O'Reilly logo

Operating System Forensics by Ric Messier

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 3

Data and File Recovery

Abstract

Investigation of the different types of data that may be stored in the file system, including locating files is strictly based on the header and footer values. Other locations for storing data both within and outside of the file system are covered.

Keywords

operating systems
forensics
operating environments

INFORMATION INCLUDED IN THIS CHAPTER:

Data carving
Slack space
Searching for data
Data hiding

Introduction

Once you understand the layout of the file systems you are working on, you can better understand how to go about retrieving information from the disk. There are a number of reasons you may need to go digging. One of the reasons is because someone may have deleted a file and it may not clearly ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required