Filesystem Analysis and Data Recovery. Although there are many automated and commercial tools available nowadays, understanding how these tools perform can distinguish one from another, and this can provide great support during expert testimony in the courtroom. Filesystem analysis and data recovery are considered as the main categories in the digital forensics process.Extracting files from a storage device or recovering deleted ones with evidential related data can solve a case. For this research, you will go through two different filesystems: the FAT and the NTFS. You will basically explain how the files are structured in each one and how the recovery process of deleted files actually works. You will start with the famous TSK or The Sleuth Kit and how its command line tools are categorized, as they are based on each layer in the hard drive or the forensic image. After this, we will discuss Autopsy, the TSK graphical user interface. At the end of this chapter, you will need to show your foremost of these, which is the Linux-based file carving tool that is used to recover files based on their signature.
