Chapter 3
Data and File Recovery
Abstract
Investigation of the different types of data that may be stored in the file system, including locating files is strictly based on the header and footer values. Other locations for storing data both within and outside of the file system are covered.
Keywords
operating systems
forensics
operating environments
INFORMATION INCLUDED IN THIS CHAPTER:
• Data carving
• Slack space
• Searching for data
• Data hiding
Introduction
Once you understand the layout of the file systems you are working on, you can better understand how to go about retrieving information from the disk. There are a number of reasons you may need to go digging. One of the reasons is because someone may have deleted a file and it may not clearly ...
Get Operating System Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
