File Systems—NTFS and Beyond
Albert J. Marcella, Frederic Guillossou · 2012
Various filing systems and their components may have different names and their physical placement on the drive may vary, but functionally all file systems require similar pieces: those that identify it, those that identify its data, and those that contain the data itself. This chapter examines file systems, focusing on file systems beyond FAT, which are those most likely to be encountered by the cyber forensic investigator. An important concept in understanding the new technology file system (NTFS) design is that all data is allocated to files, including the file system itself; the file system files can be located anywhere in the volume, as would a regular file. Therefore, NTFS does not have a normal file system layout like FAT where there are areas at the beginning of the volume reserved for these data.