File System Forensics
Acquiring, parsing, and analysing file system artefacts (NTFS, ext4, APFS) during a digital investigation.
## Overview
File system forensics covers the recovery and interpretation of artefacts left behind on storage media. Examiners reconstruct timelines from MFT records, journal logs, and slack space.