• Windows Operating System is a complex product with many system files, utilities, settings, features, etc
• History of Windows you can read here:

Windows Fundamentals 1

The File System

• The file system used in windows is new Technology file system (NTFS)
• Before NTFS there was FAT16/FAT32(File Allocation Table) and HPFS(High Performance File System).
• FAT partitions are used today in USB devices, MicroSD Cards.
• NTFS is known as journaling file system. In case of failure, the file system can repair itself using information stored in log file.

NTFS addresses many of the limitations of the previous file systems; such as:

• Supports files larger than 4GB

• Set specific permissions on folders and files

• Folder and file compression

• Encryption (Encryption File System or EFS)

• On NTFS volumes, you can set permissions that grant or deny access to files and folders.

• The permissions are:

  • Full control
  • Modify
  • Read & Execute
  • List folder contents
  • Read
  • Write

  The below image lists the meaning of each permission on how it applies to a file and a folder.

  

  How can you view the permissions for a file or folder?

  • Right-click the file or folder you want to check for permissions.
  • From the context menu, select Properties.
  • Within Properties, click on the Security tab.
  • In the Group or user names list, select the user, computer, or group whose permissions you want to view.

  In the below image, you can see the permissions for the Users group for the Windows folder.

  

  • Alternate Data Streams is a file attribute specific to Windows NTFS.
  • Every file has at least one data stream ($DATA), and ADS allows files to contain more than one stream of data. Natively Window Explorer doesn't display ADS to the user. There are 3rd party executables that can be used to view this data, but Powershell gives you the ability to view ADS for files.
  • From a security perspective, malware writers have used ADS to hide data.

The Windows\System32 Folders

• The Windows Folder (C:\Windows) is the traditionally known as the folder which contain the Windows operation system.
• The folder doesn’t have to reside in the C drive specifically.
• This is where system environment variables come into play.