NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
File System Fundamentals
Understand how operating systems store data. Learn the basics of NTFS, FAT, MFT, inodes, and clusters for digital forensic analysis.
Room tasks
1What Is a File System and Why Does It Matter
2FAT, NTFS & ext4 Structures
3Master File Table (MFT) Internals
4Guided Lab: Examining an MFT with Autopsy
Frequently Asked Questions
What is a file system?
A file system organises how data is stored and found on a disk, tracking names, locations, sizes and permissions. Examples include NTFS, FAT, ext4 and APFS.
What is the Master File Table?
The MFT is NTFS's core database, holding a record for every file and folder, including names, timestamps and data locations. Forensic examiners rely on it to recover and date files.
What are inodes and clusters?
Inodes store metadata for files on Unix-style systems, while clusters are the allocation units that hold file data. This free beginner Codelivly room explains how both matter for forensics.