Filesystem Forensics

Content Leader: Jess Garcia - Last Updated: March 10, 2007

Index

• Partition Tables (see below)
• Filesystems Specifications (see below)

• Disk Images
• RAID Arrays
• USB Drives
• Wiping & Secure Deletion
• Recovery of Deleted / Formatted / Damaged Filesystems

Partition Tables

References

• Partition Types
• Intel Partition Table

Filesystems Specifications

Field Notes

• ext2/ext3
• FAT
• NTFS

Note: These fields notes are intended to provide help in daily forensics analysis. They are by no means meant to be complete, and a best effort is made to keep them accurate.

References

• You can find a wonderful list of filesystem specifications at forensics.nl.