The Association of Digital Forensics, Security and Law (ADFSL)
On the day that I sat down to start to write this review, the following e-mail came across on one of my lists: Person A and Person B write back and forth and create an email thread. Person A then forwards the email to Person C, but changes some wording in the email exchange between A & B. What is the easiest way (and is it even possible) to find out when that earlier email message was altered before sent to Person C? Before you try to answer these questions, read Fred Cohen's Digital Forensic Evidence Examination. His book won't actually tell you how to answer these questions but it will help you understand the difficulty in even trying to answer them with any level of certainty.
Cohen, F. (2010). Digital Forensic Evidence Examination (2nd ed.). Livermore, CA: ASP Press. 452 pages, ISBN: 978-1-878109-45-3, US$79..
Kessler, Gary C.
"Book Review: Digital Forensic Evidence Examination (2nd Ed.),"
Journal of Digital Forensics, Security and Law: Vol. 5
, Article 6.
Available at: http://commons.erau.edu/jdfsl/vol5/iss2/6