## Windows File System

Unlike Linux (start at `/`), Windows starts at a Drive Letter, usually `C:`.

### Key Directories
1.  `C:Windows`: The OS core.
    *   `System32`: Critical DLLs and Executables. (Note: On 64-bit systems, System32 contains 64-bit files. `SysWOW64` contains 32-bit files. Confusing, but legacy.)
2.  `C:Users`: User profiles.
    *   `C:UsersBobDesktop`, `Downloads`, etc.
    *   `AppData`: Hidden folder storing app settings (Chrome history, Discord cache). Great for forensics.
3.  `C:Program Files`: Where 64-bit apps live.
4.  `C:Program Files (x86)`: Where 32-bit apps live.
5.  `C:PerfLogs`: Performance logs. Often empty, but sometimes writable by everyone (PrivEsc vector!).

### ADS (Alternate Data Streams)
A hidden feature of NTFS. A file can have "sub-files" hidden behind it.
*   `echo "Hidden Data" > innocent.txt:secret.txt`
*   `innocent.txt` looks normal. 0 bytes change.
*   Hackers use ADS to hide malware inside benign files.
*   **Detection**: `dir /R` shows streams.

### Permissions (ICACLS)
Windows uses ACLs (Access Control Lists).
*   **Full Control**: God mode.
*   **Modify**: Read/Write/Delete.
*   **Read & Execute**: Run programs.
*   **tool**: `icacls file.txt` (View permissions).