Title: 1. Understanding File Systems
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Understanding File Systems

1. The file system gives an OS a road map to data on a disk.  The type of file system an OS uses determines how data is stored on the disk.  A file system is usually directly related to an OS.
2. When you need to access a suspect’s computer to acquire or inspect data, you should be familiar with the computer’s platform.

Understanding the Boot Sequence

1. To ensure that you don’t contaminate or alter data on a suspect’s Windows or DOS PC, you must know how to access and modify a PC’s Complementary Metal Oxide Semiconductor (CMOS) and Basic Input/Output System (BIOS) settings.
2. A computer stores system configuration and date and time information in the CMOS when power to the system is off.  The Basic Input/Output System (BIOS) contains programs that perform input and output at the hardware level.
3. The bootstrap process is contained in ROM and tells the computer how to proceed when booting. It displays the key or keys you press to open the CMOS setup screen.  The CMOS should be modified if you want to boot from a forensic floppy disk or CD. See Figure 6-1.

Understanding Disk Drives

1. Disk drives are made up of one or more platters coated with magnetic material.
2. Figures 6-2 and 6-3 to describe some of the disk drive components, including:
  - Geometry
  - Head
  - Tracks
  - Cylinders
  - Sectors
3. Some of the properties handled at the drive’s hardware or firmware level, including:
  - Zoned bit recording (ZBR)
  - Track density
  - Areal density
  - Head and cylinder skew