Course Curriculum

    1. What is File System

    2. Ext4

    3. NTFS vs EXT4

    4. Timestamps and File Operations

    5. Required Files

    6. Exercise 02 -- Inspecting Timestamps

    7. Exercise 02 - Solutions

    8. NOTICE

    1. Required Files (FAT Analysis)

    2. FAT File System - Basics - Slides

    3. Intro to FAT File System

    4. Lab - Analyzing FAT Structure

    5. FAT File System - Directory Entry - Slides

    6. FAT File System - Timestamps - Slides

    7. Lab - Analyzing FAT File System #1

    8. Lab - Analyzing FAT File System #2

    1. NTFS

    2. Required Files (NTFS Analysis)

    3. NTFS Basics - Slides

    4. NTFS MFT - Slides

    5. Lab - Analyzing the MFT File #1

    6. Lab - Analyzing the MFT File #2

    7. Lab - Working with Data Attributes

    8. NTFS Dataruns and Fragmented Files

    9. MFT Slack Space

    10. NTFS Fixups - Slides

    11. Lab - Working with Links

    12. NTFS INDX Buffers - Slides

    13. NTFS Journaling - Slides

    14. Lab - Working with UsnJrnl

    15. Lab - Working with Journals and Indexes

    16. Lab - NTFS Challenge

    17. Lab - NTFS Challenge (Solution A)

    18. Lab - NTFS Challenge (Solution B)

    1. Extra Reading

About this course

  • $50.00
  • 35 lessons
  • 1 hour of video content

8 CPE Credits

After completing this course, you will earn:

Get Started Now

Learn how to parse and analyze their structures and utilize file system data

Enroll now for $100

Learning Outcomes

After completing this course, you will learn the following.

  • Demonstrate a comprehensive understanding of file systems and the ability to identify unique file system metadata

  • Analyze and parse the underlying file system structures

  • Apply this knowledge to data recovery and forensic investigations

Technical Requirements

To complete the hands-on labs of this track

  • Windows 10/11 operating system (recommended)

  • Internet Connection

  • 010 Editor here or HxD Editor here

  • X-Ways here or WinHex here

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates.

Thank You