Operating systems continuously record file lifecycle activity beneath the graphical user interface. By analyzing raw binary structures within physical disk sectors and allocation clusters, a digital forensic examiner can reconstruct deleted files, reveal manipulated timestamps, prove unauthorized data transfers, and trace file execution to the millisecond. This comprehensive, lab-driven masterclass delivers an exhaustive investigation of file system internals across enterprise and embedded storage platforms. Students dissect the fundamental architectural mechanics of Windows, Linux, and Apple storage: parsing 1024-byte NTFS Master File Table ($MFT) records, data runs, $LogFile transactions, and change journals ($UsnJrnl); deconstructing Linux EXT2/3/4 superblocks, Block Group Descriptors, inode tables, and 48-bit extent trees; exploring Apple APFS container geometry, Object Maps, and Copy-on-Write snapshots; and mastering FAT12/16/32 and exFAT allocation bitmaps. Beyond structural parsing, examiners develop court-defensible skills in manual hex file carving, slack space recovery, Alternate Data Stream (ADS) discovery, timestomping detection, RAID array reassembly, and full-disk encryption forensics (BitLocker, FileVault, VeraCrypt, LUKS).
Advanced File System Forensics: NTFS $MFT, EXT4 Inodes, APFS & Deep File Carving
22 modules · self-paced learning
Curriculum
22 modules · 265 lessons
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 13 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Enroll in the course to access this module’s 12 lessons.
Begin your learning journey with structured modules, practical exercises, and self-paced progress tracking.
Tell us what you are working on and our team will get back to you.
We will only use your details to respond to this enquiry.