Title: Working with Windows and DOS Systems
Course: CAP 2140 Digital Forensics > Section: Working with Windows and DOS Systems

Introduction

To become proficient in recovering data for computer investigations, one has to learn how data is stored and managed on Microsoft OSs. A later module will examine other OSs.

Objectives

At the end of this module the student will be able to:

- Explain the purpose and structure of file systems
- Describe Microsoft file structures
- Explain the structure of New Technology File System (NTFS) disks
- List some options for decrypting drives encrypted with whole disk encryption
- Explain how the Windows Registry works
- Describe Microsoft startup tasks
- Describe MS-DOS startup tasks
- Explain the purpose of a virtual machine

Readings and Resources

- Textbook: Chapter 6 pg. 197-251
- File system: http://en.wikipedia.org/wiki/File_system
- Master boot record: http://en.wikipedia.org/wiki/Master_boot_record