Hi Everyone, I have been reading many posts in the rich forum, and this is my first simple question,
I am knew to this, I just downloaded WinHex and FTK, but I do not seem to find where to look for these references
I have a copy of floppy image
Bytes per Sector
Sector Count
Thanks in advace
Hi Zinman,
In WinHex there are several ways to see this information. It also might depend on which version you are using and whether you have the forensic version or not.
But, in general Open the image in WinHex. If it is an image file, you will have to use the Specialist -> Interpret Image File As Disk feature to "see" the logical structure. At this point the information should be on the screen. In the bottom left corner of the hex view, you should see a counter showing which sector you are viewing. It should show something like 0 of 2880. The bytes per sector figure should be showing in the Details Panel on the right hand side. If not, click View->Show->Details Panel.
Another option is to put the cursor on the first byte of the disk image and choose View->Template Manager. Then choose Boot Sector FAT. The template manager will open and show the details you want. And, as a bonus, WinHex will show you the offsets to read the info yourself.
If you learn to use it, WinHex is an incredible program (not quite as full featured as FTK or EnCase, but….). It is the best program for data recovery (in my humble opinion).
Good luck.
Most programs designed for recovery try to do too much for you. They don't always give you the freedom that you might need. In exchange, they are very easy to use with little training.
WinHex is a full featured forensic analysis environment (..maybe e-mail recovery is a weakness…) so it gives you total control. The trade off is that you have to spend some time learning to use the features.
What I like
Easy access to the hex underlying the files.
Aggressive data carving.
A simple right click to recover deleted files that still have FAT/MFT/directory information.
It is mostly manual. I decide what to recover, not the program. If a file is fragmented, I can look at the hex for the fragments and not rely on some program blindly reconstructing parts and then telling me that the file is corrupt.
Also if you need to image a damaged drive, my experience is that WinHex chugs through bad sectors and keeps going better than any other program. I've been able to get nearly complete images with WinHex when EnCase wouldn't even start!
In all likelihood, the reason I like it so much is that I attended training with Stefan Fleischmann, learned to use the program well and appreciate its power. Once I was comfortable with it, why would I buy any other program just because it is easier to learn?