CHFI › OS and File System Forensics
This domain covers forensic examination of Windows and Linux file systems: NTFS metadata (MFT, $LogFile, $UsnJrnl), FAT/exFAT structures, ext2/3/4 inodes and journaling, deleted-file recovery, timestamps, and evidence acquisition. Questions are scenario-based, asking you to interpret artifacts, choose sound acquisition methods, and explain what file-system records reveal about attacker or user activity.
CHFI OS and File System Forensics — All 14 Questions
Every question in this domain with answers and detailed explanations.
Computer Forensics Investigation Process
Computer Forensics Fundamentals and Process
Application, Email and Cloud Forensics
Mobile and Malware Forensics
Network and Cloud Forensics
Storage Forensics and File System Analysis
Database and Application Forensics
Incident Response and First Responder Skills
Computer Forensics Lab
OS and Network Forensics
Malware Forensics
Evidence Acquisition and Duplication