Chapter 3

 FFS  UFS  XFS  Ext2fs  Ext3fs  And more

 Unix and linux systems can mount foreign file systems  If a file system is not used ◦ umount ◦ umount –f will force

 you can choose not to mount a device  Unix and Linux record the existence as they boot up ◦ dmesg – ring buffer ◦ syslogd on UNIX and Solaris ◦ klogd on Linux daemon  df command  fdisk –l device_name

 regular file  directory  symbolic link  IPC endpoints  device files

 ownership  permissions  file type  hard link count  file size  time stamps ◦ last modified ◦ last accessed ◦ last status change (change of owner, permissions, etc.) ◦ deletion time ◦ birth time  data block addresses

 now found in Sleuthkit  go to  good commands ◦ icat ◦ fls  icat can find what cat can’t  cat can find what icat can’t

 zone size = blocks  typical block size = 1024 ◦ UFS ◦ FFS ◦ Ext3fs