This is a stupid post but necessary at the same time, im looking at records in hex in FTK and want to see the physical sector number, however when i drag over certain records the physical sector number appears to be too large and goes onto a new line, being hidden from view by a frame.
Can anyone help? this is most infuriating haha.
Might help to know which hex editor you're using.
I'm looking at it in the FTK overview tab in hex view
forenz,
What view are you looking at to see this? When I go to the Overview or Explore tab and look at a file in hex, the Selection start= ,length= ;cluster= ;physical sector= are left justified in the frame. It would take a very very large number to run off the edge of the frame.
I guess if your resolution were 800x600 it might not fit, but otherwise . . .
Its when i drag over hex, "selection start = 16282100, length = 17" appear in front of "cluster, logical sector, physical sector" and "physical sector" drops down to another line in the frame, if you can call it a line, so i am unable to read the value, i can see the tops of numbers but not make them out cry
My screen resolution is 1024x768
I cannot recreate the two line display problem. This is something I would send to AD support. My only suggestion is the sometimes helpful often useless suggestion to reinstall the app to reset everything to default settings.
Which tab are you viewing the data in?
Perhaps trying viewing the item/s in the 'search' tab where the preview panel is the complete width of the application.
If that's not the issue, can you post a screen dump?
Could this be solved with a bigger screen or different resolution? Try making the desktop 1600x1200???
Never saw this before….