File Systems and Data Storage Basics
Understanding File Systems and Data Storage Basics is essential for anyone studying computer forensics. These concepts explain how data is saved, organised, and accessed on digital devices. In forensic investigations, knowing how data is stored helps experts recover evidence and understand how information can be hidden or deleted.
How Data is Stored on Computers
Computers store data on physical devices such as hard drives, solid-state drives (SSD), USB flash drives, and memory cards. These devices use magnetic or electronic methods to save information as bits, which are the smallest unit of data—either a 0 or a 1.
The storage device is divided into smaller sections called sectors or blocks. Data is saved in these units, making it easier for the computer to find and read files quickly.
Data is organised by file systems, which act like the manager or librarian of the storage device. They keep track of where each file is saved and how to access it.
What is a File System?
A file system controls how files are named, stored, and retrieved. It manages the hierarchy of folders and files, allowing users and programs to access stored data easily.
Common file systems include:
- NTFS – Used mostly on Windows computers.
- FAT32 – Older system, compatible across many devices.
- exFAT – Common on USB drives and external storage.
- HFS+ and APFS – Used on Apple Mac systems.
- Ext3/Ext4 – Used on many Linux computers.
Each file system has its own method of organising files, its limitations on file size, and tools for recovering deleted data.
How Files Are Stored
A file is stored as one or more clusters, which are groups of sectors. When you save a file, the file system finds free clusters and writes the file data there. It also records the file location in a table or index for quick access.
When files grow or are modified, the file system can link clusters that are not next to each other, which is called fragmentation. Defragmentation tools can reorganise these clusters for better performance.
Why File Systems Matter in Computer Forensics
Forensic investigators must understand different file systems because:
- Each file system stores metadata (information about files) differently, which can reveal when a file was created, modified, or accessed.
- Deleted files are not always erased immediately. Instead, their space is marked as free, allowing recovery if not overwritten.
- Some file systems use journaling, which keeps logs of changes, helping recover damaged data.
- File system knowledge helps recognise hidden files, encrypted data, or attempts to cover tracks.
Data Storage in Practical Terms
Every time you save a photo, document, or video, the file system places it in the storage device’s structure. This saves time and storage space. When files are deleted, the file system usually removes the reference to these files, but the actual data remains until overwritten.
Forensic tools use this behaviour to recover mistakenly deleted or deliberately hidden files during investigations.
Summary
File Systems and Data Storage Basics form the backbone of understanding digital evidence. Knowing how data is saved, organised, and managed on storage devices helps in recovering information, tracing activity, and understanding how computers handle data. For learners in computer forensics, this knowledge is the first step to uncovering digital clues accurately and effectively.
Live Scenario • Active Situation
You are a digital forensic analyst called to investigate a suspected data breach on a company’s Windows laptop.
There is no single perfect answer. Choose what you would do in this situation.
