File Allocation and Tracking in NTFS

Most major forensic software suites will reassemble fragmented files with ease. However, there may be the occasion when an important file cannot be reassembled automatically and requires manual reassembly. Digital forensic practitioners must have a fundamental understanding of the fragmentation process in various file systems and how to reassemble a fragmented file. During this course you will review an instructional presentation and engage in a hands-on lab exercise to understand how data are allocated and tracked in the New Technology File System (NTFS).

Modules:

• File Allocation and Tracking in NTFS

Who Should Take This Course:

Cybersecurity professionals who wish to learn the fundamentals of image file forensics through a hands-on virtual lab environment.

About This Course:

Throughout this two-hour virtual lab course, you will experience audio guided presentations, knowledge checks, a virtual lab exercise and a final assessment. Course content is intended to be accessed in order and is sequenced to enhance learning. Unless otherwise noted, you should navigate the content by first reading, listening, or watching, then answering the knowledge check questions to ensure understanding. At the end of the course, you will be asked to take a final assessment and must score 70% or higher prior to receiving a certificate of completion and earning continuing professional education (CPE) credits.