To be able to obtain forensics evidence during a cyber breach investigation you should understand how
endpoint file systems work.
So what is a file system.
Think of them as digital filing cabinets when you store data on your computer hard drive or flash drive.
File systems are used to divide it into organized units that can be accessed later on.
This can be accomplished in many ways depending on the type of file system that is used.
Back in the day file allocation table or fat was the default file system used by Microsoft operating
systems that organize data by splitting disks into clusters with a table to reference what was stored
where over time newer versions of führer introduced such as the more recent FAT 32 that 32 overcame
some of the earlier fat version limitations but still lacked inside capacity making it not suitable
for newer systems.
As an alternative to fat Microsoft introduced the new technology file system or NTFS NTFS is more secure
and scalable than fat making it the clear winner and has been used since Windows XP as the Microsoft
OS file system NTFS keeps track of time stamps of any changes to a file system.
Each file has a time stamped for create modify access and entry modified as you would expect.
Time is crucial across all aspects of cybersecurity.
If there is any file activity on a compromised device the time of the activity could be the smoking
gun and a breach.
Investigation.
If you go to computer management any Windows device and then go to storage and disk management you can
see what a file system is used for each type of drive.
As you can see here I have my my main hard drive which is using NTFS as its file system and then I have
an external storage device that uses x fat which is a nother version of the FAT file system.
Next I want to open up a file that has been modified on my system to show you where he can look at time
stamp information for files on a Windows computer.
So I go to my desktop and I have this test text file just by hovering over.
I can see that it was Last-Modified on October 30th that 10:32 p.m..
So if I was doing an investigation and found new files on the system or wanted to see if critical documents
were accessed or not I could right click on that file go to properties and then I can see the last time
it was created modified and accessed.
So I'm going to open up the file and I'll make a change and we should see update to today's date which
is November 21st 2017.
So modify the file click save X out of there and then let's go back to the properties of that file and
I can see that the modified date has been changed.
So that's just a really basic thing to know.
If you're not that familiar with file systems on Windows computers that can be very helpful for computer
forensics.