Forensic Analysis of File Systems and Operating Systems
Reading the operating system as a silent witness
Every operating system keeps internal records that passively document almost everything that happens on a device, from which programs ran and when to which USB devices were connected or which files were recently accessed, information the user rarely knows exists. Forensic analysis of file systems and operating systems consists precisely of interpreting those artifacts, such as the Windows registry, system log files, NTFS file system metadata or journals on Linux systems, to reconstruct a detailed timeline of activity. In practice, this timeline reconstruction is usually the backbone of an investigation, because it makes it possible to correlate multiple seemingly unconnected events, such as connecting an external device followed minutes later by the mass copying of confidential files. Mastering the particularities of each operating system is essential because the available artifacts and their format vary enormously between Windows, macOS and Linux.