|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/understanding-and-analyzing-data-streams-in-ntfs/
课程评论：没有评论
**课程名称：** 网络取证：NTFS 数据流分析 **课程概述：** 本课程将帮助学生深入了解微软Windows文件系统NTFS的基础知识，包括主文件表（Master File Table, MFT），数据流（包括主要数据流和备用数据流）的存储方式。学生将学会区分驻留数据（resident data）和非驻留数据（non-resident data），并了解如何在备用数据流（Alternate Data Streams, ADS）中隐藏数据。此外，课程还将教授如何分析MFT内外的存储数据，并定位数据在硬盘上的具体簇（cluster）或扇区（sector）位置。 **通过本课程，学生将能够：** * 理解备用数据流（ADS）的基础知识、其用途和发展历史。 * 学习如何向备用数据流和主要数据流中添加驻留数据（小于512字节）和非驻留数据（大于512字节）。 * 利用通用的十六进制编辑器（Hex Editor）在MFT中定位并分析任何数据流中的驻留数据。 * 通过定位数据在磁盘上的实际簇和扇区地址，分析任何数据流中的非驻留数据。 * 借助另一个十六进制编辑器，验证数据流中是否存在非驻留数据。 * 实际操作常用的取证工具和十六进制编辑器，以分析MFT内外的存储数据。 **课程价值：** 本课程为希望理解计算机取证和文件系统基础知识的学生提供了深刻的见解，尤其是在数据流分析方面，将非常有益。
The course will help students to learn about the basics of Microsoft Windows File System (NTFS), the Master File Table (MFT) and how data is stored in data streams, both primary and alternate. Students will also get to differentiate between resident and non-resident data and learn how to hide data in the ADS. It would also enable students to analyze the data inside and outside of the MFT and to locate the specific cluster/sector on the hard disk where this data is actually stored. Moreover the students will be able to:Understand the basics of Alternate Data Streams (ADS), their usage and historyAdding resident (less than 512 bytes) and non-resident (more than 512 bytes) data in both alternate and primary data streamsAnalyzing the resident data in any stream by locating it inside the MFT using a common Hex EditorAnalyzing the non-resident data in any stream by locating its actual cluster and sector address on the diskVerifying the presence of non-resident data in any data stream with the help of another Hex EditorPractically experiment common Forensics tools and Hex Editors for analyzing data in the MFT and otherwise.This course will turn out to be very useful for the students who want to understand the basics of computer forensics and file systems as it provides insight to analyzing data stored in the data streams.
