Guide to Computer Forensics

and Investigations
Sixth Edition

Chapter 5
Working with Windows and CLI Systems

1
 Objectives

• Explain the purpose and structure of file systems

• Describe Microsoft file structures
• Explain the structure of NTFS disks
• List some options for decrypting drives encrypted with whole disk encryption
• Explain how the Windows Registry works
• Describe Microsoft startup tasks
• Explain the purpose of a virtual machine

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
2
2
protected website for classroom use.
 Understanding File Systems

• File system
• Gives OS a road map to data on a disk
• Type of file system an OS uses determines how data is stored on the disk
• When you need to access a suspect’s computer to acquire or inspect data
• You should be familiar with both the computer’s OS and file systems

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
3
3
protected website for classroom use.
 Understanding the Boot Sequence (1 of 2)

• Complementary Metal Oxide Semiconductor (CMOS)

• Computer stores system configuration and date and time information in the CMOS
- When power to the system is off
• Basic Input/Output System (BIOS) or Extensible Firmware Interface (EFI)
• Contains programs that perform input and output at the hardware level
• Bootstrap process
• Contained in ROM, tells the computer how to proceed
• Displays the key or keys you press to open the CMOS setup screen
• CMOS should be modified to boot from a forensic floppy disk or CD

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
4
4
protected website for classroom use.
Understanding the Boot Sequence (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
5
5
protected website for classroom use.
 Understanding Disk Drives (1 of 4)

• Disk drives are made up of one or more platters coated with magnetic material
• Disk drive components
• Geometry
• Head
• Tracks
• Cylinders
• Sectors

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
6
6
protected website for classroom use.
Understanding Disk Drives (2 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
7
7
protected website for classroom use.
Understanding Disk Drives (3 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
8
8
protected website for classroom use.
 Understanding Disk Drives (4 of 4)

• Properties handled at the drive’s hardware or firmware level

• Zone bit recording (ZBR)
• Track density
• Areal density
• Head and cylinder skew

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
9
9
protected website for classroom use.
 Solid-State Storage Devices

• All flash memory devices have a feature called wear-leveling

• An internal firmware feature used in solid-state drives that ensures even wear of
read/writes for all memory cells
• When dealing with solid-state devices, making a full forensic copy as soon as
possible is crucial
• In case you need to recover data from unallocated disk space

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
10
10
protected website for classroom use.
 Exploring Microsoft File Structures

• In Microsoft file structures, sectors are grouped to form clusters

• Storage allocation units of one or more sectors
• Clusters range from 512 bytes up to 32,000 bytes each
• Combining sectors minimizes the overhead of writing or reading files to a disk
• Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT
• the First sector of all disks contains a system area, the boot record, and a file
structure database
• OS assigns these cluster numbers, called logical addresses
• Sector numbers are called physical addresses
• Clusters and their addresses are specific to a logical disk drive, which is a disk
partition

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
11
11
protected website for classroom use.
 Disk Partitions (1 of 2)

• A partition is a logical drive

• Windows OSs can have three primary partitions followed by an extended
partition that can contain one or more logical drives
• Hidden partitions or voids
• Large unused gaps between partitions on a disk
• Partition gap
• Unused space between partitions
• The partition table is in the Master Boot Record (MBR)
• Located at sector 0 of the disk drive
• In a hexadecimal editor, such as WinHex, you can find the first partition at offset
0x1BE
• The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
12
12
protected website for classroom use.
Disk Partitions (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
13
13
protected website for classroom use.
 Examining FAT Disks (1 of 7)

• File Allocation Table (FAT)

• File structure database that Microsoft originally designed for floppy disks
• FAT database is typically written to a disk’s outermost track and contains:
• Filenames, directory names, date and time stamps, the starting cluster number, and
file attributes
• Three current FAT versions
• FAT16, FAT32, and exFAT (used for mobile personal storage devices)
• Cluster sizes vary according to the hard disk size and file system

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
14
14
protected website for classroom use.
Examining FAT Disks (2 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
15
15
protected website for classroom use.
 Examining FAT Disks (3 of 7)

• Microsoft OSs allocate disk space for files by clusters

• Results in drive slack
- Unused space in a cluster between the end of an active file’s content and the end of
the cluster
• Drive slack includes:
• RAM slack and file slack
• An unintentional side effect of FAT16 allowing large clusters was that it reduced
fragmentation
• As cluster size increased

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
16
16
protected website for classroom use.
Examining FAT Disks (4 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
17
17
protected website for classroom use.
 Examining FAT Disks (5 of 7)

• When you run out of room for an allocated cluster

• OS allocates another cluster for your file
• As files grow and require more disk space, assigned clusters are chained
together
• The chain can be broken or fragmented
• When the OS stores data in a FAT file system, it assigns a starting cluster
position to a file
• Data for the file is written to the first sector of the first assigned cluster

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
18
18
protected website for classroom use.
Examining FAT Disks (6 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
19
19
protected website for classroom use.
 Examining FAT Disks (7 of 7)

• When this first assigned cluster is filled and runs out of room
• FAT assigns the next available cluster to the file
• If the next available cluster isn’t contiguous to the current cluster
• File becomes fragmented

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
20
20
protected website for classroom use.
 Deleting FAT Files

• In Microsoft OSs, when a file is deleted

• Directory entry is marked as a deleted file
- With the HEX E5 character replacing the first letter of the filename
- FAT chain for that file is set to 0
• Data in the file remains on the disk drive
• Area of the disk where the deleted file resides becomes unallocated disk space
• Available to receive new data from newly created files or other files needing more
space

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
21
21
protected website for classroom use.
 Examining NTFS Disks (1 of 3)

• NT File System (NTFS)

• Introduced with Windows NT
• Primary file system for Windows 10
• Improvements over FAT file systems
• NTFS provides more information about a file
• NTFS gives more control over files and folders
• NTFS was Microsoft’s move toward a journaling file system
• It records a transaction before the system carries it out

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
22
22
protected website for classroom use.
 Examining NTFS Disks (2 of 3)

• In NTFS, everything written to the disk is considered a file

• On an NTFS disk
• First data set is the Partition Boot Sector
• Next is Master File Table (MFT)
• NTFS results in much less file slack space
• Clusters are smaller for smaller disk drives
• NTFS also uses Unicode
• An international data format

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
23
23
protected website for classroom use.
Examining NTFS Disks (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
24
24
protected website for classroom use.
 MFT Structures for File Data

• For the header of all MFT records, the record fields of interest are as follows:
• At offset 0x00 - the MFT record identifier FILE
• At offset 0x1C to 0x1F - size of the MFT record
• At offset 0x14 - length of the header (indicates where the next attribute starts)
• At offset 0x32 and 0x33 - the update sequence array, which stores the last 2 bytes of
the first sector of the MFT record

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
25
25
protected website for classroom use.
 NTFS Alternate Data Streams (1 of 2)

• Alternate data streams

• Ways data can be appended to existing files
• Can obscure valuable evidentiary data, intentionally or by coincidence
• In NTFS, an alternate data stream becomes an additional file attribute
• Allows the file to be associated with different applications
• You can only tell whether a file has a data stream attached by examining that
file’s MFT entry

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
26
26
protected website for classroom use.
NTFS Alternate Data Streams (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
27
27
protected website for classroom use.
 NTFS Compressed Files

• NTFS provides compression similar to FAT DriveSpace 3 (a Windows 98

compression utility)
• With NTFS, files, folders, or entire volumes can be compressed
• Most computer forensics tools can uncompress and analyze compressed
Windows data

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
28
28
protected website for classroom use.
 NTFS Encrypting File System (EFS)

• Encrypting File System (EFS)

• Introduced with Windows 2000
• Implements a public key and private key method of encrypting files, folders, or disk
volumes
• When EFS is used in Windows 2000 and later
• A recovery certificate is generated and sent to the local Windows administrator
account
• Users can apply EFS to files stored on their local workstations or a remote
server

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
29
29
protected website for classroom use.
 EFS Recovery Key Agent

• Recovery Key Agent implements the recovery certificate

• Which is in the Windows administrator account
• Windows administrators can recover a key in two ways: through Windows or
from a command prompt
• Commands:
• cipher
• copy

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
30
30
protected website for classroom use.
 Deleting NTFS Files

• When a file is deleted in Windows NT and later

• The OS renames it and moves it to the Recycle Bin
• Can use the del (delete) MS-DOS command
• Eliminates the file from the MFT listing in the same way FAT does

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
31
31
protected website for classroom use.
 Resilient File System

• Resilient File System (ReFS) - designed to address very large data storage needs
• Such as the cloud
• Features incorporated into ReFS’s design:
• Maximized data availability
• Improved data integrity
• Designed for scalability
• ReFS uses disk structures similar to the MFT in NTFS

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
32
32
protected website for classroom use.
 Understanding Whole Disk Encryption (1
of 3)
• In recent years, there has been more concern about loss of
• Personal identity information (PII) and trade secrets caused by computer theft
• Of particular concern is the theft of laptop computers and handheld devices
• To help prevent loss of information, software vendors now provide whole disk
encryption

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
33
33
protected website for classroom use.
 Understanding Whole Disk Encryption (2
of 3)
• Current whole disk encryption tools offer the following features:
• Preboot authentication
• Full or partial disk encryption with secure hibernation
• Advanced encryption algorithms
• Key management function

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
34
34
protected website for classroom use.
 Understanding Whole Disk Encryption (3
of 3)
• Whole disk encryption tools encrypt each sector of a drive separately
• Many of these tools encrypt the drive’s boot sector
• To prevent any efforts to bypass the secured drive’s partition
• To examine an encrypted drive, decrypt it first
• Run a vendor-specific program to decrypt the drive
• Many vendors use a bootable CD or USB drive that prompts for a one-time
passphrase

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
35
35
protected website for classroom use.
 Examining Microsoft BitLocker

• Available Vista Enterprise/Ultimate, Windows 7, 8, and 10

Professional/Enterprise, and Server 2008 and later
• Hardware and software requirements
• A computer capable of running Windows Vista or later
• The TPM microchip, version 1.2 or newer
• A computer BIOS compliant with Trusted Computing Group (TCG)
• Two NTFS partitions
• The BIOS is configured so that the hard drive boots first before checking other
bootable peripherals

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
36
36
protected website for classroom use.
 Examining Third-Party Disk Encryption
Tools
• Some available third-party WDE utilities:
• Endpoint Encryption
• Voltage SecureFile
• Jetico BestCrypt Volume Encryption

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
37
37
protected website for classroom use.
 Understanding the Windows Registry

• Registry
• A database that stores hardware and software configuration information, network
connections, user preferences, and setup information
• To view the Registry, you can use:
• Regedit (Registry Editor) program for Windows 9x systems
• Regedt32 for Windows 2000, XP, and Vista
• Both utilities can be used for Windows 7 and 8

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
38
38
protected website for classroom use.
 Exploring the Organization of the Windows
Registry (1 of 5)
• Registry terminology:
• Registry
• Registry Editor
• HKEY
• Key
• Subkey
• Branch
• Value
• Default value
• Hives

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
39
39
protected website for classroom use.
Exploring the Organization of the Windows
Registry (2 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
40
40
protected website for classroom use.
Exploring the Organization of the Windows
Registry (3 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
41
41
protected website for classroom use.
Exploring the Organization of the Windows
Registry (4 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
42
42
protected website for classroom use.
Exploring the Organization of the Windows
Registry (5 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
43
43
protected website for classroom use.
 Examining the Windows Registry (1 of 2)

• Tools with built-in or add-on Registry viewers:

• X-Ways Forensics
• OSForensics
• Forensic Explorer
• FTK

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password- 44
protected website for classroom use.
Examining the Windows Registry (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password- 45
protected website for classroom use.
 Understanding Microsoft Startup Tasks

• Learn what files are accessed when Windows starts

• This information helps you determine when a suspect’s computer was last
accessed
• Important with computers that might have been used after an incident was reported

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
46
46
protected website for classroom use.
 Startup in Windows 7, Windows 8 and
Windows 10
• Windows 8 and 10 are multiplatform OSs
• Can run on desktops, laptops, tablets, and smartphones
• The boot process uses a boot configuration data (BCD) store
• The BCD contains the boot loader that initiates the system’s bootstrap process
• Press F8 or F12 when the system starts to access the Advanced Boot Options

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
47
47
protected website for classroom use.
 Startup in Windows NT and Later (1 of 5)

• All NTFS computers perform the following steps when the computer is turned
on:
• Power-on self test (POST)
• Initial startup
• Boot loader
• Hardware detection and configuration
• Kernel loading
• User logon

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
48
48
protected website for classroom use.
 Startup in Windows NT and Later (2 of 5)

• Startup Files for Windows Vista:

• The Ntldr program in Windows XP used to load the OS has been replaced with these
three boot utilities:
- [Link]
- [Link]
- [Link]
• Windows Vista includes the BCD editor for modifying boot options and updating the
BCD registry file
• The BCD store replaces the Windows XP [Link] file

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
49
49
protected website for classroom use.
 Startup in Windows NT and Later (3 of 5)

• Startup Files for Windows XP:

• NT Loader (NTLDR)
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• Device drivers
• Contain instructions for the OS for hardware devices

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
50
50
protected website for classroom use.
Startup in Windows NT and Later (4 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
51
51
protected website for classroom use.
 Startup in Windows NT and Later (5 of 5)

• Contamination Concerns with Windows XP

• When you start a Windows XP NTFS workstation, several files are accessed
immediately
- The last access date and time stamp for the files change to the current date and
time
• Destroys any potential evidence
- That shows when a Windows XP workstation was last used

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
52
52
protected website for classroom use.
 Understanding Virtual Machines (1 of 3)

• Virtual machines
• Enable you to run another OS on an existing physical computer (known as the host
computer) by emulating a computer’s hardware environment
• A virtual machine is just a few files on your hard drive
• Must allocate space to it
• A virtual machine recognizes components of the physical machine it’s loaded on
• Virtual OS is limited by the physical machine’s OS

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
53
53
protected website for classroom use.
Understanding Virtual Machines (2 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
54
54
protected website for classroom use.
 Understanding Virtual Machines (3 of 3)

• In digital forensics
• Virtual machines make it possible to restore a suspect drive on your virtual machine
- And run nonstandard software the suspect might have loaded
• From a network forensics standpoint, you need to be aware of some potential
issues, such as:
• A virtual machine used to attack another system or network

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
55
55
protected website for classroom use.
 Creating a Virtual Machine

• Common applications for creating virtual machines

• VMware Server, VMware Player and VMware Workstation, Oracle VM VirtualBox,
Microsoft Virtual PC, and Hyper-V
• Using VirtualBox
• An open-source program (download)
• Consult with your instructor before doing the activities using VirtualBox

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
56
56
protected website for classroom use.
 Summary (1 of 3)

• When starting a suspect’s computer, using boot media, such as forensic boot
CDs or USB drives, you must ensure that disk evidence isn’t altered
• The Master Boot Record (MBR) stores information about partitions on a disk
• Microsoft used FAT12 and FAT16 on older operating systems
• To find a hard disk’s capacity, use the cylinders, heads, and sectors (CHS)
calculation

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
57
57
protected website for classroom use.
 Summary (2 of 3)

• When files are deleted in a FAT file system, the hexadecimal value 0x05 is
inserted in the first character of the filename in the directory
• NTFS is more versatile because it uses the Master File Table (MFT) to track file
information
• Records in the MFT contain attribute IDs that store metadata about files
• In NTFS, alternate data streams can obscure information that might be of
evidentiary value

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
58
58
protected website for classroom use.
 Summary (3 of 3)

• File slack, RAM slack, and drive slack are areas in which valuable information
can reside on a drive
• NTFS can encrypt data with EFS and BitLocker
• NTFS can compress files, folders, or volumes
• Windows Registry keeps a record of attached hardware, user preferences,
network connections, and installed software
• Virtualization software enables you to run other OSs on a host computer

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
59
59
protected website for classroom use.