I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH: File Systems and Data Recovery

CCFH · Work through your exam, one topic at a time.

All guide sections

File Systems and Data Recovery

What this domain tests

This domain tests whether you can navigate NTFS, FAT, and ext-family structures, interpret timestamps correctly, and recover or explain the absence of deleted content.

Core rules and concepts

  • NTFS structure. The Master File Table holds 1024-byte records with attributes that are resident (inside the record) or non-resident (in clusters). Key metadata files include $MFT, $LogFile, $UsnJrnl with its $J stream, $Bitmap, $Secure, and $Extend.
  • Duplicate timestamps. Each file usually has four timestamps in $STANDARD_INFORMATION and four in $FILE_NAME. The $FILE_NAME copy updates on creation, rename, and move, so disagreement between the two sets is evidence of copying or timestamp manipulation.
  • Allocation concepts. Cluster size determines slack space; deleted files leave records and clusters marked unallocated until reused.
  • FAT. Directory entries hold short names; long names occupy separate entries. A deleted entry typically has its first name byte set to 0xE5 and its start cluster zeroed, so recovery depends on locating the cluster chain or carving.
  • ext3/ext4. Superblock, inode table, extents, and journal. Deletion clears inode pointers, but data blocks persist until overwritten; the journal may retain recent metadata.
  • Epochs and zones. NTFS FILETIME counts from 1601 UTC; Unix time from 1970 UTC. Always normalise to UTC and state the offset used.
  • Carving. File headers and footers, such as JPEG markers FFD8 and FFD9 or the %PDF signature, allow recovery without metadata; fragmented files may carve incompletely, so carving is weaker evidence than a reconstructed chain.

Worked example

A file shows $STANDARD_INFORMATION creation of 2019 but $FILE_NAME creation of 2022. Two explanations exist: the file was copied or moved into the volume in 2022, which preserves the older system timestamps, or the timestamps were deliberately altered. Corroborate with the USN journal for rename or create records, with $MFT record numbers, and with volume shadow copies. Only the combination supports a conclusion.

Traps that cost marks

  • Reading $STANDARD_INFORMATION alone and calling it the file's true creation time.
  • Forgetting the time-zone offset when building a timeline.
  • Assuming carved files are complete or original.
  • Claiming deleted data is unrecoverable without checking unallocated clusters, shadow copies, or the journal.