Digital Forensics : Files System

Running head: DIGITAL FORENSICS
DIGITAL FORENSICS
Name of the Student
Name of the University
Author Note

1DIGITAL FORENSICS
Discussions
A file system analysis is done after the data collection and the data acquisition is
done. It is executed after the data has been stored in specific files after they have been
retrieved from the various digital devices. I have learnt that a system of files in a computer is
a manner by which the files are named and then are placed logically in order to store and
retrieve. It can be considered to be as a database and can be called as an index on the storage
devices such as hard disk, CD, DVD and many more (Hilgert, Lambertz and Plohmann
2017). I have learnt that there are various types of file systems those are stored. It includes
FAT file systems, FAT 32 file systems, and NTFS file systems and Ext file systems. I have
known that there are various types of files. These include document files, images, executable
files; excel files, PowerPoint files, web page files and many more. These files are generally
stored in the file systems and from these files; the investigators retrieve the data in order to
investigate the crime. I have learnt that there are various steps in the file system analysis.
These steps include acquisition, validation and discrimination and lastly extraction. I have
studied that acquisition means the investigators retrieve the data from the various digital
devices those are recovered from the crime scene. These are done in four ways as studied by
me. These include disk-to-image, disk-to-disk, logical and sparse (Wani and Bhat 2018).
Next, i have learnt about the validation and discrimination step. The investigators must
validate the image before they analyse it as it make sure the data integrity. I have known that
the investigators use hashing algorithms in order to decide if a forensic image is a precise
image of the original disk or volume. This validates the honesty of the evidence and it can
provided in front of the court of law. The last step is the extraction. I have learned that are
various types of data those are stored like unstructured and deleted data. It is the most
important procedure of file system analysis and I have always known that when a data is
deleted forever but after studying digital forensics i have learnt that after deletion some of the