In the last video we talked about Microsoft file system fundamentals Linux operating systems also have
their own version of file systems x4 is the successor Linux file system 2 x 3 and it's earlier predecessors
due to its larger capacity and performance capabilities.
The x4 file system maintains a special file called a journal a file system Journal is used to record
data so that even in the event of power failures or system crashes the file system can be restored to
the previous state.
Journaling also provides data integrity to ensure that data has not been tampered with when X for file
systems are partitioned.
The information is held within the master boot records.
The ambi are also referred to as a bootloader contains executable code to function as a loader for the
installed operating system and makes file systems have two main partitions data and swap swap space
that is held within the swap partition.
Hold additional RAM that can be used by the system if needed.
The purpose of swap space is to help the Linux system operate but it can also be used as a forensic
tool because anything stored in RAM could also be stored in swap.
So this means that valuable system data such as emails credentials and plain text data can be analyzed
in swap as part of a forensics investigation.
If you want to view a summary of swap space usage by device you can use the command swap on summary.