A forensic image is only useful if you can read it. A file system is the structure an operating system uses to organise data on a disk, and knowing how it works tells you where evidence lives, what deleting a file really does, and what traces are left behind.
You'll compare common file systems such as NTFS, FAT, and ext4, and look closely at the NTFS Master File Table (MFT). Then you'll move on to data recovery: finding deleted files, examining unallocated and slack space, and using file carving to rebuild files from raw data when the file system records are gone. Tools like Autopsy, FTK Imager, and PhotoRec are used along the way.
Next up is Windows Forensics, where you'll apply this knowledge to the artifacts Windows leaves behind.
An overview of the file systems used on Windows, Linux, and macOS, and what each one means for a forensic examiner.
How the NTFS Master File Table stores file records, and how to extract and recover files from resident and non-resident data using FTK Imager.
Using PhotoRec from the Windows command line to recover files, not just photos, from a USB stick.
How investigators create a forensic image and then recover deleted files from it using FTK Imager and Autopsy.