File Systems and Data Structures
File Systems and Data Structures
This domain tests file-system metadata and where evidence hides. The exam favors NTFS and FAT, with awareness of exFAT, APFS, HFS+, and ext4.
Core structures
- FAT12/16/32 use a boot sector, FAT tables, root directory, and clusters. Deleted directory entries are marked 0xE5 and FAT chains are zeroed; data may remain until clusters are reused. exFAT uses an allocation bitmap.
- NTFS uses MFT records with $STANDARD_INFORMATION and $FILE_NAME timestamps, $DATA attributes, $Bitmap, $LogFile, $UsnJrnl, $MFTMirr, $Secure, and $Extend. Files can be resident or nonresident; NTFS supports compression, sparse files, alternate data streams, and EFS.
- APFS is copy-on-write with snapshots; HFS+ uses a catalog and extents; ext4 uses inodes, extents, and a journal.
- Slack includes file slack, RAM slack, and volume slack. Unallocated space holds deleted content.
Worked example
A deleted NTFS file's MFT record is not reused. The record still shows the file name, timestamps, and data runs. The examiner checks $Bitmap and cluster contents to see whether the runs were reallocated. If not, metadata-based recovery succeeds; if reallocated, only carving may help. $UsnJrnl can corroborate creation or deletion activity.
Traps
Trusting one timestamp; ignoring $FILE_NAME versus $STANDARD_INFORMATION differences; assuming FAT deletion wipes content; overlooking alternate data streams; misreading UTC versus local time.
Key points
- NTFS MFT records preserve metadata after deletion.
- FAT deletion marks directory entries and zeroes FAT chains.
- $Bitmap, $LogFile, and $UsnJrnl support recovery and timelines.
- Slack and unallocated space are distinct evidence locations.
- Timestamp source and time zone must be stated.