Forensic Discovery Errata.

Despite our best efforts a few errors did creep into the book; we are, of course, to blame for all! Here are the ones we know about.

By far the biggest error in the book is that dan changed his domain name - all the fish.com references in the book should be replaced by fish2.com.

Chapter 4:

In section 4.7 (Existing file MACtimes)

mactime -p /victim/etc/passwd -g /image/etc/group ...

should be

mactime -p /victim/etc/passwd -g /victim/etc/group ...

Chapter 8:

Rayner K Rosich found an error in the graph in chapter 8, figure 8.3. The graph in the book cuts off the left-most data points of the chart's y-axis; the raw data shows that 2346 pages didn't change (y=2346, x=0), while 606 changed once (y=606, x=1). This can be barely seen in the original gnuplot output that we sent to Addison-Wesley:

In addition there are constant bitrot and program syntax changes that might make our examples no longer work, but to the best of our knowledge they were fine at the time of the writing and publishing. For example, the syntax for loopback mount commands has changed with FreeBSD 5. In addition, a variety of URLs have changed, but we'll kindly decline updating all that, and leave it instead as an exercise to the reader - and google ;-)