Data Recovery 2 - General Information
Description - This is the third class of the curriculum which will concentrate on advanced topics including:
- Development of complex batch files to automate various operations
- Complete coverage of the NTFS file system, the primary file system used on the majority of end user and professional PC's including workstations and servers.
Class Schedule Information
This class will be offered in Summer 2008
Data Recovery 2 - Introduction to NTFS Curriculum Outline
- Data Recovery 1 Review
- Development of Complex batch files for working with the MBR
- Development of Complex batch files for working with the DBR
- Development of Complex batch files for working with the EMBR's and their DBR's
- Laboratory procedures: Working with Windows 2000/2003/XP Disk Management
- Introduction to Dynamic Drive concepts and the Dynamic Drive Database
- Laboratory procedures: Working with Windows 2000/2003/XP Recovery Console
- Review Structure, Location, Function of the Master Boot Record
- Structure, Location, Function of the NTFS Partition Table
- Structure, Location, Function of Extended Master Boot Records used in NTFS
- Structure, Location, Function of the Volume Boot Record of NTFS
- Structure, Location, Function of the NTFS VBR Drive Parameter Block
- Structure, Location, Function of the NTFS Master File Table
- Structure, Location, Function of the standard $MFT Entries
- Structure, Location, Function of data file $MFT Entries
- Structure, Location, Function of NTFS resident directory entries
- Laboratory procedures: Working with Norton Diskedit
- Basic exercise, build new empty NTFS partition, create a file in it and investigate all structures and locate the file
- Basic exercise, build new empty NTFS partition, create a large file in it and investigate all structures and locate all occupied clusters of the file
- Advanced exercise: Manual Reconstruction of a zeroed NTFS MBR
- Advanced exercise: Manual Reconstruction of a zeroed NTFS VBR
- Laboratory Procedures: Using Norton 2003's Diskedit to read LBA sectors
- Advanced exercise: Manual Reconstruction of a fragmented file in NTFS
- Advanced exercise: Manual Reconstruction of a nonresident directory in NTFS
