# Disk and File System Forensics

> Master the acquisition, preservation, and deep analysis of disk drives to uncover hidden evidence and recover deleted data.

Canonical: https://codelivly.com/learning-paths/disk-and-file-system-forensics
Last updated: 2026-09-11

| | |
|---|---|
| Level | Beginner |
| Category | Forensics |
| Rooms | 5 |
| Lessons | 20 |
| Estimated time | 2 h 30 min |

This comprehensive learning path guides you through the complete lifecycle of disk and file system forensics. Starting with foundational evidence handling and sterile workstation setup, you will progress to mastering forensic imaging, parsing complex file system architectures (NTFS, FAT), and executing advanced file carving techniques. Gain the practical skills needed to transform raw disk sectors into legally defensible, actionable intelligence.

## Rooms in this path

1. [File System Fundamentals](https://codelivly.com/rooms/file-system-fundamentals) - Understand how operating systems store data. Learn the basics of NTFS, FAT, MFT, inodes, and clusters for digital…
2. [Partition and Volume Analysis](https://codelivly.com/rooms/partition-and-volume-analysis) - Master partition tables and volume analysis. Learn to analyze MBR/GPT structures, uncover hidden partitions, and map…
3. [Deleted File Recovery](https://codelivly.com/rooms/deleted-file-recovery) - Master the techniques to recover deleted files. Learn file carving, magic numbers, and unallocated space analysis for…
4. [File System Metadata Analysis](https://codelivly.com/rooms/file-system-metadata-analysis) - Master file system metadata analysis. Learn to detect timestomping, parse MACB timestamps, uncover Alternate Data…
5. [Registry and Windows Artifact Analysis](https://codelivly.com/rooms/registry-and-windows-artifact-analysis) - Master Windows Registry forensics. Learn to parse hives, uncover malware persistence, track user activity via…

## Related

- [Career path: Digital Forensics](https://codelivly.com/career-paths/digital-forensics)
- [Reverse Engineering Fundamentals](https://codelivly.com/learning-paths/reverse-engineering-fundamentals)
- [Legal Procedure and Expert Testimony](https://codelivly.com/learning-paths/legal-procedure-and-expert-testimony)
- [Timeline Analysis and Artifact Correlation](https://codelivly.com/learning-paths/timeline-analysis-and-artifact-correlation)