Computer Forensic Fundamentals
MBR
The Master Boot Record (MBR) is the information in the first sector of a hard disk or a removable drive. It identifies how and where the system's operating system (OS) is located in order to be booted (loaded) into the computer's main storage or random access memory (RAM).
File systems
| Windows / floppy disls /USB sticks | FAT12, FAT 16/32, NTFS | | Linux most common | ext, Apple/MAC, HFS | | CDs most commons | ISO 9660, ISO 13490 | | DVDs most common | UDF, Joliet |
USB sticks
Get serial number and manufacture information (useful in linking to an OS later).
First time USB device connected to system (registry key):
Last time USB device connected to system (registry key):
FTK imager - A tool for forensic analysis
What is it? A tool that quickly assess electronic evidence by obtaining forensic images of computer data, without making changes to the original evidence.
Last update: 2023-04-11 Created: March 10, 2023 20:56:07