A JonnyTech guide to file systems in forensic investigations.
Summary
Every operating system organizes data differently. Windows uses NTFS or FAT. Linux uses Ext4. macOS uses APFS. If you don't understand how each system stores files, you'll miss evidence. Worse, you might accidentally overwrite the very data you're trying to recover. Understanding file systems is the foundation of digital forensics.
How Hard Drives Store Data
Before we talk about file systems, you need to understand the hardware.
The Physical Drive: Platters, Tracks, and Sectors
Platter: A spinning disk inside a hard drive coated with magnetic material that actually stores the data.
Remember it like this: Like a vinyl record—the data is written in circles around the platter.
Tracks: Concentric circles on the platter where data is stored, numbered from the outside edge to the center.
Remember it like this: Like the rings on a tree—each ring is a track.
Sectors: Small pie-shaped sections of each track where data is actually written. A standard sector is 512 bytes (newer drives use 4,096 bytes).
Remember it like this: If tracks are rings, sectors are pizza slices.
Clusters: A group of sectors bundled together into one storage unit. The operating system assigns data to clusters, not individual sectors.
Remember it like this: Like combining pizza slices into a whole pizza for easier handling.
Partitions: Dividing the Drive
A hard drive can be split into multiple partitions, each acting like its own independent disk.
MBR (Master Boot Record)
An older system that stores partition information in sector 0. It can handle drives up to 2.2 TB.
Remember it like this: It's like a table of contents at the front of a book.
GPT (GUID Partition Table)
The modern replacement for MBR. It handles much larger drives (over 2.2 TB) and stores partition information more reliably.
Remember it like this: Think of it as an improved table of contents that works with enormous books.
Partition Gap
Unused space between partitions. Criminals sometimes hide data here because it's often overlooked.
Remember it like this: Like the gap behind a picture frame on a wall.
Windows File Systems: FAT and NTFS
Windows has used two main file systems: FAT (old) and NTFS (modern).
FAT (File Allocation Table)
FAT is an older file system used on older Windows computers, USB drives, and SD cards.
How FAT works: A database at the beginning of a partition lists every file, its location, size, date modified, and which clusters it uses.
Remember it like this: Like an address book—it tells you where to find each file.
FAT Versions:
- FAT16: Very old, limited to small drives
- FAT32: Common on USB drives
- exFAT: Modern version for portable media
Critical Forensic Fact: Deletion in FAT
When you delete a file in FAT, only the first letter of the filename changes to HEX E5. The actual data stays on disk.
This is why deleted files can often be recovered. The data is still there—the file system just lost track of it.
Drive Slack: Finding Hidden Data
Drive Slack: Unused space left over when a file doesn't perfectly fill the clusters assigned to it.
Remember it like this: Like when you pour milk into a glass and there's extra room—that's slack.
RAM Slack: Older data left in RAM before it's written to disk. Newer Windows systems zero this out.
File Slack: Unused sectors in the last cluster assigned to a file. Often contains fragments of deleted files.
File Fragmentation
When a file is split across non-consecutive clusters because the drive ran out of continuous space. The file is still readable, but scattered across the disk.
Remember it like this: Like tearing a book into chapters and storing them in different rooms.
NTFS (New Technology File System)
NTFS is Microsoft's modern file system used in Windows 10/11. It stores much more information about files than FAT.
What Makes NTFS Better
Remember it like this: An upgrade from FAT—like going from a simple filing cabinet to a smart database system.
NTFS advantages:
- Journaling (records changes before they happen—helps prevent data loss)
- Unicode support for international characters
- Much less file slack than FAT
- More detailed metadata
Master File Table ($MFT)
The $MFT is a database containing metadata about every file and folder on the drive. Each entry is 1,024 bytes.
Remember it like this: Like the card catalog in a physical library.
What's in the $MFT:
- Filename
- File size
- Creation date
- Modified date
- Accessed date
- Permissions
- Location on disk (cluster numbers)
- Short (DOS-style) filename
Metadata: The File's Passport
Metadata: Information about a file rather than the file's actual content.
Remember it like this: The file's passport or ID card—it describes the file without being the file itself.
Resident vs. Nonresident Data
Resident data: Small enough to fit inside the $MFT record itself. No separate storage needed.
Nonresident data: Too large and stored elsewhere on disk with a pointer in the $MFT.
Remember it like this: Resident = data in the index card itself. Nonresident = data in a separate file cabinet with a reference in the index.
Important NTFS System Files
Prefetch Files
Windows creates these files to speed up application loading. They record when applications were run, how many times, and what data they accessed.
Remember it like this: Like a history book of every program you've run and when.
Location: C:\Windows\Prefetch
Tool to read: PECmd.exe
$UsnJrnl (Update Sequence Number Journal)
A log that records every change made to files on the disk—creation, modification, deletion, renaming, etc.
Remember it like this: Like a security camera recording every action taken on the file system.
Why it's valuable: Shows activity in chronological order and can survive file deletion.
$I30 System File
Created by Windows to store additional file and folder information when a directory grows large. Can contain residual data about deleted files.
Remember it like this: When a filing cabinet gets too full, you create an overflow file.
Index Slack (INDX Slack)
The space inside $I30 files that contains information about deleted files. Often recoverable.
Remember it like this: Like pages torn out of a logbook that are still readable.
NTFS Security Features
Alternate Data Streams (ADS)
Hidden data attached to a file that doesn't increase the file's visible size. Criminals use this to hide malware or evidence.
Remember it like this: Attaching a secret note to a document without making it thicker.
Example: malware.exe:hidden.txt stores hidden.txt attached to malware.exe
NTFS Encryption (EFS)
Encrypts files or folders using public/private key cryptography. Without the key, even the OS can't read the data.
Remember it like this: Like a safe deposit box that even the bank can't open.
Critical for forensics: Be prepared to encounter encrypted evidence you cannot access.
Linux File Systems
Linux uses different file systems than Windows, but the principles are similar.
Ext2, Ext3, Ext4
Linux's native file systems.
- Ext2: Older, no journaling
- Ext3: Added journaling (prevents data loss on crash)
- Ext4: Most modern, better performance
Remember it like this: Ext4 is the most modern Linux file system, like Windows moving from FAT to NTFS.
Key forensic fact: Linux doesn't move files to trash. When you delete a file at the command line, it's gone immediately. No recovery without specialized tools.
ReiserFS and Reiser4
Alternative Linux file systems with advanced features like journaling and efficient space usage.
Remember it like this: Less common than Ext, but still used in some Linux distributions.
macOS File Systems
macOS has evolved through different file systems.
HFS+ (Hierarchical File System Plus)
The file system used on older Mac computers. Less efficient than modern systems.
Remember it like this: Like an older filing system—it works but has limitations.
APFS (Apple File System)
Apple's modern file system for current Macs. Optimized for SSDs.
Remember it like this: Apple's equivalent to moving from FAT to NTFS.
APFS advantages:
- 64-bit architecture (handles massive files)
- Snapshots—backups at specific points in time
- File cloning—copies without using extra storage
- Better forensic artifacts
macOS Forensics
Keychain
Apple's password manager that stores passwords for applications, websites, and system files.
Remember it like this: Like a digital key ring holding all your passwords.
FileVault
Full-disk encryption in macOS. Encrypts the user's home directory and makes forensic access much harder.
Remember it like this: A safe that protects the entire drive.
Disk Arbitration
A macOS security feature that automatically mounts drives when connected. Forensic tools need to disable it to properly acquire evidence without causing changes.
Remember it like this: Like an automatic lock that engages—you need to disable it for forensic work.
macOS directory structure:
/users/username- User home directory (not/homelike Linux)/private/var/root- Root user directory- Guest account disabled by default
- Users have limited access to other users' files
Linux Forensics Tools
Sleuth Kit and Autopsy
Open-source tools for analyzing file systems. Autopsy is the web interface version of Sleuth Kit.
Remember it like this: Magnifying glasses for examining file system evidence.
Capabilities:
- Free and widely used
- Can analyze FAT, NTFS, Ext, and other file systems
- Excellent for carving (finding deleted files)
Foremost
A file carving tool that searches disk images for file headers and footers to recover deleted files, even if the file system is damaged.
Remember it like this: Like searching through garbage to find torn-up documents.
dc3dd
A Linux command-line tool for creating forensic images of hard drives while verifying integrity.
Remember it like this: Like making a perfect photocopy of evidence.
Proving Data Integrity: Hashing
Hash/Checksum: A unique fingerprint of digital data. If even one byte changes, the hash changes completely.
Remember it like this: Like a tamper seal—if it's broken, you know someone messed with it.
Common Hash Algorithms
- MD5: Outdated, not recommended anymore
- SHA-1: Better than MD5, widely used but being phased out
- SHA-256: Modern standard, most secure
Critical rule: Calculate hash values before and after examination. If hashes match, data integrity is proven.
Key Takeaway
File systems are how operating systems organize data. Understanding them tells you:
- Where evidence is hidden
- How to recover deleted files
- What metadata reveals about user activity
- How to prove you didn't change anything
Get the file system wrong, and you either miss evidence or contaminate it. Get it right, and you recover data that would otherwise be lost forever.