Internship
Student login
← Digital Forensics learning path
Digital Forensics · Module 4 of 10

Storage and file systems

Understand where data lives on devices.

📖 Key ideas

  1. Storage media: HDD, SSD, USB, memory cards.
  2. File systems: NTFS, FAT32, exFAT, ext4, APFS.
  3. Deleted files may remain until overwritten (on HDDs).
  4. SSD TRIM can quickly erase deleted data.
  5. Metadata: timestamps (created, modified, accessed), owner, size.
💡 Real-life example: Deleting a file is like tearing a book's index page; the chapters may still be on the shelf.
File systemMethod of organising files
MetadataData about data
Slack spaceUnused space in allocated clusters
TRIMSSD command clearing deleted blocks