Problem
(a) What do you meant by a file system?
(b) Mention the five categories of data for a basic file system reference model. What is the use of such a reference model?
(c) Forensic examiners differentiate between essential and non - essential data when it comes to information gathered from a file system.
i. Differentiate between essential and non-essential data. How does this relate for forensic investigation.
ii. Consider the FAT file system, give two examples of each essential and non-essential data.
(d) i. What do you meant by a cluster?
ii. What is the impact of having large cluster size?