File Systems Explained: FAT32, NTFS, EXT and APFS
Published 9/2026
Created by Mustafa Mowafek
MP4 | Video: h264, 1920x1080 | Audio: AAC, 44.1 KHz, 2 Ch
Level: Beginner | Genre: eLearning | Language: English | Duration: 28 Lectures ( 5h 17m ) | Size: 2.3 GB
Read a disk at byte level: hex editor, boot sector, Master File Table and recovering deleted files
What you'll learn
Distinguish sectors, clusters, allocated and unallocated space, and slack space Work with a hex editor and convert values between hexadecimal, decimal and binary Tell little endian from big endian and interpret byte sequences correctly Use offset tables to locate specific structures inside a disk image Analyze MBR and GPT partitioning and explain the forensic differences Take FAT32 apart: boot sector, FAT region, directory entries and data region Read the NTFS Master File Table and analyze the most important MFT attributes Distinguish resident from non-resident data and detect alternate data streams Explain what happens on deletion and recover deleted files Classify the structures of exFAT, EXT and APFS, including inodes and APFS snapshotsRequirements
Basic computer skills, some familiarity with file systems is helpful No prior knowledge of hexadecimal required, it is taught in the course Recommended for hands-on practice: a free hex editor and a sample disk imageDescription
This course contains the use of artificial intelligence.
All content was researched, written and structured by human forensic practitioners. AI is used for the narration voice and for parts of the course graphics
When a file is deleted, the data does not disappear. Only the pointer to it does.
Understand that, and you can recover deleted files. Miss it, and you are relying on a tool you cannot explain in court. This course goes one level deeper than any analysis software: down to the bytes themselves.
Foundations. First the vocabulary: allocated and unallocated space, sectors, clusters and blocks. Then a detail that decides many cases, slack space, where fragments of older files survive.
The hex editor. The central tool. Converting between hexadecimal, decimal and binary, little endian versus big endian, and why byte order decides between right and wrong. Then the practice: the layout of a hex view, working with offset tables, locating sub-offsets and interpreting the values you extract.
Partitioning. MBR on classic BIOS systems, GPT on modern EFI systems, and the differences that matter forensically.
The FAT family. FAT12, FAT16 and FAT32 taken apart completely: boot sector and reserved region, the FAT region with its cluster chain, root directory and the layout of a directory entry, long file names under VFAT, and the data region. Then the decisive question: what happens on deletion and how to get the file back. Plus exFAT with its own boot sector and cluster heap.
NTFS. The centerpiece: the Master File Table. Its fixed layout and fixed records, MFT records and their attributes in detail, including STANDARD INFORMATION with its timestamps, FILE NAME, and DATA with the difference between resident and non-resident content and the virtual cluster number. Plus alternate data streams, which can hide entire files, and how storing, deleting and recovering works on NTFS.
EXT and APFS. Linux with superblock, block groups and inodes. Apple with the APFS container concept and the features that matter for analysis: snapshots, clones and encryption.
After this course you no longer read a disk through a tool. You understand what the tool is showing you, and you notice when it is wrong.
What is primarily taught in your course?
The forensic analysis of file systems at byte level: working with a hex editor, offset tables and endianness, partitioning with MBR and GPT, and the complete structure of FAT12, FAT16, FAT32, exFAT, NTFS, EXT and APFS, including boot sector, Master File Table, MFT attributes, slack space, and what actually happens when a file is deleted.
Who this course is for
Digital forensic examiners who want to understand what their tools do under the hood Investigators who need to explain and verify recovered data themselves Incident response teams and administrators interested in data recovery Students of information security and computer sciencePlease Login or Register to see this code