Computer Security, Forensics and Ethical Hacking
Discussion Forum: File System
The purpose of a file system in an operation system and explain why it is possible to recover a deleted file.
File system is a method for storing and organizing data content in/on a given medium.The most common application of the term file system in computer forensics usually refers to the organizational structure of electronic computer data stored on computer media such as hard/floppy/optical disks, thumb drives, and so on.A large number of file systems exist.A forensic examiner will want to be prepared to work on as many different file systems as possible:An examiner will need access to multiple operating systems, multiple hardware devices, and various software applications to attack a broad scope of file systems.
Different operating systems support different file systems, to examine file systems of certain types, it may be necessary to have a compatible operating system available.
It is possible to recover a deleted file? The EnCase Program allows to recover the entire physical file, which includes the deleted files as well as slack space. Slack space is the unused portion of a cluster on a disk. Valuable data and remnants can often reside in slack space.