Hi All,
This is my 1st post - so it may be v simple but I have to start somewhere! I am new to forensic computing and currently in year 1 of a Masters in the area. We have been asked the following question in a Lab related to FAT16
Generally every html file has starting and ending html tags. Yet typically, a search through slack space for the string "<html" yields fewer results than for the string "</html". Why is this?
Is this as simple as, data from files remain in memory until overwritten & therefore the presence of HTML closing tags indicates eof's that have not yet been overwritten? Or is there more significant attached to HTML files? Does it indicate RAM slack ?
Thank you!
My money, if I had any, would be on more "<html" being overwritten than "</html".
Why? Because they are at the start of the cluster and will always get overwritten first.
Ockhams Razor - it has worked for the last 600 years so there must be something to it.
Regards
Steve
Cheers Steve - makes sense!