Re: [sleuthkit-users] USB flash disk and TSK
Brought to you by:
carrier
From: Brian C. <ca...@sl...> - 2005-09-22 06:30:13
|
On Sep 21, 2005, at 4:57 PM, youcef bichbiche wrote: > Hi Brian, > > >> how many sectors do you get if you image the device? >> > this is the ouptut of the dd command: > > 252840+0 records in > 252840+0 records out > 129454080 bytes (129 MB) copied, 144.047 seconds, 899 > kB/s That is fewer than expected based on the mmls and fsstat output. > Brian I was following your wondefull book for the FAT > analysis and I stumbled on page 225 when you gave a > formula on how to determine if there are unused > sectors. > > the fomular says: > (total sectors - address of cluster 2) / (number of > clusters per cluster) > > my understanding is that the formual should be: > > (total sectors - address of cluster 2)+1 / (number of > clusters per cluster) > > Am I correct or is it just one of my late night > reading syndrome. nope, the formula in the book is correct. Consider a very small example where there are 9 sectors (0 to 8) and cluster 2 starts in sector 2 (i.e. 2 sectors before data area and 7 in the data area). Let each cluster be 2 sectors: (9 - 2) / 2 = 3.5 There is a remainder, which means there is an unused sector (sector 8 in this case). brian |