Unlike Linux, which uses a single root directory:

/

Windows commonly organizes storage using drive letters.

Examples:

C:\
D:\
E:\

Each drive contains its own directory structure.

Most Windows systems store the operating system, applications, and user data on:

C:

---

Why This Matters

Nearly every activity performed by an Operator involves the file system.

Examples include:

Understanding the file system is therefore a prerequisite for:

• Administration
• Incident Response
• Digital Forensics
• Threat Hunting
• Malware Analysis
• Penetration Testing
• Red Teaming

---

Hierarchical Structure

Windows organizes data as a hierarchy of directories and files.

Example:

C:\
├── Users
│   ├── Alice
│   └── Peter
│       ├── Desktop
│       └── Downloads
├── Windows
├── Program Files
├── Program Files (x86)
└── Temp

Important characteristics:

• Every file has a path
• Every directory can contain files
• Every directory can contain additional directories
• Each drive has its own root
• Additional storage devices appear as separate drives

---

Paths

A path identifies the location of a file or directory.

Example:

C:\Users\Peter\Documents\report.docx

This path can be read as:

---

Absolute Paths

Absolute paths begin from the root of a drive.

Examples:

C:\Windows\System32\cmd.exe
C:\Users\Peter\Downloads\tool.exe
C:\Program Files\App\application.exe

Characteristics:

• Begin with a drive letter
• Fully identify a location
• Valid regardless of the current directory
• Commonly used in documentation

---

Relative Paths

Relative paths begin from the current directory.

Examples:

Documents\report.docx
..\Downloads\tool.exe
.\script.ps1

Special symbols:

Example:

Assuming your current directory is:

C:\Users\Peter\Documents

then:

..\Downloads

resolves to:

C:\Users\Peter\Downloads

---

Directories and Files

Windows stores information using files and directories.

Examples:

---

Naming Conventions

Windows file names are generally:

• Not case-sensitive
• Descriptive
• Associated with file extensions

Examples:

report.docx
Report.docx
REPORT.docx

These typically refer to the same file.

---

Hidden Files

Windows supports hidden files and directories.

Examples:

AppData
ProgramData
desktop.ini

Operators frequently inspect hidden locations because they often contain:

• User configuration
• Application data
• Credentials
• Logs
• Persistence mechanisms

Hidden files can be viewed through:

dir /a

or

Get-ChildItem -Force

---

File Extensions

Windows commonly identifies file types through extensions.

Examples:

Examples:

notepad.exe
kernel32.dll
backup.ps1

Extensions often provide clues about a file's purpose.

---

NTFS

The most common Windows file system is:

NTFS

NTFS provides features such as:

• Permissions
• Ownership
• Compression
• Encryption
• Journaling

Most modern Windows systems use NTFS.

---

Ownership

Every file and directory has an owner.

Examples:

Administrator
SYSTEM
Alice

Ownership determines who controls the object and who may modify its permissions.

---

Permissions

Windows controls access through permissions.

Common examples:

• Read
• Write
• Modify
• Full Control

Permissions determine who can access files and what actions they may perform.

Example:

PS C:\Users\PC> icacls.exe C:\Windows
C:\Windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Administrators:(M)
           BUILTIN\Administrators:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

Permission concepts will be explored in greater depth later within the Privileges & Integrity Levels section.

---

Alternate Data Streams

NTFS supports additional hidden streams attached to files.

Example:

echo secret > report.txt:hidden

The file:

report.txt

appears normal.

However, an additional stream named:

hidden

also exists.

Alternate Data Streams can be used legitimately but have historically appeared in malware and persistence techniques.

Example:

PS C:\Users\PC\Desktop\Demo> Set-Content -Path .\report.txt -Stream hidden -Value "secret"
PS C:\Users\PC\Desktop\Demo> ls

    Directory: C:\Users\PC\Desktop\Demo

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---           6/18/2026  4:49 PM              0 report.txt

PS C:\Users\PC\Desktop\Demo> Get-Item .\report.txt -Stream *

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\Users\PC\Desktop\Demo\report.txt::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\PC\Desktop\Demo
PSChildName   : report.txt::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\PC\Desktop\Demo\report.txt
Stream        : :$DATA
Length        : 0

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\Users\PC\Desktop\Demo\report.txt:hidden
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\PC\Desktop\Demo
PSChildName   : report.txt:hidden
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\PC\Desktop\Demo\report.txt
Stream        : hidden
Length        : 8

---

Drive Letters

Windows commonly exposes storage through drive letters.

Examples:

C:
D:
E:

These may represent:

• Internal drives
• External drives
• USB devices
• Optical media
• Network mappings

Operators frequently enumerate available drives during investigations.

---

Operator Perspective

When approaching an unfamiliar Windows system, Operators typically ask:

Structure

• What drives exist?
• What directories exist?
• What storage is attached?

Files

• What files are present?
• What files were recently modified?
• What files appear unusual?

Ownership

• Who owns important files?
• Are permissions overly permissive?

Persistence

• What files execute automatically?
• What hidden files exist?

Evidence

• What exists within Downloads?
• What exists within Temp?
• Where are logs stored?
• Where are application files stored?

Understanding the file system provides the foundation for answering all of these questions.

---

Key Takeaways

• Windows organizes data using drives, directories, and files.
• Files are identified using paths.
• Paths may be absolute or relative.
• Most systems use the C: drive for the operating system.
• Files and directories have owners.
• Files and directories have permissions.
• Windows supports hidden files and directories.
• NTFS provides permissions, ownership, encryption, and journaling.
• Alternate Data Streams can store hidden data.
• Understanding the file system is foundational for both offensive and defensive operations.

The next lesson explores Users & Groups and how Windows manages identities and access control.