I85PREP
⌘ K
Mile2 CDFE study materials
Mile2 CDFE study resources

Mile2 CDFE: Disk and File System Forensics

Mile2 CDFE · Work through your exam, one topic at a time.

All guide sections

Disk and File System Forensics

Domain 3 - Disk and File System Forensics

This domain tests how storage media and file systems record activity, how to recover deleted content, and how to interpret metadata without overclaiming. Expect questions on MBR/GPT, FAT, NTFS, ext, slack space, carving, and timelines.

Core rules

  • A disk image is a bit-for-bit copy; verify with a hash. Work on copies, mount read-only, and document partition offsets.
  • MBR holds boot code and a 4-entry partition table; GPT uses a protective MBR and GUID partition entries with backup headers.
  • FAT uses directory entries, cluster chains, and a file allocation table; deletion typically marks the first filename byte as 0xE5 and frees clusters. Fragmentation complicates recovery.
  • NTFS uses the Master File Table (MFT); each file has a record with attributes and data runs. $LogFile records metadata transactions, $UsnJrnl tracks changes, $Bitmap tracks cluster allocation, and alternate data streams can hide content.
  • ext2/3/4 use inodes, block bitmaps, and journals (ext3/4); deletion clears inode pointers and frees blocks, so recovery depends on reuse.
  • Slack space is the tail of the last allocated cluster; unallocated space holds deleted or orphaned data. File carving uses headers, footers, and signatures, not file system metadata.
  • Timeline analysis combines MACB timestamps (modified, accessed, changed/MFT, born/created) with timezone and clock caveats.

Worked example

A deleted NTFS file is suspected. The examiner parses the MFT for a record with the in-use flag cleared, checks $Bitmap for clusters marked free, follows data runs, and carves if runs are fragmented or overwritten. Reasoning: the MFT may retain the filename and runs after deletion, but free clusters can be reused; recovery is strongest when clusters are not reallocated. The finding is 'a deleted file consistent with X,' not proof of who deleted it.

Traps

Reporting file times without timezone or clock correction; treating MAC times as intent; assuming deleted means unrecoverable; confusing resident data with clusters; using carving output without validation; ignoring ADS and $LogFile.