Working with the contributing authors on this Handbook has been a deep honor and learning experience. Thanks to all involved for their commitment to advancing the field of digital forensics and investigation, and their willingness to share their knowledge. I have deepest gratitude for Christopher Daywalt for being smarter, better, faster, and repeatedly rescuing this book by lifting us over seemingly insurmountable hurdles. Thanks for the tireless support and patience of Liz Brown, Renske van Dijk, Nikki Levy, and everyone else at Elsevier who worked on bringing this book to print. Special thanks to Genevieve, Roisin and Hesper for their infinite love and reminding me what is important in life.

There are a lot of people I owe a debt of gratitude with regards to Linux & UNIX forensics. First and foremost among these people is Brian Carrier – without the Sleuthkit we'd still be using stone knives and bearskins to examine any non-Windows file systems. I'd like to thank Eoghan Casey for encouraging me to share my knowledge with the community, first through Digital Investigation, then the Digital Forensics Research Workshop, and most recently this handbook. Thanks go to Rob Lee for his continued advice and support over the years, and to Andy Rosen for being the vanguard of our industry as well as a good friend. An enormous amount of gratitude goes to Avery Brewing for Mephistopheles Stout, Dogfish Head for Theobroma, and New Belgium for La Folie. Finally, to my incredible wife Jamie and my two amazing daughters for always reminding me why it is I do what I do – I love you.

I would like to thank Eoghan Casey for the opportunity to make my modest contribution to this excellent text.

I want to personally thank Eoghan Casey for his incredible patience and support during the whole chapter preparation. He was incredibly active and kind, also helping me and my co-author Andrea de Donno since the first moment. I dedicate this work to my daughter Nicole, my wife Kseniya, my mother Marisa and my sister Daniela. The contribution to this book will not help me to change my Ferrari, but will surely make me a better author.

I appreciate Eoghan for reaching out to me to ask me to contribute to this book and Ernst & Young for approving my participation. Books do not happen without some sacrifice from the authors and their families. Thank you Stacy, Jacob, Audra and Jenna for letting me take nights and weekends away from you to write. I also acknowledge the tremendous work of the other contributing authors of the electronic discovery chapter. They clearly have a wealth of experience in this area.

I would like to acknowledge the continued support and patience of Eoghan Casey. Eoghan is, as my father used to say, “a gentleman and a scholar.”

I would like to thank the following people for assisting in creation of the many iterations of Macintosh forensic courses I've worked on: Gord Beatty, France Thibodeau, Thane Erickson, Erinn Soule, Al Evans, and of course Jim May. I would also like to thank both Jesica and Marissa for their part during my very intensive research bouts during the past eight years. I would like to thank the following real or imaginary influences in no particular order: Johnny, the Dead Presidents and all other inhabitants of the Frat House, past and present of bfist, tmag20, Libby, Miko, Bill, Lisa, Ken, and lastly, Taft. I would like to issue a special thank you to all of my family, most of whom do not understand a thing I say about computers. Lastly I would like to thank Eoghan Casey for the opportunity to work with him in many endeavors.

I'd like to thank my wife Kathy, my children Maddy, Julia, and Nathan, and my colleagues at Stroz Friedberg for their encouragement, time, and support. I'd also like to thank Eoghan Casey for inviting me to join this worthy endeavor.

Thanks to my kids, Patrick, Morgan, Nicole and Collin, for showing me on a daily basis no matter what else I do you guys will always be the best thing I have ever done. Thanks to Chris Daywalt and Eoghan Casey, my colleagues and “partners in computer crime”, for providing me company at the Brewer's Art. And thanks to my hero, a dentist in Wilmington Delaware, who taught me everything I ever needed to know about life.

Personally, this is for my Grandfather, Dr. Robert Renard, who is my model for living a fulfilling life, and for my wife and wonderful sons, who represent all that is good and contenting in my world. Professionally, for Dave Shaver, a great friend, archetypal mentor, and long-time collaborator; for Eoghan Casey, for being a true soul, opening this door (and many others), and being the nicest Jedi in our field; for Jamey Tubbs, a loyal friend and the reason I got my first break; for Bob Weitershausen, thanks for taking a chance on an unknown; for Lance Mueller, whose work continues to remind me everyday how much I have left to learn; for Dr. Larry Kurtz, who continues to inspire my professional and academic achievement; for Jon Evans, who forced me out of my Linux-less existence; for the other brilliant men and women in our field, like Harlan Carvey, Jesse Kornblum, and Brian Carrier, who constantly answer forensic questions I never even knew I had; and for CID Agents everywhere, working way too hard, in way too much danger, for way too little money or recognition.

I would like to thank Federal Bureau of Investigation Special Agents Mike and Gail Gneckow; Wendy Olson and Traci Whelan, Assistants United States Attorney; Thomas Moss, United States Attorney for the District of Idaho, as well as all the other incredibly dedicated and hard working professionals involved in the capture, investigation and prosecution of Joseph Edward Duncan III.

I would like to take a moment to thank my parents for giving me my first HP-UX computer in the late 1980s and always teaching me to find out the answers. Thanks to my wife for her patience and understanding. Brent Pack, who taught me Linux is almost as cool as UNIX; David House, who demonstrated the proper method for blowing up computers; Scott Stein, who taught me that a Mac computer is actually pretty damn cool; Ryan Pittman, who taught me that some hot sauces are actually quite hot and painful; Troy Asmus, who taught me that anything could be disassembled if you have a big enough hammer; Mark Diaz, who was always there to point out my errors (“Dave, your lug nuts are loose”) and finally, a warm “thank you” to all the Usual Suspects, and to my fellow CID Agents who get the job done despite having to work long hours with little pay, not enough support and too much red tape.

I would like to thank my colleagues and friends for your encouragement, assistance and willingness to share your knowledge. Thanks to my mother and father, for your love, guidance and support. And thanks to my husband Taylor, for all the above and much more.

I would like to thank the people within the Dutch government supporting forensic embedded system analysis, and all the people from law enforcement organizations willing to share knowledge. Thanks also to my colleagues for reviewing the embedded systems analysis chapter.