In this course, you will learn how to interact with the lower levels of files and disks. Specifically, you will understand the file's structure and learn how to identify various file types. File's metadata will also be demystified in this section. You will then get familiar with disk drives, their types, and schemes used today by our systems. Volumes and partition concepts are up next. You will learn what they are, how to identify them and the techniques you can use to analyze them. Finally, you will dive into the world of file systems. You will be shown how to analyze FAT and NTFS file system structures and how to apply file carving techniques to retrieve previously removed data. You will have the chance to try each tool and technique mentioned in hands-on and practical labs.
This course is part of the Digital Forensics Professional Learning path which prepares you for the eCDFP exam and certification
Homepage