One of the primary uses of computing is the ability to work with files. These files might be used by the operating system itself, or other applications and programs.

In this section, you will learn how to explain the concept of virtual memory, and how this can cause long-term residuals of activity. We will look at how both the Linux and Windows operating systems manage virtual memory, and how journaling, alternative data streams, and metadata are produced and managed differently by Linux and Windows.

While we have already considered some of the restrictions that result from the filesystem format, operating systems also utilize resources differently, meaning that system files are created, read, updated, and destroyed in different ways. Operating systems also implement different methods of making, finding, and editing user files. This information can be particularly useful for cybersecurity researchers.