CPT 499C Lecture 9 NTFS deleted files

CPT 499C Lecture 9 NTFS deleted files - DEPARTMENT OF...

Info iconThis preview shows pages 1–6. Sign up to view the full content.

View Full Document Right Arrow Icon
NTFS Deleted Files Slide 1 Deleted Files in NTFS
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
NTFS Deleted Files Slide 2 Learning Objectives The student will be able to: Describe the changes that take place on an NTFS drive when a file or directory is deleted Recover deleted files
Background image of page 2
NTFS Deleted Files Slide 3 So, what happens when you Delete a file in NTFS?
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
NTFS Deleted Files Slide 4 Deleting Files in NTFS $LogFile metadata file is updated Transaction steps are logged Used to “roll back” if necessary
Background image of page 4
NTFS Deleted Files Slide 5 Parent directory Index entry removed $BITMAP attribute updated* MFT file record marked available AND sequence number incremented by 1 Pointer to parent *NOT* updated MFT $BITMAP attribute Updated $Bitmap Metadata file updated If non-resident clusters Deleting Files in NTFS
Background image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 6
This is the end of the preview. Sign up to access the rest of the document.

Page1 / 13

CPT 499C Lecture 9 NTFS deleted files - DEPARTMENT OF...

This preview shows document pages 1 - 6. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online