Identifying file systems

From ForensicsWiki
Revision as of 23:58, 25 April 2008 by Simsong (Talk | contribs)

Jump to: navigation, search

There are many ways to identify a file system inside a partition.

When an operating system attempts to mount a partition, it may use the ID from the partition table.

There are several tools that can identify the partition from the data it contains, including:

In general you should not rely on the partition record for determining the partition type.

Some of the test images created for the Honeynet Challenges have multiple file systems contained in a single partition.