Curriculum
Course Content
4 items · 1 sections
- 01 How filesystems store data and metadata
- 02 Recovering deleted and hidden data
- 03 Reading filesystem structures
- 04 Detecting anti-forensic tampering
GCFA
Advanced
Certificate
File System Forensics
Below the files, into the filesystem itself. How NTFS and common filesystems store data and metadata, recovering deleted and hidden data, and reading the filesystem structures that outlive an attacker cleanup.
Skills
What You Will Learn in This Course
Explain how filesystems store data and metadata.
Recover deleted and hidden data.
Read filesystem structures forensically.
Detect anti-forensic tampering.
About This Course
Below the files, into the filesystem itself. How NTFS and common filesystems store data and metadata, recovering deleted and hidden data, and reading the filesystem structures that outlive an attacker cleanup.
Requirements
- Windows and Linux forensics.
Who It Is For
- GCFA-track analysts.
Certified
Certificates You Can Earn
Finish your course and receive an accredited MotiGraph certificate you can add to your CV and share with employers.
