Understanding and o...
 
Notifications
Clear all

Understanding and organizing your references

4 Posts
3 Users
0 Reactions
410 Views
(@brianb23)
New Member
Joined: 13 years ago
Posts: 3
Topic starter  

I'm wondering how everybody out there organizes their references, for example how do you keep track of your partition volume and file system layout tables ?

Example a Dos partition table

0-445 Boot code
446-461 Partition Table entry #1
…..
510-511 Signature value (0XAA55)

What method do you use for refences like this, for data structure tables for other OSs, an online guide ? Software ? a Reference guide such as Lock and Codes guide ? I'm wondering what methods everyone uses for something like this ?

thanks
B


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Example a Dos partition table

0-445 Boot code
446-461 Partition Table entry #1
…..
510-511 Signature value (0XAA55)

Well, no.
(in the sense that is not a "DOS" partition table reference)

That is a MBR reference (not necessarily "DOS") and it misses the Disk Signature (four bytes @offset 440) that is used in any NT based system.

For this I personally use my MBRview structure viewer for Tiny Hexer or the small CHSLBA spreadsheet I made, see
http//www.forensicfocus.com/Forums/viewtopic/p=6539032/#6539032
so I would say (in order of most common use)

  1. software
  2. self-made spreadsheets, notes
  3. documentation (text, pdf, etc.)
  4. online reference (like the Starman's pages, as an example)
  5. [/listo]

    jaclaz


   
ReplyQuote
erowe
(@erowe)
Estimable Member
Joined: 18 years ago
Posts: 144
 

I use EndNote (http//endnote.com/).

It's designed more for academic use as a citation management tool, but it allows me to keep track of web sites, PDFs, forensic software, and just about any document or piece of software I download. I can just lump them into groups that I create, and it's easy to put the same reference material into more than one group (e.g. Firefox forensics and SQLite).

I can also for instance save Forensic Focus posts as PDFs and keep both the referring URL and the PDF under the same listing. Another nice thing is that it has a Notes field that allows you to add your own notes to the reference (or downloaded material) in case there's anything special you want to remember (e.g. registration keys or notes on how to do certain things).


   
ReplyQuote
(@brianb23)
New Member
Joined: 13 years ago
Posts: 3
Topic starter  

Thanks to the replies. it seems there is no definitive "go to" guide out there, lots of places to find what you need, or organize in your own way as you've stated, and that's what I was expecting, but I like to hear from people already in the field, as i'm getting there….


   
ReplyQuote
Share: