A Practical Guide to Digital Forensics Investigations, 2nd Edition

Chapter 2

Windows Operating and File Systems

Learning Outcomes

After reading this chapter, you will be able to understand the following:

• Explain what an operating system does;

• Explain binary, decimal, and hexadecimal and how to convert from each notation;

• The physical structure of a hard drive and how files are stored and retrieved;

• The boot process;

• Windows file systems; and

• The different features of each Windows operating system and their implications for investigators.

A strong foundation in operating systems is an important building block to becoming a highly effective computer forensics investigator. The evidence that computer forensics investigators work with are files. The organization of these files, the data they contain, and their ...