Host, File-System and Operating-System Forensics

Introduction and context

Host forensics examines evidence created, stored, processed, and deleted by a computing device. It connects physical storage structures with operating-system behaviour and user activity. The investigator’s task is not simply to locate suspicious files; it is to reconstruct events, evaluate competing explanations, preserve evidential integrity, and communicate conclusions that can withstand technical and legal scrutiny.

A modern endpoint may contain multiple storage devices, encrypted volumes, virtual disks, cloud-synchronisation folders, removable media, system logs, browser databases, configuration stores, and application artefacts. Windows, Linux, and macOS implement these features differently. Consequently, competent examination requires both general forensic principles and platform-specific knowledge.

Host evidence is particularly valuable because it can answer questions such as:

• Which account was active at a particular time?
• Was a file created, modified, copied, renamed, or deleted?
• Was removable media attached?
• Which program executed?
• Did malware establish persistence?
• What network or authentication activity was recorded?
• Are timestamps reliable, and what time zone or clock offset applies?

Forensic interpretation must remain cautious. An artefact usually records an event or state, not the complete intention of a person. A file’s presence does not prove that it was opened, and a login record does not necessarily prove that the account owner operated the device.

Learning objectives

By the end of this chapter, a learner should be able to:

1. Explain disk, partition, volume, file-system, and operating-system relationships.
2. Distinguish major features of NTFS, FAT/exFAT, APFS, HFS+, ext4, and common Linux file systems.
3. Acquire and verify host evidence without altering the source.
4. Interpret metadata, deleted data, slack space, logs, registries, and user-activity artefacts.
5. Analyse persistence mechanisms on Windows, Linux, and macOS.
6. Construct and qualify forensic timelines.
7. Recognise limitations, anti-forensic activity, privacy obligations, and evidential risks.

1. The host as a forensic system

A useful model separates five layers:

1. Physical media: magnetic disks, solid-state drives, flash media, and removable devices.
2. Partitioning: structures that divide a device into partitions, such as MBR or GPT.
3. Volumes and file systems: logical storage containers formatted as NTFS, ext4, APFS, or another system.
4. Operating system: kernel, drivers, services, account management, logs, and security controls.
5. Applications and users: browsers, office software, messaging clients, scripts, and human activity.

Evidence may be duplicated or transformed between layers. For example, a browser download can appear in a browser database, the file system’s metadata, an antivirus log, a shell history file, and a backup. Corroboration across independent artefacts is stronger than reliance on one record.

Acquisition and integrity

The preferred approach is to acquire a forensic image or other defensible copy while preventing writes to the original medium. A hardware or software write blocker helps protect storage media. Investigators should document device identifiers, acquisition tool and version, start and finish times, operator, errors, hash values, and chain of custody.

A cryptographic hash is commonly used to demonstrate that two byte sequences are identical. For an input message x, a hash function produces H(x). The investigator compares the source or acquisition hash with a later verification hash. A matching hash supports integrity but does not, by itself, prove that the evidence is authentic, complete, or lawfully obtained.

Live acquisition may be necessary where volatile evidence is important, such as RAM contents, active network connections, mounted encrypted volumes, running processes, and temporary keys. It is inherently more intrusive because collection tools change memory and may alter system state. The decision between live and dead-box acquisition should be justified and recorded.

2. Partitions, volumes, and storage structures

An MBR normally contains boot code, a partition table, and a signature. Its traditional partitioning scheme has limitations, including a practical disk-size limit and a maximum of four primary partition entries. GPT uses globally unique identifiers, supports larger disks and more partitions, and maintains a secondary header for recovery. Both structures can be examined for unexpected partitions, unallocated regions, boot-code manipulation, and evidence of wiping.

A partition is not necessarily a mounted file system. It may contain a file system, a swap area, a recovery environment, an encrypted container, or a virtual-machine image. Investigators should therefore inspect partition type identifiers, offsets, sizes, volume labels, encryption indicators, and file-system signatures rather than assuming that every partition is user data.

Solid-state storage creates additional complexity. Wear levelling, garbage collection, and TRIM can cause deleted blocks to become unavailable to conventional imaging. A deleted file may remain logically referenced in metadata while its content has already been erased or relocated. Evidence recovery expectations must therefore be based on the device and acquisition circumstances, not on assumptions derived from magnetic disks.

3. File-system forensics

A file system records names, locations, allocation status, permissions, timestamps, and relationships between files and directories. It may also record journals, transactions, extended attributes, snapshots, and security descriptors.

NTFS

NTFS uses a Master File Table (MFT), in which files and directories are represented by records. Attributes may be resident within an MFT record or non-resident in separate data runs. Important NTFS evidence includes:

• MFT records and file-reference relationships;
• Standard information timestamps;
• File-name timestamps;
• security identifiers and access-control information;
• the USN Change Journal, when enabled;
• the $LogFile transaction log;
• $Bitmap, which records allocation status;
• alternate data streams;
• Volume Shadow Copies and Windows Search databases.

An MFT record marked inactive may indicate deletion, but it does not guarantee that content is recoverable. Conversely, a file may have been deleted while portions of its data remain in unallocated space. NTFS timestamps should be interpreted with awareness of copying, extraction, application behaviour, clock changes, and timestamp manipulation.

FAT and exFAT

FAT-family systems use allocation tables and directory entries. They are common on removable media and are comparatively simple, but their historical timestamp resolution and limited metadata can reduce precision. Deleted directory entries may retain a filename fragment and starting cluster. ExFAT supports larger media and differs in allocation and timestamp details. Removable-media examinations should include volume labels, serial numbers, directory structures, allocation status, and operating-system records showing attachment.

Linux file systems

Ext2, ext3, and ext4 use inodes, directory entries, block groups, and allocation structures. An inode commonly records ownership, permissions, size, timestamps, link count, and data-block references. Ext4 may use journalling, extents, delayed allocation, and nanosecond timestamp precision. The journal can preserve information about recent metadata operations, but it is not a complete activity log and may be overwritten.

Linux systems may also use XFS, Btrfs, ZFS, or encrypted LUKS containers. Btrfs and ZFS can provide snapshots and copy-on-write behaviour, creating valuable historical states but also complicating interpretation of apparent duplicates and timestamps.

macOS file systems

APFS is a modern copy-on-write file system supporting encryption, snapshots, clones, containers, and multiple volumes. A file may appear in a current volume and in snapshots without representing multiple independent user actions. APFS metadata, snapshots, unified logs, quarantine information, launch services, and preference stores should be interpreted together. Older macOS systems may use HFS+, whose catalog and journal structures have different recovery characteristics.

Metadata and timestamps

Common timestamp categories are:

• Creation or birth time: when a file-system object was created, where supported.
• Modification time: when content was last modified.
• Metadata-change time: when attributes or directory information changed; common in Unix-like systems.
• Access time: when content was accessed, subject to operating-system policies.
• Change-journal time: when a file-system change was recorded.

A timestamp is meaningful only with its source, time zone, precision, clock condition, and known transformation history. Copying a file may preserve content timestamps while changing metadata timestamps. Archive extraction may assign new times. Cloud synchronisation may produce times from a remote system.

4. Deleted data and unallocated space

Deletion generally removes a directory reference or marks allocation structures as available; it does not always immediately overwrite content. Examination may therefore include inactive metadata records, unallocated clusters, file slack, journal records, shadow copies, recycle-bin structures, application databases, and backups.

File carving searches raw data for file signatures and internal structures without relying on file-system metadata. It can recover fragments when metadata is damaged, but it may produce false positives, lose filenames and paths, and incorrectly combine fragments. A carved document should be treated as a reconstruction whose completeness must be assessed.

The Windows Recycle Bin, macOS Trash, and Linux desktop trash mechanisms may retain original paths, deletion times, and file content. These records are not universal: command-line deletion, secure deletion, application-specific deletion, and automated cleanup may bypass them.

Encryption, SSD TRIM, overwriting, compression, fragmentation, and file-system reuse limit recovery. Absence of recovered data should therefore be reported as “not found under the examination conditions,” not as proof that the data never existed.

5. Operating-system artefacts

Windows

Important Windows sources include the Registry, Event Logs, Prefetch, Amcache, Shimcache, Windows Search, Jump Lists, LNK files, Recycle Bin records, browser databases, scheduled tasks, services, WMI subscriptions, startup folders, Defender logs, and Volume Shadow Copies.

The Registry is a hierarchical configuration database stored in hives. Key hives include SYSTEM, SOFTWARE, SAM, and user NTUSER.DAT; each user profile may also contain UsrClass.dat. Registry evidence can identify installed software, connected devices, user preferences, network configuration, shell activity, and persistence. Registry LastWrite times refer to key changes, not necessarily the time an associated program executed.

Event Logs commonly include Security, System, Application, PowerShell, Task Scheduler, and Windows Defender channels. Security events may document logons, process creation, privilege use, account changes, and object access when auditing is enabled. Logging configuration, retention, forwarding, and tampering must be evaluated before drawing conclusions.

Linux and Unix-like systems

Linux evidence may include systemd journal files, traditional /var/log files, authentication logs, shell histories, cron and systemd timers, SSH configuration and keys, user and group databases, sudo records, package-management logs, auditd records, process accounting, temporary directories, and desktop artefacts. File permissions and ownership are themselves important evidence. Shell history is user-configurable and does not record every command; timestamps may be absent or disabled.

macOS combines Unix foundations with Apple-specific artefacts. Useful sources include the unified logging system, launch agents and daemons, login items, quarantine metadata, property-list files, recent-items databases, browser data, Keychain-related evidence where lawfully accessible, and APFS snapshots. macOS privacy controls may restrict collection, and encryption may make acquisition dependent on device state and credentials.

6. User activity and persistence

User activity is best reconstructed by correlating artefacts. For example, a downloaded executable may be supported by browser history, a download database, a quarantine record, file-system metadata, antivirus detection, Prefetch or execution traces, and a subsequent persistence entry. No single artefact necessarily proves execution.

Persistence is any mechanism that causes code or a service to run again after reboot, logon, or another trigger. Common examples include:

A persistence finding should establish the mechanism, path, owner, permissions, creation or modification evidence, trigger, and whether execution is corroborated. Suspicious location alone is insufficient; legitimate software also uses scheduled tasks and services.

7. Logs, clock analysis, and timeline construction

A forensic timeline is an ordered representation of events drawn from multiple sources. It may include file-system events, log entries, application records, authentication events, process traces, and external observations. A timeline should preserve the original timestamp, normalized timestamp, source, event type, confidence, and interpretation.

Time normalization requires knowledge of time zones, daylight-saving changes, UTC conversion, clock drift, and timestamp semantics. The basic conversion from local time to UTC can be expressed as:

The offset must be appropriate for the location and date; it is not always a fixed value because daylight-saving rules may change. Investigators should retain both original and normalized values. If a system clock is wrong by an estimated drift ∆t, recorded event time can be described as an estimate rather than silently corrected.

Timeline analysis should distinguish:

• fact: what an artefact directly records;
• inference: what several facts reasonably suggest;
• hypothesis: an explanation requiring further testing.

A useful confidence approach is qualitative—high, medium, or low—based on source reliability, corroboration, completeness, and susceptibility to manipulation. Numerical confidence scores should not be invented unless a validated method supports them.

8. Applied case: illustrative investigation of an unauthorised tool

Background

A fictional organisation detects that confidential archives were copied from a Windows file server to removable media. The server is suspected of being accessed using a compromised administrator account.

Problem

Investigators must determine whether the archive was accessed, which account was involved, whether removable media was used, and whether a persistence mechanism remained on the server.

Analysis

A verified forensic image is acquired with a write blocker. Investigators record the server’s time configuration and compare it with domain-controller and central logging times. Partition structures show a standard GPT layout and an NTFS data volume. The MFT identifies the archive and its modification history; the USN Change Journal records a rename and subsequent close event.

Security logs show a successful logon using the administrator account, followed by process-creation events for an archiving utility. Registry and system artefacts identify a USB device serial number and its first-connection history. A scheduled task executes a script from an unusual directory at system start. The task’s creation time precedes the suspicious logon, but the task has a legitimate vendor signature; therefore, it is not automatically classified as malicious.

A browser record, Prefetch entry, and antivirus log corroborate execution of the archiving utility. However, the evidence does not establish who physically operated the account. Video access records and endpoint telemetry are requested for attribution.

Approach and outcome

The final report separates direct observations from interpretations. It concludes that the archive was accessed and copied during the relevant interval, that a particular removable device was connected, and that an existing scheduled task was examined but not shown to be attacker-created. The administrator account was used, but human attribution remains unresolved.

Learning points

The case demonstrates the value of corroboration, time normalization, cautious attribution, and distinguishing access from intent. It also shows why a suspicious artefact must be tested against legitimate explanations.

9. Legal, ethical, and governance considerations

Host examination may expose personal communications, health information, credentials, privileged documents, and unrelated employee activity. Investigators should operate under appropriate authority, define scope, minimise unnecessary collection, and protect acquired data through access controls and encryption. Legal requirements vary by jurisdiction, but common evidential expectations include relevance, authenticity, integrity, continuity, reproducibility, and transparent methodology.

Examiners should preserve original evidence, work from verified copies, document tool versions and settings, retain error messages, and avoid unsupported claims. Automated tools and artificial intelligence can assist with triage, clustering, anomaly detection, and timeline sorting, but they cannot replace validation. AI-generated interpretations may be opaque, biased, or wrong; investigators must preserve provenance, test results against source artefacts, and ensure that confidential evidence is not disclosed to unauthorised services.

10. Limitations and best practices

Major limitations include encryption, secure deletion, SSD garbage collection, incomplete logging, clock error, malware tampering, virtualisation, cloud dependence, proprietary formats, and missing or corrupted artefacts. Anti-forensic behaviour may include timestamp manipulation, log clearing, wiping, alternate data streams, hidden partitions, and use of legitimate administrative tools.

Best practice is to:

1. Define investigative questions before collection.
2. Preserve volatile evidence when justified.
3. Use validated acquisition and analysis tools.
4. Hash and verify images and extracted files.
5. Maintain a complete chain of custody.
6. Record original timestamps, time zones, and precision.
7. Corroborate important findings across independent sources.
8. Test innocent and malicious hypotheses.
9. Report limitations and absent evidence explicitly.
10. Separate facts, interpretations, and conclusions.

Chapter Summary

Host forensics links physical media, partitions, volumes, file systems, operating systems, applications, and users. NTFS, FAT/exFAT, ext4, APFS, and related systems preserve different forms of metadata, journals, allocation information, snapshots, and deleted-data remnants. Windows Registry and Event Logs, Linux journals and authentication records, and macOS unified logs and launch mechanisms provide valuable but imperfect evidence.

Reliable analysis depends on defensible acquisition, hashing, chain of custody, timestamp interpretation, cross-source correlation, and awareness of anti-forensic and technological limitations. Deleted data may be recoverable, but SSD behaviour, encryption, overwriting, and fragmentation can prevent recovery. Persistence analysis must identify the mechanism and corroborate execution rather than treating unusual location as proof of compromise. Ethical and legal practice requires authority, proportionality, privacy protection, reproducibility, and carefully qualified conclusions.

Key Terms

Host forensics: Examination of evidence on a computer system.

Forensic image: Bit-for-bit or otherwise validated representation of storage media.

Partition: A logically defined region of a storage device.

Volume: A logical storage container, often formatted with a file system.

File system: Structures and rules used to store and retrieve files.

MFT: NTFS database containing records for files and directories.

Inode: Unix-like structure recording file metadata and data references.

Metadata: Information describing a file, object, or event.

Unallocated space: Storage marked available for future allocation.

File carving: Recovery based on content signatures rather than metadata.

Slack space: Unused bytes within allocated storage units.

Journal: Record of selected file-system or system transactions.

Registry: Windows hierarchical configuration database.

Persistence: Mechanism that causes software to run again automatically.

Timeline: Ordered representation of events from one or more sources.

Timestamp: Recorded time associated with an event or object.

Chain of custody: Documented history of evidence possession and handling.

Write blocker: Mechanism preventing writes to an evidential storage source.

TRIM: Storage command that allows an SSD to erase unused blocks.

Corroboration: Support for a finding from independent evidence sources.

Review Questions

Short Answer Questions

1. What is the difference between a partition and a volume?
2. Why should a forensic examiner retain both original and normalized timestamps?
3. What information can the Windows Registry provide?
4. Why is file carving subject to false positives?
5. Name two persistence mechanisms used by Linux systems.

Long Answer Questions

1. Explain how an investigator should acquire and verify a host image while preserving evidential integrity.
2. Compare NTFS, ext4, and APFS from a forensic perspective.
3. Discuss the evidential value and limitations of deleted files, unallocated space, and file-system journals.
4. Explain how Windows Event Logs, Registry artefacts, and application records can be correlated.
5. Describe the legal, ethical, and governance obligations involved in examining an employee workstation.

Analytical / Application Questions

1. A file has a recent modification time, an older creation time, and a matching copy in a cloud-synchronisation folder. Develop competing explanations and identify additional evidence needed to distinguish them.
2. A scheduled task launches a script from a temporary directory, but the script is digitally signed by a trusted vendor. Explain how you would assess whether the task represents attacker persistence.
3. A server’s local clock is 17 minutes slow and its Security log has missing entries. Design a cautious timeline method and identify the limits of your conclusions.

Multiple Choice Questions with Answers

Question 1

Which NTFS structure records file and directory records?

A. Master File Table

B. Systemd journal

C. APFS snapshot

D. FAT boot sector

Correct Answer: A. Master File Table

Question 2

What is the principal purpose of a forensic write blocker?

A. To encrypt an evidence image

B. To prevent writes to the source medium

C. To recover every deleted file

D. To correct system timestamps

Correct Answer: B. To prevent writes to the source medium

Question 3

Which statement best describes file carving?

A. It relies exclusively on Registry keys

B. It recovers data using content signatures and structures

C. It proves who created a file

D. It requires a functioning directory entry

Correct Answer: B. It recovers data using content signatures and structures

Question 4

Which Windows artefact is a hierarchical configuration database?

A. Prefetch

B. USN Journal

C. Registry

D. Recycle Bin

Correct Answer: C. Registry

Question 5

If local time is recorded as 14:00 with a UTC offset of +2 hours, what is the corresponding UTC time?

A. 12:00

B. 14:00

C. 16:00

D. 02:00

Correct Answer: A. 12:00

Question 6

Which factor particularly complicates recovery of deleted data from SSDs?

A. GPT identifiers

B. TRIM and garbage collection

C. File extensions

D. Directory names

Correct Answer: B. TRIM and garbage collection

Question 7

Which is a Linux persistence mechanism?

A. LaunchDaemon

B. Run key

C. Cron job

D. Jump List

Correct Answer: C. Cron job

Question 8

What does a matching acquisition hash primarily support?

A. That the evidence copies are byte-consistent

B. That a suspect is guilty

C. That a file was executed

D. That the system clock was accurate

Correct Answer: A. That the evidence copies are byte-consistent

Question 9

Which conclusion is most defensible when an administrator account logged in but human attribution is absent?

A. The account owner definitely operated the device

B. The account was used, but the operator is unresolved

C. No access occurred

D. The event must be malware execution

Correct Answer: B. The account was used, but the operator is unresolved

Question 10

Why should important findings be corroborated across artefacts?

A. Every artefact records complete user intent

B. Independent sources can reduce the risk of misinterpretation

C. Corroboration removes the need for documentation

D. A single timestamp is always unreliable

Correct Answer: B. Independent sources can reduce the risk of misinterpretation