[.ca] Forensic Discovery (ISBN 020163497X)

Nice look at Unix forensics!:
I must admit that some parts of this book are "over my head". However, this book packs quite a punch with much insight into forensics and explanations that are detailed and accompanied by MANY practical examples. The authors do a fine job of making this book interesting and they actually keep it rather short (believe me, most books on the subject are). One possible flaw is that I'd probably prefer for it to have a bit more theory and a bit less practical examples.