1. Chapter 3

2.  FFS  UFS  XFS  Ext2fs  Ext3fs  And more

3.  Unix and linux systems can mount foreign file systems  If a file system is not used ◦ umount ◦ umount –f will force

4.  you can choose not to mount a device  Unix and Linux record the existence as they boot up ◦ dmesg – ring buffer ◦ syslogd on UNIX and Solaris ◦ klogd on Linux daemon  df command  fdisk –l device_name

5.  regular file  directory  symbolic link  IPC endpoints  device files

6.  ownership  permissions  file type  hard link count  file size  time stamps ◦ last modified ◦ last accessed ◦ last status change (change of owner, permissions, etc.) ◦ deletion time ◦ birth time  data block addresses

7.  now found in Sleuthkit  go to http://s-t-d.orghttp://s-t-d.org  good commands ◦ icat ◦ fls  icat can find what cat can’t  cat can find what icat can’t

8.  zone size = 32768 blocks  typical block size = 1024 ◦ UFS ◦ FFS ◦ Ext3fs