well as see examples of chapter concepts in action in professional practice.

  • Expansive high-resolution images bring chapter concepts to life. For example, cutaway views of hard drives present a difficult concept like the anatomy of a disk in a way students can thoroughly understand.

About the Author

Bill Nelson

Bill Nelson has worked for two global Fortune 100 companies in information technologies for more than 32 years, including 18-plus years in corporate digital forensics and information security. In addition, he has taught digital forensics classes at the City University of Seattle and the University of Washington's Professional and Continuing Education Department for 10 years. He also has experience in Automated Fingerprint Identification System software engineering and reserve police work. A former president and vice president for Computer Technology Investigators Northwest, he routinely lectures at several colleges and universities in the Pacific Northwest.

Amelia Phillips

Amelia Phillips is a tenured faculty member at Highline College in Seattle, Washington. After serving as an engineer at the Jet Propulsion Lab, she worked with e-commerce websites and began her training in computer forensics to prevent credit card numbers from being stolen from sensitive e-commerce databases. She designed certificate and AAS programs for community colleges in e-commerce, network security, computer forensics and data recovery. She designed the Bachelor of Applied Science in cybersecurity and forensics, which was approved in 2014. A Fulbright Scholar, she taught at Polytechnic of Namibia in 2005 and 2006 and continues her work with developing nations, traveling there frequently. She earned B.S. degrees in astronautical engineering and archaeology and an MBA in technology management from the Massachusetts Institute of Technology and an interdisciplinary Ph.D. in computer security from the University of Alaska, Fairbanks.

Christopher Steuart

Christopher K. Steuart is a practicing attorney maintaining a general litigation practice, with experience in information systems security for a Fortune 50 company and the U.S. Army. He is also an honorary life member and the former general counsel for Computer Technology Investigators Northwest. He has presented computer forensics seminars in regional and national forums, including the American Society for Industrial Security, Agora, Northwest Computer Technology Crime Analysis Seminar and CTIN.

Table of Contents

1. Understanding the Digital Forensics Profession and Investigations.
2. The Investigator's Office and Laboratory.
3. Data Acquisition.
4. Processing Crime and Incident Scenes.
5. Working with Windows and CLI Systems.
6. Current Computer Forensics Tools.
7. Linux Boot Processes and File Systems.
8. Recovering Graphics Files.
9. Digital Forensics Analysis and Validation.
10. Virtual Machine Forensics, Live Acquisitions and Cloud Forensics.
11. Email and Social Media.
12. Mobile Device Forensics and the Internet of Anything.
13. Cloud Forensics.
14. Report Writing for High-Tech Investigations.
15. Expert Testimony in Digital Forensic Investigations.
16. Ethics for the Digital Forensic Examiner and Expert Witness.
Appendix A: Digital Forensics Test References.
Appendix B: Digital Forensics References.
Appendix C: Digital Forensics Lab Considerations.
Appendix D: Digital Forensics Alternative Tools and Methods.

New to this edition

  • Thoroughly updated, the new Sixth Edition of the popular GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS guides readers step by step through conducting a high-tech investigation, from acquiring digital evidence to reporting its findings.
  • Completely up to date with new software and technologies, coverage includes how to set up a forensics lab, how to acquire and evaluate the necessary tools, and how to conduct an investigation and subsequent digital analysis.
  • With the book's free downloads of the latest forensics software, readers can quickly become familiar with current tools of the trade.
  • Offering the most up-to-the-minute content available, the Sixth Edition provides updated coverage of Linux and Macintosh, virtual machine software such as VMware and Virtual Box, Android, mobile devices, handheld devices, cloud forensics and much more.
  • All-new coverage of email, social media and the Internet of Anything reflects the latest developments from the field.
  • Enhanced end-of-chapter exercises give students more hands-on applications--helping them maximize their study time and course success.
  • Available with the Sixth Edition, MindTap Computing is the digital learning solution that helps learners master the skills they need to succeed in today's workforce. Hands-on exercises and live virtual machine labs provide real-life application. Readings and "Whiteboard Shorts" support the lecture, while "In The News" assignments keep students up to date with the latest developments. In addition, pre- and post-course assessments help you measure how much students learn--making it easy to see where the class stands in terms of progress, engagement and completion rates.


All supplements have been updated in coordination with the Main title.
Please see Main title page for new to this edition information.

Instructor Supplements

Instructor Companion Website  (ISBN-10: 1337568961 | ISBN-13: 9781337568968)

Everything you need for your course in one place! This collection of product-specific lecture and class tools is available online via the instructor resource center at You'll be able to access and download materials such as PowerPoint presentations, images, instructor's manual, videos and more.

Cengage Testing, powered by Cognero┬« Instant Access  (ISBN-10: 1337569097 | ISBN-13: 9781337569095)

Cengage Learning Testing, powered by Cognero® is a flexible, online system that allows you to import, edit and manipulate content from the texts test bank or elsewhere, including your own favorite test questions; create multiple test versions in an instant; and deliver tests from your LMS, your classroom or wherever you want.