FOR220 - Windows Storage Architecture Overview
Understanding how files are stored (and may be hidden) on a disk or other storage media (solid-state disk, USB "key", SD card, etc.), is essential to performing a thorough forensic investigation. Learn the essentials of the on-disk formats of NTFS, EFS, FAT 12/16/32, exFAT, CDFS, and UDFS. This seminar also covers details of partitioning methods (MBR vs. GPT), the various types of Windows "volumes," basic vs. dynamic disks, and the new Storage Spaces.
Cyber forensics investigators
FOR111: Data Storage and Recovery Methods, or equivalent Windows experience
|Operating systems supported:||All Windows versions|
|Durations and formats:||1 day with labs|