StorageHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.File System Analysis
Read NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
Tools show you a neat folder tree. Underneath, every file system keeps records of names, sizes, timestamps and where the data sits on disk. Those records often survive after the file is gone. This course teaches you to read those records directly, so you can check what a tool tells you and find what it misses.
Most time goes to NTFS because most cases involve Windows. You study MFT records, the $STANDARD_INFORMATION and $FILE_NAME timestamps, resident and non-resident data, alternate data streams, the $LogFile and the $UsnJrnl change journal. Then you move to FAT32 and exFAT on removable media, ext4 on Linux servers and Android, and APFS on Macs and iPhones.
The last part brings it together in a timeline. Say a contract was edited, copied and deleted in one evening. You build that sequence from file system records, spot signs of timestamp tampering and present the result in a form a non-technical reader can follow.
NTFS and the MFText4 and APFSTimestampsTimeline building
After this course you can
- Parse an NTFS MFT record by hand and explain each attribute
- Compare $STANDARD_INFORMATION and $FILE_NAME timestamps to spot timestomping
- Use the $UsnJrnl and $LogFile to show files that were created, renamed or deleted
- Recover deleted files from FAT32, exFAT and NTFS and explain why ext4 recovery is harder
- Describe APFS containers, volumes, snapshots and copy-on-write behaviour
- Build a timeline with plaso and MFTECmd and filter it down to the events that matter
Syllabus
7 modules · 29 topics
01File system basics4 topics
- Clusters, blocks and allocation
- Metadata, directories and data areas
- Slack space: RAM slack and file slack
- Using The Sleuth Kit layers: volume, file system, metadata and content
02NTFS in depth5 topics
- The boot sector, $MFT and MFT records
- $STANDARD_INFORMATION and $FILE_NAME attributes and their four timestamps
- Resident and non-resident data, data runs
- Alternate data streams, including Zone.Identifier for downloaded files
- $I30 index entries and deleted file names in directory slack
03NTFS journals4 topics
- $LogFile and what it records
- $UsnJrnl:$J change journal and reason codes
- Finding renamed and deleted files from journal records
- Volume Shadow Copies as older views of the volume
04FAT32 and exFAT4 topics
- Boot sector, FAT chains and directory entries
- Deleted entries and recovery limits
- exFAT allocation bitmap, entry sets and timestamps with time zone offset
- Where these file systems turn up: pen drives, SD cards, cameras, CCTV exports
05ext4 on Linux and Android4 topics
- Superblock, block groups, inodes and extents
- The jbd2 journal
- Why deleted file recovery on ext4 is harder than on NTFS
- Using debugfs and Sleuth Kit tools on ext4 images
06APFS on Apple devices4 topics
- Containers, volumes and volume roles
- Copy-on-write and what it means for deleted data
- Snapshots and how to list them
- Encryption on APFS and when analysis needs keys
07Timelines and timestamp tampering4 topics
- MAC(B) times across file systems and how each one updates
- Building super-timelines with plaso (log2timeline)
- Filtering in Timeline Explorer
- Signs of timestomping and clock changes
Hands-on labs
- Lab 1
Decode an MFT record in a hex editor and match each value with what Autopsy shows
- Lab 2
Find a timestomped document by comparing $SI and $FN times and confirm it from the USN journal
- Lab 3
Recover a deleted folder from an exFAT SD card image and list original names and times
- Lab 4
Build a timeline of a mock office theft case and present the ten key events
- Lab 5
List snapshots on an APFS image and compare a file across two snapshots
Tools you will use
- The Sleuth Kit and Autopsy
- MFTECmd and Timeline Explorer
- plaso (log2timeline)
- X-Ways Forensics
- FTK Imager
- debugfs
- mac_apt
- HxD hex editor
Who it suits
- Examiners who want to check tool output rather than trust it blindly
- Students preparing for the DCFA certification
- Incident responders who build attack timelines
- Forensic lab staff who present timestamps in reports and court
Before you join
- Basics of Cyber Forensics or some experience with forensic tools
- Comfort with hexadecimal and simple binary values (a short refresher is given)
- HDD Forensics is useful but not required
Questions about this course
Why learn structures by hand when tools do it for you?
Tools sometimes parse things wrongly or miss deleted records. If you are asked in court how you know a timestamp is right, you need to explain where it came from. Knowing the structure lets you check and defend your findings.
Which file system gets the most time?
NTFS, because most cases involve Windows computers. FAT32, exFAT, ext4 and APFS each get their own module.
Will I learn to spot faked timestamps?
Yes. You compare timestamps from different NTFS attributes and from the change journal. Mismatches are a common sign that someone changed the times with a tool.
More courses in Digital Storage Forensics
StorageHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.
StorageUSB / Pen Drive ForensicsExamine pen drives and memory sticks and prove which USB device touched which computer.
StorageRAID / NAS ForensicsImage RAID members, rebuild arrays virtually and examine NAS boxes after ransomware.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.