Lab 1: Introduction to File Systems

What does a wipe do?

A wipe will erase all of the 0's and 1's written to the hard disk.

What are some of the most common Linux file systems?

EXT2, EXT3, EXT4 and ReiserFS (EXT3, EXT4 and ResierFS are all journaling file systems)

Which EXT is used for journaling?

EXT3 and EXT4 are journaling file systems. EXT2 does not have journaling.

What are the versions of FAT?

FAT12, FAT16, FAT32, exFAT and FATx (XBOX)

What does FAT stand for?

File Allocation Table

What are the file systems that are supported by Microsoft operating systems?

File Allocation Table (FAT) and New Technology File System (NTFS)

File Systems store data on a _____.

File Systems store data on a DISK.

What does FAT do?

Holds information about where files are stored on a volume

What does NTFS do?

Is a journaling file system which means it keeps a log of changes being written to the disk

What does NTFS stand for?

New Technology File System

Does a quick format really erase all of the data on the disk?

No

The NTFS File System offers ______ while the FAT file system is better known for its _________.

The NTFS File system offers SECURITY while the FAT file system is better known for its COMPATIBILITY

What feature of NTFS makes it a more stable file system?

The journaling feature

What are the EXT2/3/4 used for?

They are utilized by the Linux operating systems

T/F: if a wipe is done correctly, all data will be erased and recovery of artifacts will be near impossible.

True

What is the command to format the 1st partition on the 5th disk with ReiserFS?

mkfs.reiserfs /dev/sde1

What command will allow you to see the mounted file systems in Linux?

mount

How would you unmount the 1st partition on the 5th disk in Linux?

umount /dev/sde1

What Linux command allows you to verify that the drive has been zeroed out?

xxd/dev/sde

What is the command to view all of the mounted file systems?

~#mount

What does format do?

A format will not erases the data from the volume. Rather, it will delete the references to the file in the FAT or Master File Table ($MFT) and make those spaces on the disk available. Forensic recovery of files may be possible on a formatted disk

What is the name of a GUI tool in Linux that allows you to view disks?

gparted

How many file systems are supported by the Linux operating system?

95