I've used this book a couple of times on the few Linux examinations I've been involved in:
http://www.amazon.co.uk/UNIX-Forensic-Analysis-DVD-Toolkit/dp/1597492698
No complaints.
↧