The Investigating File Systems course offers a comprehensive, hands-on exploration of how file systems operate and how yet-uncovered artefacts provide critical insights during forensic investigations. Participants will learn to navigate file system structures, recover deleted or hidden data, and trace user and application behaviour across different storage environments.
Through practical exercises, learners explore file systems (such as NTFS, FAT32, EXT4), master forensic acquisition techniques, and uncover key artifacts that support investigations of incidents, breaches, and malicious activity. By the end of this course, participants will have the skills and confidence to interpret complex file system evidence and contribute significant findings to forensic reports.
Format: On-demand, self-paced online course.
Access Options: Course material & practical virtual lab environment (hands-on labs included).
Ideal For: Learners who want practical, in-depth experience with file system forensics, recovering deleted data, interpreting MFT and metadata, and analyzing allocation structures, at their own pace.
-
-
-
-
-
-
Timestamps and File Operations
-
-
Exercise 02 -- Inspecting Timestamps
-
-
-
-
Required Files (FAT Analysis)
-
FAT File System - Basics - Slides
-
-
Lab - Analyzing FAT Structure
-
FAT File System - Directory Entry - Slides
-
FAT File System - Timestamps - Slides
-
Lab - Analyzing FAT File System #1
-
Lab - Analyzing FAT File System #2
-
-
-
Required Files (NTFS Analysis)
-
-
-
Lab - Analyzing the MFT File #1
-
Lab - Analyzing the MFT File #2
-
Lab - Working with Data Attributes
-
NTFS Dataruns and Fragmented Files
-
-
-
-
NTFS INDX Buffers - Slides
-
-
Lab - Working with UsnJrnl
-
Lab - Working with Journals and Indexes
-
-
Lab - NTFS Challenge (Solution A)
-
Lab - NTFS Challenge (Solution B)
-
- Understand the structure and purpose of common file systems, including NTFS, FAT32, and EXT4
- Identify and interpret key file system artifacts such as Master File Table (MFT) entries, directory records, and metadata
- Recover deleted or hidden files using forensic tools and techniques
- Analyze allocation structures and interpret slack space for potential evidence
- Correlate file system artifacts with system and user activity timelines
- Apply forensic acquisition methods to ensure data integrity and evidence preservation
- Generate well-structured reports that clearly communicate findings in forensic investigations