Disks, Partitions and File Systems

Summary

To understand file systems it is necessary to understand the physical and logical structures in which they reside. This chapter introduces the physical storage technologies that might be encountered during investigation and also the logical containers, called partitions, in which file systems are generally found. This chapter also introduces the reader to the most common partition table structures, master boot record (MBR) and GUID Partition Table (GPT), which are used to describe the layout of partitions on disk. The chapter also introduces a number of general file system concepts and compares the file systems in this book in terms of their features and storage capacity. This chapter concludes with an introduction to the Sleuth Kit, a set of command line tools available for all major operating systems which perform file system forensics. For those file systems supported by Sleuth Kit, the tool is used to validate the results of the manual analysis conducted in the text.