Updated filesystem cheat sheets

26 Aug 2012

At PFIC last year I ran a workshop on the analysis of NTFS and handed out some cheat sheets I made for examining NTFS in a hex editor. I have been using these cheat sheets for ages and over the weekend finally got around to updating the partition table and FAT ones. They are available here:

FAT
MBR & GPT
NTFS

Of course I still have to make them for HFS and ext but I will get there one day.

If you have any suggestions for improvements please let me know.

-----------------------

More from this section

Filegen - file generator for tool testing

One of my students is currently researching data recovery on solid state drives. Part of the

12 Apr 2013

Resources for learning python for forensics

This is just a small collection of some of the resources that are available if you are interested in learning python. It is not intended to be a comprehensive list of everything available, just enough to get you started. They are not listed in any particular order although I may have saved the best till last ;-)

11 Apr 2013

Updated filesystem cheat sheets

At PFIC last year I ran a workshop on the analysis of NTFS and handed out some cheat sheets I made for examining NTFS in a hex editor. I have been using these cheat sheets for ages and over

26 Aug 2012

4096 byte sector drives, NTFS and forensic tools

One of the topics that came up during Kevin Ripa's DFIROnline presentation was the concept of 4k sectors, or really sectors larger than 512 bytes. I have been aware of these

24 May 2012

New Website and a new resource

I have transferred to a new hosting provider and made a few upgrades to the website. The most

1 Mar 2012

DFIROnline Meetup review

Well the DFIROnline meetup went well tonight. The turn-up tripled from the first event, we had a max of 97 attendees at one point. Harlan and Eric both gave a couple of great presentations,

17 Jan 2012

Free non-forensic windows programs for forensics and thanks.

Over the past couple of days Harlan has been talking about people contributing to the DFIR

27 Dec 2011

The beauty of forms

I recently read the book the “Checklist Manifesto” by Atul Gawande In the book Atul describes how by creating and using checklists of common tasks that should be performed before, during and

10 Nov 2011

PFIC

I have spent the past few days at the PFIC conference in Utah, it was a blast, except for the

8 Nov 2011

What makes a good forensicator? or how to get a job in Digital Forensics

A common question those seeking to enter the field of digital forensics ask is what do I need to

4 Nov 2011