File System Forensics: A Comparative Analysis across Operating Systems

Kapil B. Morey, Vijay J. Thakare, Vishal S. Pawade and Vaishali B. Mahajan

International Journal of Scientific Research in Science and Technology, 2026, vol. 13, issue 3, 582-588

Abstract: File system forensics is a critical area within digital forensics, focusing on the acquisition, examination, and interpretation of data stored within various file systems. Given the centrality of file systems to data storage and access, understanding their structures and behaviors is essential for effective forensic investigations. This paper gives a comprehensive comparative analysis of file system forensics within three leading operating system environments: Windows (NTFS), Linux (ext4), and macOS (APFS). We evaluate each file system based on metadata handling, timestamp resolution, data deletion and recovery processes, journaling, and vulnerability to anti-forensics methods. Our study highlights the forensic strengths and weaknesses inherent in each system and proposes best practices for forensic analysts. These insights aim to guide future developments in forensic tools and methodologies [1][2][3].

Keywords: Digital Forensics; File System Analysis; NTFS; Ext4; APFS; Metadata; Data Recovery; Journaling; Anti-Forensics; Operating Systems; Timeline Reconstruction (search for similar items in EconPapers)
Date: 2026
References: Add references at CitEc
Citations:

Downloads: (external link)
https://ijsrst.com/home/article/view/IJSRST26133178 Abstract page (text/html)
https://ijsrst.com/home/article/download/IJSRST26133178/IJSRST26133178 Full text (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:etm:ijsrst:v13:y2026:i3:id:1637

DOI: 10.32628/IJSRST26133178

Access Statistics for this article

More articles in International Journal of Scientific Research in Science and Technology from Technoscience Academy
Bibliographic data for series maintained by Pankaj Sharma ().