Coen 252 computer forensics
Download
1 / 8

COEN 252 Computer Forensics - PowerPoint PPT Presentation


  • 221 Views
  • Uploaded on

COEN 252 Computer Forensics. Master Boot Record NTFS Example. NTFS Example. Use WinHex to go directly to the partition. WinHex will read the boot sector and allow easier navigation. NTFS Example. Disassembling MFT entries by hand is difficult. Use tools.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'COEN 252 Computer Forensics' - fidella


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Coen 252 computer forensics l.jpg

COEN 252 Computer Forensics

Master Boot Record

NTFS

Example


Ntfs example l.jpg
NTFS Example

  • Use WinHex to go directly to the partition.

  • WinHex will read the boot sector and allow easier navigation.


Ntfs example4 l.jpg
NTFS Example

  • Disassembling MFT entries by hand is difficult.

  • Use tools.

  • WinHex allows you to look at the file structure.


Ntfs example7 l.jpg
NTFS Example

  • WinHex allows to search for strings


Ntfs example8 l.jpg
NTFS Example

  • But string searches can take a long time.


ad