coen 252 computer forensics l.
Download
Skip this Video
Download Presentation
COEN 252 Computer Forensics

Loading in 2 Seconds...

play fullscreen
1 / 8

COEN 252 Computer Forensics - PowerPoint PPT Presentation


  • 222 Views
  • Uploaded on

COEN 252 Computer Forensics. Master Boot Record NTFS Example. NTFS Example. Use WinHex to go directly to the partition. WinHex will read the boot sector and allow easier navigation. NTFS Example. Disassembling MFT entries by hand is difficult. Use tools.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'COEN 252 Computer Forensics' - fidella


Download Now An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
coen 252 computer forensics

COEN 252 Computer Forensics

Master Boot Record

NTFS

Example

ntfs example
NTFS Example
  • Use WinHex to go directly to the partition.
  • WinHex will read the boot sector and allow easier navigation.
ntfs example4
NTFS Example
  • Disassembling MFT entries by hand is difficult.
  • Use tools.
  • WinHex allows you to look at the file structure.
ntfs example7
NTFS Example
  • WinHex allows to search for strings
ntfs example8
NTFS Example
  • But string searches can take a long time.
ad