The Windows
NT file system (NTFS) provides a combination of performance, reliability, and
compatibility not found in the FAT file system. It is designed to quickly
perform standard file operations such as read, write, and search - and even
advanced operations such as file-system recovery - on very large hard disks.
This PDF covers the following topics related to The Windows NT file system :
NTFS Partition Boot Sector, NTFS Master File Table (MFT), NTFS File Types, NTFS
File Attributes, NTFS System Files, NTFS Multiple Data Streams, NTFS Compressed
Files, NTFS & EFS Encrypted Files, NTFS Sparse Files, NTFS Data Integrity and
Recoverability.
The file system on any storage device is essential to the overall
organization, storage mechanisms, and data control of the device. Knowing how
these file systems work and the layout of key structures, storage mechanisms,
associated metadata, and file system characteristics is essential to being able
to forensically investigate a computer or other device. The New Technology File
System (NTFS) and File Allocation Table (FAT32) are two key file systems that
will be compared and contrasted, since both are still actively used and
encountered often. Both systems offer forensic evidence that is significant and
mandatory in an investigation. This PDF covers the following topics related to
Windows NFTS and FAT32 File System : Abstract, Introduction, Results and
Discussion, Conclusions, Future Research, Figures.