Chapter 3

Disk and File System Analysis

Information in this Chapter

Media Analysis Concepts

At its most basic, forensic analysis deals with files on media—deleted files, files in folders, files in other files, all stored on or in some container. The goal of media analysis is to identify, extract, and analyze these files and the file systems they lie upon. Identification includes determining which active and deleted files are available in a volume. Extraction is the retrieval of relevant file data and metadata. Analysis is the process in which we apply our intelligence to the data set and ideally come up with meaningful ...

Get Digital Forensics with Open Source Tools now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.