Chapter 2

Windows Operating and File Systems

Learning Outcomes

After reading this chapter, you will be able to understand the following:

  • Explain what an operating system does;

  • Explain binary, decimal, and hexadecimal and how to convert from each notation;

  • The physical structure of a hard drive and how files are stored and retrieved;

  • The boot process;

  • Windows file systems; and

  • The different features of each Windows operating system and their implications for investigators.

A strong foundation in operating systems is an important building block to becoming a highly effective computer forensics investigator. The evidence that computer forensics investigators work with are files. The organization of these files, the data they contain, and their ...

Get A Practical Guide to Digital Forensics Investigations, 2nd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.