Support for File Sy...
 
Notifications
Clear all

Support for File System Forensic Byte Offset , Field Length

2 Posts
2 Users
0 Likes
252 Views
(@wasantha)
Posts: 1
New Member
Topic starter
 

Hi,

I am studying for a Forensic certification and found the below question in a sample. Need someones support for Calculating how many hidden sectors, total sectors, sector size when ONLY following information is available.Is this information is enough ?

Byte Offset , Field Length , Name

11,2,Bytes Per Sector
13,1,Sectors Per Cluster
28.4.Hidden Sectors
40,8,Total Sectors
48,8,Logical Cluster # for the MFT
56,8,Logical Cluster # for the MFT Mirror

Thanks
Wasantha

 
Posted : 12/04/2017 8:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

What do you mean "calculate"? ?
hidden sectors=28.4.Hidden Sectors
total sectors=40,8,Total Sectors
sector size=11,2,Bytes Per Sector

There is nothing to "calculate", you simply read the values in those fields.

jaclaz

 
Posted : 12/04/2017 10:10 pm
Share: