Title: Module 6 Objectives and Activities List
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Learning Objectives

By successfully completing this module, the student will be able to:

- Explain the purpose and structure of file systems
- Describe Microsoft file structures
- Explain the structure of New Technology File System (NTFS) disks
- List some options for decrypting drives encrypted with whole disk encryption
- Explain how the Windows Registry works
- Describe Microsoft startup tasks
- Describe MS-DOS startup tasks
- Explain the purpose of a virtual machine

Learning Activities

- Read Chapter 6
- Read Instructor notes

This chapter reviews how data is stored and managed on Microsoft operating systems (OSs).  To become proficient in recovering data for computer investigations, you should understand file systems and their OSs, including legacy (MS-DOS, Windows 9x and Windows Me, for example) and current OSs, such as Windows 2000, XP and Vista.  In this chapter, you examine the tasks an OS performs when it starts so that you can avoid altering evidence when you examine data on a drive.  You also learn how to use a Virtual PC environment to further analyze Windows digital evidence.

Assessment Activities

- Complete Discussion 6
- Complete Quiz 6
- Complete Chapter 6: Hands on Projects 6-3