Mastering Windows Network Forensics and Investigation, 2nd Edition

Filesystems vs. Operating Systems

It is important when conducting network investigations to understand the operating systems involved as well as the filesystems used by those operating systems; both significantly impact the investigation. It is just as important that you understand the differences between an operating system and a filesystem because they are distinct entities.

The operating system is responsible for the basic tasks of the computer’s function such as input (mouse, keyboard, and so on), output (display, printing, and so on), control of peripheral devices (disk drives, scanners, and so on), system security (authentication of users, controlling access to objects, and so on), and keeping track of files and directories on available ...