Operating System and File System Forensics Questions

Knowledge of operating system and file system internals and artifacts used to reconstruct user and system activity. Topics include storage structures and metadata, file system carving and recovery, timeline reconstruction, analysis of system and application logs, registry and preference artifacts on desktop and mobile platforms, and methods for extracting user activity and persistence mechanics. Candidates should be able to explain how file system metadata and system artifacts are used to prove timelines and user actions and how to recover and interpret deleted or partially corrupted data.