Sie sind auf Seite 1von 6

Digital Forensic

File Recovery

Michael Wilkinson

Now you can do some work!


How is data stored on a disk?
ones and zeros
100110110100011010101010100001001001010010100110111

But to make life easier we can use hex


A3D4C1

Michael Wilkinson

Numbering
systems

Binary

Hexade
cimal

Decimal

10

11

100

101

110

111

1000

1001

1010

10

1011

11

1100

12

1101

13

1110

14

1111

15

Michael Wilkinson

How does the hard drive know


where find a file?
Divide the numbers into sectors
sector 1

sector 2

sector 3

20656E2D55533B2072

763A312E392E302E31

3529204765636B6F2F

512 bytes

512 bytes

512 bytes

Michael Wilkinson

But what about the operating


system?
Cluster 1

Cluster 2.....

sector 1

sector 2

sector 3

20656E2D55533B2072

763A312E392E302E31

3529204765636B6F2F

512 bytes

512 bytes

512 bytes

Michael Wilkinson

But wait there is more.


Boot sector
The file system
FAT 1

Reserved sectors

FAT 2
Root directory
Cluster 2
Cluster 3
Cluster 4
.........
Michael Wilkinson

Das könnte Ihnen auch gefallen