• views: 195
• date: 16 September 2026
• posted by: 0nelove

File Systems Explained: FAT32, NTFS, EXT and APFS
Published 9/2026
Created by Mustafa Mowafek
MP4 | Video: h264, 1920x1080 | Audio: AAC, 44.1 KHz, 2 Ch
Level: Beginner | Genre: eLearning | Language: English | Duration: 28 Lectures ( 5h 17m ) | Size: 2.3 GB

Read a disk at byte level: hex editor, boot sector, Master File Table and recovering deleted files

What you'll learn
⚡ Distinguish sectors, clusters, allocated and unallocated space, and slack space
⚡ Work with a hex editor and convert values between hexadecimal, decimal and binary
⚡ Tell little endian from big endian and interpret byte sequences correctly
⚡ Use offset tables to locate specific structures inside a disk image
⚡ Analyze MBR and GPT partitioning and explain the forensic differences
⚡ Take FAT32 apart: boot sector, FAT region, directory entries and data region
⚡ Read the NTFS Master File Table and analyze the most important MFT attributes
⚡ Distinguish resident from non-resident data and detect alternate data streams
⚡ Explain what happens on deletion and recover deleted files
⚡ Classify the structures of exFAT, EXT and APFS, including inodes and APFS snapshots

Requirements
❗ Basic computer skills, some familiarity with file systems is helpful
❗ No prior knowledge of hexadecimal required, it is taught in the course
❗ Recommended for hands-on practice: a free hex editor and a sample disk image

Description
This course contains the use of artificial intelligence.

All content was researched, written and structured by human forensic practitioners. AI is used for the narration voice and for parts of the course graphics

When a file is deleted, the data does not disappear. Only the pointer to it does.
Understand that, and you can recover deleted files. Miss it, and you are relying on a tool you cannot explain in court. This course goes one level deeper than any analysis software: down to the bytes themselves.

Foundations. First the vocabulary: allocated and unallocated space, sectors, clusters and blocks. Then a detail that decides many cases, slack space, where fragments of older files survive.

The hex editor. The central tool. Converting between hexadecimal, decimal and binary, little endian versus big endian, and why byte order decides between right and wrong. Then the practice: the layout of a hex view, working with offset tables, locating sub-offsets and interpreting the values you extract.

Partitioning. MBR on classic BIOS systems, GPT on modern EFI systems, and the differences that matter forensically.

The FAT family. FAT12, FAT16 and FAT32 taken apart completely: boot sector and reserved region, the FAT region with its cluster chain, root directory and the layout of a directory entry, long file names under VFAT, and the data region. Then the decisive question: what happens on deletion and how to get the file back. Plus exFAT with its own boot sector and cluster heap.

NTFS. The centerpiece: the Master File Table. Its fixed layout and fixed records, MFT records and their attributes in detail, including STANDARD INFORMATION with its timestamps, FILE NAME, and DATA with the difference between resident and non-resident content and the virtual cluster number. Plus alternate data streams, which can hide entire files, and how storing, deleting and recovering works on NTFS.

EXT and APFS. Linux with superblock, block groups and inodes. Apple with the APFS container concept and the features that matter for analysis: snapshots, clones and encryption.

After this course you no longer read a disk through a tool. You understand what the tool is showing you, and you notice when it is wrong.

What is primarily taught in your course?
The forensic analysis of file systems at byte level: working with a hex editor, offset tables and endianness, partitioning with MBR and GPT, and the complete structure of FAT12, FAT16, FAT32, exFAT, NTFS, EXT and APFS, including boot sector, Master File Table, MFT attributes, slack space, and what actually happens when a file is deleted.

Who this course is for
⭐ Digital forensic examiners who want to understand what their tools do under the hood
⭐ Investigators who need to explain and verify recovered data themselves
⭐ Incident response teams and administrators interested in data recovery
⭐ Students of information security and computer science



   
   
   

Forex Trading

Crypto Trading. 20 USD Bonus after KYC

We need your support!
Make a donation to help us stay online
        
Bitcoin (BTC)
bc1q08g9d22cxkawsjlf8etuek2pc9n2a3hs4cdrld
	
Bitcoin Cash (BCH)
qqvwexzhvgauxq2apgc4j0ewvcak6hh6lsnzmvtkem

Ethereum (ETH)
0xb55513D2c91A6e3c497621644ec99e206CDaf239

Litecoin (LTC)
ltc1qt6g2trfv9tjs4qj68sqc4uf0ukvc9jpnsyt59u

USDT (ERC20)
0xb55513D2c91A6e3c497621644ec99e206CDaf239

USDT (TRC20)
TYdPNrz7v1P9riWBWZ317oBgJueheGjATm

0 1 2 3 4 5

| Print version |

	Information
		Users of GUESTS are not allowed to comment this publication.