File systems at a glance

Almost every question an examiner answers about a computer, a phone or a memory card passes through its file system. The file system decides where data is stored, what it is called, when it changed and what happens when it is deleted. This lesson explains what a file system does, the ones you will meet most often, the structures that matter for evidence, and why deleted data can often still be found. Timestamps get their own lesson (Lesson 6.2), and the traces left by programs and users are covered in Lesson 6.3.

What a file system does

A storage device is a long row of numbered sectors, usually 512 or 4,096 bytes each. On its own it has no files or folders. A file system organizes that space and keeps track of four things:

• Names and folders: the hierarchy a user sees, such as Documents\Invoices\march.xlsx.
• Metadata: facts about each file, such as its size, timestamps, owner and permissions.
• Allocation: which parts of the disk hold each file's content.
• Free space: which parts of the disk are available for new data.

Space is handed out in clusters (Windows) or blocks (Linux and macOS): groups of sectors that are the smallest unit a file can occupy, often 4 KiB. A file of 10 KiB therefore occupies three 4 KiB clusters, and the unused part of the last one becomes important evidence, as explained below.

Partitions and volumes

Before there is a file system, a disk is divided into partitions, described by a partition table at the start of the disk.

• MBR (Master Boot Record), the older scheme, allows four primary partitions and, with 512-byte sectors, disks of up to 2 TiB.
• GPT (GUID Partition Table), used by modern computers that start with UEFI, supports much larger disks and many partitions, and keeps a backup copy of the table at the end of the disk.

A volume is a partition, or a set of them, that holds a file system. A single laptop disk commonly contains several: a small boot partition, a recovery partition and the main volume. A physical image (Module 4) captures all of them, including space between partitions that belongs to none.

The file systems you will meet

Older Macs and some external drives use HFS+, the predecessor of APFS. Recognizing the file system early matters, because it determines which tools can read the volume, how deleted data behaves and how timestamps must be interpreted.

Inside NTFS and FAT

NTFS: the Master File Table

NTFS keeps a Master File Table (MFT), a special file containing one record, usually 1 KiB, for every file and folder on the volume. Each record holds attributes, among them $STANDARD_INFORMATION (timestamps and flags), $FILE_NAME (the name, the parent folder and another set of timestamps) and $DATA (the content). Very small files can be stored entirely inside their MFT record, which is called resident data; larger files have their content in clusters elsewhere, and the record lists where. NTFS also keeps journals of recent changes, such as $LogFile and the $UsnJrnl change journal, which examiner-level work uses to reconstruct activity.

FAT: directory entries and the allocation table

FAT stores each file's name, size, timestamps and starting cluster in a directory entry inside its parent folder. The File Allocation Table itself is a list with one entry per cluster, chaining each cluster of a file to the next one. The structure is simple, which makes FAT easy to read on almost any device and easy to examine by hand.

Allocated, unallocated and slack space

• Allocated space belongs to current files and is what a user, or a logical copy, sees.
• Unallocated space is marked as free. It is not necessarily empty: it often holds the content of deleted files and fragments of older data.
• File slack is the unused space between the end of a file and the end of its last cluster. It may contain remnants of whatever previously occupied that cluster.

Only a physical or volume image (Module 4) preserves unallocated space and slack, which is one reason examiners prefer them when deleted data may matter.

What deletion really does

Deleting a file in Windows Explorer or the macOS Finder normally moves it to the Recycle Bin or the Trash, which is just another folder. Emptying it, or deleting directly, changes the file system's records rather than the content:

• In NTFS, the MFT record is marked as not in use and the file's clusters are marked as free. The content stays where it was until new data overwrites it, and the MFT record itself may survive for a while.
• In FAT, the first character of the name in the directory entry is replaced with the byte E5 (hexadecimal) and the file's cluster chain in the allocation table is cleared. The content usually remains, but finding all the pieces of a fragmented file becomes harder.

Deleted data can therefore often be recovered on hard drives and memory cards. On solid-state drives, TRIM (Module 1) may cause the drive to erase freed blocks soon after deletion, so the absence of deleted data on an SSD is expected rather than suspicious.

File carving

When the file system records are gone, content can still be found by carving: scanning raw data, usually unallocated space, for the known signatures that mark the start and end of file types. A JPEG image begins with the bytes FF D8 FF and ends with FF D9; a PDF begins with the text %PDF; DOCX and XLSX files are ZIP archives, which begin with the letters PK. Carved files have no original name, folder or file system timestamps, and fragmented files may come out incomplete or mixed with other data, so carving results must be checked and reported for what they are.

A worked example

A memory card from a photographer's camera is formatted exFAT. The owner says she deleted a set of photos weeks ago and has taken many pictures since. The examiner images the card through a write blocker and finds the remaining directory entries for some deleted files, with names and sizes; carving the unallocated space recovers dozens of further JPEGs without names. Some carved images are partly gray where their clusters were overwritten by newer photos. The report separates photos recovered with their file system metadata from carved photos, and states that the dates of carved photos can only come from data inside the images themselves.

Exam focus: Know what a file system tracks (names, metadata, allocation, free space), clusters and blocks, MBR versus GPT, and where NTFS, FAT32, exFAT, ext4 and APFS are used. Know the NTFS Master File Table and resident data, FAT directory entries and the allocation table, and the difference between allocated space, unallocated space and file slack. Expect questions on what deletion changes in NTFS and FAT, why SSDs often keep no deleted data, and what carving can and cannot recover.