# File System Fundamentals

> Understand how operating systems store data. Learn the basics of NTFS, FAT, MFT, inodes, and clusters for digital forensic analysis.

Canonical: https://codelivly.com/rooms/file-system-fundamentals
Last updated: 2026-09-11

| | |
|---|---|
| Level | Beginner |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module introduces the foundational concepts of file system architectures in digital forensics. You will learn how operating systems organize, store, and track data on physical disk drives. Key topics include the structural differences between FAT and NTFS, the critical role of the Master File Table (MFT) and inodes, cluster allocation, and how the OS actually handles "deleted" files. From a cybersecurity perspective, understanding these low-level structures is absolutely essential for uncovering hidden data, detecting anti-forensic techniques like timestomping, and recovering deleted artifacts that standard logical copies completely miss.

## Lessons

1. What Is a File System and Why Does It Matter (30 min)
2. FAT, NTFS & ext4 Structures (30 min)
3. Master File Table (MFT) Internals (30 min)
4. Guided Lab: Examining an MFT with Autopsy (30 min)

## Related

- [Learning path: Disk and File System Forensics](https://codelivly.com/learning-paths/disk-and-file-system-forensics)
- [All rooms](https://codelivly.com/rooms)