NTFS file system explained: understanding resident and non-resident files - Computer forensics

The goal of the Computer forensics course is to teach you how to collect evidence in case of an incident and to investigate how the intruders came in, what data they have stolen, if they have harmed your system.
In addition we will give you advice on what you can do to block the next attack.

The Computer forensics course will cover:
- Recovering NTFS file system and looking for evidence
- Recovering FAT16 and FAT32 file system
- Acquiring saved passwords from the password managers of browsers
- Browser history and cache file recovery to investigate the users’ internet usage
- Getting the content (e.g. emails, contacts) from an encrypted Outlook PST file
- Recovery of Exchange MDB, Active Directory NTDS.DIT and similar files
- ZIP file recovery
- RAM analysis of Windows and Linux servers with Volatility

IN THIS TUTORIAL of the Computer forensics course you will learn the inner workings of the NTFS file system to be able to recover files and look for evidence later.
For this we will cover:
01:21 Role of the resident files and how to retrieve them
24:36 Non-resident files in NTFS and their role in the file system

Please note that this computer forensics tutorial is for educational purposes only.

SUBSCRIBE NOW FOR NEW FREE IT TUTORIALS!

SUBSCRIBE TO OUR EMAIL LIST!

FOLLOW US!

----------------------------------------------------------------------------------------------------------

[DrJams]

An explanation right down to the byte level.
Pretty much nothing more to learn once one understands it at this level.

[TotalTech.]

How would you do a run list if the data was fragmented? How would it be different?

[TotalTech.]

Hello again. If a partition table was zeroed out is there any tool that I could use to recover it. What I mean by this is not just the files but a tool which will rebuild the partition table and link the clusters?

[tasgbee]

I am wondering, where did value 0x23 came from? I have checked on my NTFS partition and it is indeed true thah you have to add (0x23 * 0x400) to MFT starting offset to get first user files entries. But why is it 0x23 and also why other sources claim its 16?

[TotalTech.]

Is it really necessary to understand Unix and Command Prompt for computer forensics. Would a tool like Encase or FTK work just as good?

[KnockedDownBySound]

Thank You very much for your video. Would you be so kind to explain how to parse information about directory content? For example: how to list it?

[TotalTech.]

If the disk was partitioned would every partition contain its own Boot Sector and $MFT record regardless of whether the partition was actually bootable or not i.e. (just used for storage)?

[abhijitsingh]

very informative video... (thumbsup) for the hard-work.
If any handouts are available, will definitely help

[WhatTheHeckTV]

I have the ntfs-file-sys and only have access to the bios, any help

[MAcreator]

Hello, im interested in Computer forensics course.
Where can I get complete course?

[rickmonarch]

De ennék egy zsíros kenyeret xd fuck éhes lettem....