Digital › Module 4 › Lesson 2
Filesystem Cues
Filesystem cues name NTFS/FAT/ext4 structures analysts recognize — MFT, inodes, paths — on YOUR $DFIR_LAB disk lessons.
Visual · t26_filesystem_cues
Filesystem literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Files live in structures — MFT rows, directory entries, and journal records tell deletion and movement stories.
NTFS: Master File Table (MFT) records files, $STANDARD_INFORMATION timestamps, attributes, data runs. FAT: directory entries and allocation tables — simpler, common on USB images. ext4: inodes and directory entries on Linux lab VMs. USN Journal (Windows) logs volume change events — defender correlation gold. Cyberlium names filesystem cues on YOUR $DFIR_LAB — identify OS and one structural artifact in practice image — not carving stranger devices without authority. Next: Deleted Recovery Named.
1. NTFS cues (named)
MFT entry: file reference, parent directory, timestamps, size, data attribute. Recycle Bin $I/$R files on Windows — deletion literacy. Prefetch, LNK, and Registry hives sit atop NTFS — cross-module literacy later.
On $DFIR_LAB Windows image, note one path showing Users\ structure — lab fictional accounts only.
Command guide
Try these commands — NTFS cues (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Autopsy — https://www.autopsy.com/ (open-source DFIR platform literacy) Autopsy docs — https://sleuthkit.org/autopsy/docs/user-docs/latest/ (official user docs) Sleuth Kit — https://www.sleuthkit.org/ (underlying engine)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
curl -sS https://www.autopsy.com/ | head -8
curl -sS https://sleuthkit.org/autopsy/docs/user-docs/latest/ | head -8
grep -E 'Autopsy|Sleuth' <<< 'Autopsy GUI over Sleuth Kit — docs literacy, not stranger disk ingest'Primary tools to practice this lesson: curl, grep. Reference sites: Autopsy (https://www.autopsy.com/); Autopsy docs (https://sleuthkit.org/autopsy/docs/user-docs/latest/); Sleuth Kit (https://www.sleuthkit.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-platform cues
FAT/exFAT: good for removable media labs — short names, allocation chains. ext4: /home, /var/log paths in Linux practice VM — inode metadata in tools.
Defenders match filesystem to imaging plan — wrong OS assumptions misread timestamps.
3. Literacy ≠ unauthorized deep dive
Forbidden: deep filesystem forensics on employer laptop without IR scope. Allowed: filesystem cue card — OS, key structure, one example path, one journal concept.
Ship: filesystem cue card for $DFIR_LAB practice image OS. Next: Deleted Recovery Named.
4. What you ship: filesystem cue card for $DFIR_LAB
OS, key structure (MFT/inode), example path. $DFIR_LAB named. NO stranger devices. chmod 600.
5. What you record before the next lesson
Date. Filesystem cue card. $DFIR_LAB named. File t26-m04-l02-filesystem-cues.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume FAT rules on NTFS image. Skip OS identification step.
Right
Write filesystem cue card for YOUR $DFIR_LAB image. Next: Deleted Recovery Named.
Mission: identify filesystem on YOUR image
1) State OS and filesystem type. 2) Name one structural artifact (MFT/inode). 3) Give one example path from lab image. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
USN Journal mentions are cheap wins in Windows timelines.
Knowledge Check
APPLY: MFT primarily belongs to:
Multiple choice
Knowledge Check
APPLY: True or False: Filesystem type affects how deletion and metadata appear.
True or False
Knowledge Check
APPLY: Filesystem literacy supports:
Multiple choice