This morning I opened up my mailbox to find an email from Jacco Tunnissen over at honeypots.net letting me know that my Linux harddrive forensic analysis presentation (slide deck here) is now being linked on the Computer Forensics, Cybercrime and Steganography Resources page.
One of these days I will have to update that to include a bit more of the actual demo, since its the demo that actually shows how to do the analysis. Once you actually SEE a MAC timeline created live and then do a block my block analysis things start to make a bit more sense.
Anyways, I checked out the page and there are some really good links in there. If you are into computer forensics I highly recommend you check some of them out at www.forensics.nl. [Dana Epp's ramblings at the Sanctuary]