ABSTRACT

Chapter Objectives Identify the various components of a hard drive and the structure of disk media Learn the differences among the numerous disk drive interfaces and functions Become familiar with the Windows, Macintosh, and Linux file structures Learn the definitions of numerous terms relating to file and storage structures Identify forensic tools used to identify and retrieve evidence from Windows, Macintosh, and Linux systems

Introduction This chapter provides an overview of computer disk drives and how data is stored and managed on Microsoft, Macintosh, and Linux systems. An understanding of the file systems and operating systems (OSs) are required in order to identify and recover latent evidence from these systems.