File Systems & Artifact Examination Flashcards

What is the role of a file system in digital storage?

Answer: Manages and organizes files

A file system is a method and data structure that an operating system uses to control how data is stored and retrieved on a storage device. It organizes files and directories, tracks their locations, manages access permissions, and ensures efficient storage and retrieval of information, making it fundamental to digital storage.

Which file systems are commonly examined in forensic cases?

Answer: NTFS, FAT32, exFAT

NTFS, FAT32, and exFAT are common file systems encountered in digital forensic investigations because they are widely used across various operating systems and storage devices. NTFS is prevalent in Windows, FAT32 is common on older systems and removable media, and exFAT is often used for larger removable storage, each requiring specific forensic analysis techniques.

What are file system artifacts?

Answer: Metadata and system records

File system artifacts are remnants or records left behind by operating system activities and user actions on a storage device. These include crucial metadata, such as file creation/modification times, sizes, and permissions, as well as various system records like journal files and registry entries. They are invaluable in forensic investigations, providing contextual information about system usage and user behavior.

What does the Master File Table (MFT) store?

Answer: File metadata in NTFS

The Master File Table (MFT) is a fundamental component of the NTFS file system, primarily used by Windows operating systems. It functions as a comprehensive database that stores critical metadata for every file and directory on the volume. This metadata encompasses essential details like file names, sizes, timestamps, security attributes, and the physical location of the file's data on the disk.

What is slack space in a file system?

Answer: Unallocated leftover data

Slack space refers to the unused portion of a disk cluster that remains after a file has been written to it. Since files rarely perfectly fill an entire cluster, the leftover space is termed 'slack.' This area can contain residual data from previously stored files or system processes, making it a significant source of potential forensic evidence for investigators.

How are deleted files identified in EnCase?

Answer: Unallocated space analysis

When a file is 'deleted' from a file system, its data is not immediately erased; instead, the operating system simply marks the space it occupied as 'unallocated' and available for new data. EnCase identifies these deleted files by meticulously analyzing this unallocated space. It searches for file signatures and remnants that indicate previously existing data, allowing investigators to recover or reconstruct files before they are overwritten.

What is a Volume Shadow Copy?

Answer: System snapshot backup

A Volume Shadow Copy (VSC) is a Microsoft Windows technology that creates snapshots of files or entire volumes, even while they are actively in use. These snapshots capture the state of the file system at a specific point in time, enabling users to recover previous versions of files or restore system states. In digital forensics, VSCs are invaluable for accessing historical data, including deleted files, and understanding past system configurations.

Which artifact reveals recent USB activity?

Answer: Registry entries

When a USB device is connected to a Windows computer, the operating system automatically creates and updates specific entries within the Windows Registry. These registry keys store vital information such as the device's vendor and product IDs, serial number, connection timestamps, and the user account that initiated the connection. Analyzing these registry entries is a primary method for forensic examiners to determine if and when a particular USB device was connected to a system.

How can time stamps be manipulated?

Answer: Use timestamp editing tools

Timestamps, which record file creation, modification, and access times, are critical metadata in digital forensics. These values can be deliberately altered using specialized timestamp editing tools, potentially to obscure malicious activity or create a misleading timeline. Forensic examiners must be aware of this possibility and employ techniques to detect such manipulation, as it can significantly impact an investigation.