Bruce Nikkel 4_1_partition_analysis.pdf
Select the folders to/from which you want to add/remove "Bruce Nikkel 4_1_partition_analysis.pdf"
Why do we have partions on a drive and what are the common partition schemes?
Reason for partitions on a drive:
Common Partition schemes:
DOS is the most common, but GPT is growing fast
How can you analyse a partition?
Identify the partition scheme with TSK
What is NVME drive how does it differ from normal drives?
What are the characteristics of the DOS partition scheme?
DOS partition scheme:
What are the charecteristics of the GPT partition schemes?
GPT partition scheme:
what tools can you use to analyze the partition tables and analize image files?
View partition table of device:
Analyze image files:
what areas on disk are of forensic intresset that are normaly not accessible and how can you access them?
Areas of forensic intrest:
Searching for deleted partitions:
Things to note:
Schweizerischer Verband der Lehrkräfte für Wirtschaft und Recht
Institut für Banking und Finance
Lernen bei den Erfolgreichsten