# File System (NTFS)

> Master the NTFS file system. Explore the Master File Table (MFT), Alternate Data Streams (ADS), file permissions, and Volume Shadow Copies for forensics.

Canonical: https://codelivly.com/rooms/file-system-ntfs
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive deep into the NTFS (New Technology File System), the backbone of Windows storage. The File System (NTFS) module breaks down how Windows organizes, secures, and tracks data on disk.

You will explore the critical Master File Table (MFT) and how it acts as the ultimate forensic artifact. We will uncover how attackers hide malicious payloads using Alternate Data Streams (ADS) and how file permissions and ACLs control access. Finally, you will learn how Volume Shadow Copies work and how they can be used to recover deleted files or track ransomware activity. By the end of this module, you will understand NTFS internals and how to leverage them for both security hardening and digital forensics.

## Lessons

1. Windows File System Basics (30 min)
2. NTFS Architecture & Metadata (30 min)
3. Windows File & Folder Permissions (30 min)
4. NTFS Security Artifacts & Investigation (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)