Brian Carrier
More info
- Country
- United States
- Known for
- The Sleuth Kit, Autopsy, File System Forensic Analysis (2005)
American researcher and developer behind The Sleuth Kit and Autopsy, the free toolkit most forensics courses start with.
The Sleuth Kit grew in the early 2000s out of The Coroner's Toolkit, which Dan Farmer and Wietse Venema had written for Unix. Carrier extended the idea into a set of command-line tools that read a disk image layer by layer — partition, file system, metadata, content — and recover deleted files where the operating system merely crossed out an entry. Autopsy put a graphical front end on top and grew into a full investigation platform.
His book File System Forensic Analysis (2005) walks through FAT, NTFS, ext and UFS byte by byte. It is still the reference, which says something about how little file systems have changed.