In this chapter, we begin by addressing the aftermath of a security incident and follow this to the problem of file storage. Specifically, we examine the following:

• ■   Incident response and recovering from an attack

• ■   Fundamentals of evidence collection and preservation

• ■   Basics of hard drives and other large-capacity devices

• ■   Hard drive formatting

• ■   File storage on hard drives, flash drives, and other devices

• ■   Features of major file systems used in operating systems and for removable storage