Computer Forensics - Computer Engineering

Computer Forensics - Computer Engineering

Computer Forensics NTFS File System MBR and GPT Disks MBR disks for 32b 86x-compatibles GPT disks for 64b Itanium processors

Start with a MBR in order to maintain compatibility MBR has a single partition with a partition table entry of 0xEE NTFS Architecture NTFS Architecture

NTFS Boot Sector NTFS Boot Sector 0x00 3B 0x03 8B

0x0B 25B 0x24 48B 0x54 426B 0x1FE 2B Marker Jump Instruction OEM ID BPB Extended BPB Bootstrap Code. End of Sector

NTSF Boot Sector NTSF Boot Sector Many fields are not important, but:

0x0B, 0x0D 0x15 0x28 0x30 0x38 0x40 0x48

Bytes per sector. Sectors per Cluster Media descriptor. F8: HD; F0: HD Floppy Total sectors. Logical cluster number for the MFT Logical cluster number copy of the MFT Clusters per MFT Record. Volume serial NTFS BPB

8 sectors per cluster Total number of sectors 0x94EAFF7 MFT starts at 0xC7E9 = 819177 LBA within partition, add 80,325 to find physical address NTFS Master File Table

First four entries are replicated, so that MFT can be repaired First 16 records are reserved for metadata files, their name begins with a dollar sign ($) NTFS Master File Table 1. 2.

3. 4. 5. 6. 7. 8. 9. 10. 11. Master file table $MFT. Master file table mirror $MftMirr.

Log file $LogFile. Volume $Volume Attribute definitions $AttrDef. The root folder . Cluster bitmap $Bitmap Boot sector $Boot, Bad cluster file $BadClus Security file $Secure Upcase table $Upcase NTFS extension file $Extend, that is used for future use. MFT Records

Entries are 1KB each Entries contain File Attributes Location Data MFT Records

Small Files (<900B) are contained completely in the MFT entry. MFT Records

Folders contain index data. Small folders reside within the MFT record Larger folders have an index structure to other data blocks. They use a B-tree structure. NTFS Versions

File system improves. Disk Layout changes.

Recently Viewed Presentations

  • Back Pain - yorkgpvts.co.uk

    Back Pain - yorkgpvts.co.uk

    Patients with degenerative neck or back pain generally have no surgically remedial cause and so should not be referred. Patients should be managed with analgesia, advice and physiotherapy. Patients with non-specific neurological symptoms/somatisation disorder. Such patients should be referred to...
  • Methamphetamine and Crack Cocaine Scheduled Sunday 02/14/10 1 ...

    Methamphetamine and Crack Cocaine Scheduled Sunday 02/14/10 1 ...

    Alex Stalcup is a graduate of Whittier College and a graduate of the University of California, San Francisco, School of Medicine. He is Board Certified in Pediatrics, and in Addiction Medicine. He is certified as a Medical Review Officer by...
  • PLGR - WordPress.com

    PLGR - WordPress.com

    (DAGR) PLGR DAGR DATUM Abbreviation or Code (w/ DATUM Name) Automatic Off Time Limit - the amount of time the PLGR stays on after a position fix is obtained. Used to save battery power. only enabled when battery power is...
  • The Structure of a LinkedIn Profile - SACM

    The Structure of a LinkedIn Profile - SACM

    Add multi-media to your profile. Profile Tips. Add photos, Slideshare or video to showcase your or your company's work. Let's talk about your summary- a summary should include 4 areas - what you do, why you love what you do,...
  • SPIEGEL SOHMER INC. - RBC Wealth Management

    SPIEGEL SOHMER INC. - RBC Wealth Management

    [31] De la même manière que la personnalité juridique distincte d'une corporation ne peut être invoquée pour masquer une contravention à une règle intéressant l'ordre public, le patrimoine distinct de la fiducie ne peut lui non plus servir à contourner...
  • 19th- and 20th-Century Detective Fiction

    19th- and 20th-Century Detective Fiction

    The Moonstone . first appeared in . All the Year Round. It was later published as a three-volume novel by Tinsley. Collins never married, but lived with a widow, Caroline Graves, and also had three children with Martha Rudd, whom...
  • Donald Bren School of Information and Computer Sciences

    Donald Bren School of Information and Computer Sciences

    ICS faculty are involved in undergraduate recruitment, workshops about grad school, mentoring and research. The size of our undergraduate student body (~850) means that most students will experience upper-division courses that are sized to allow for more opportunity for faculty/student...
  • La molecola dellacqua L'acqua  un liquido le cui

    La molecola dellacqua L'acqua un liquido le cui

    L'acqua risulta bluperché quando la luce del sole, che contiene tutti i colori, vi penetra, alcuni colori vengono assorbiti dalle sue molecole, in particolare esse assimilano maggiormente i colori arancione e rosso, quindi quando la luce arriva ai nostri occhi...