Computer Forensics Tutorial Disk File Systems (FAT16, FAT32, NTFS).

摘要

This tutorial is intended as in-class laboratory exercise for computer forensics classes at the Polytechnic University of Puerto Rico. It s specifically designed to provide basic understanding on the functionalities and capabilities of the tree most used file systems FAT16, FAT32, and NTFS. This document provides an inside or raw view of the files systems structure and how it handles data. It first covers the creation of a lab environment using openly available applications and the use of Hexadecimal Editors or Disk Editors to view and modify data.