Re: [sleuthkit-users] USB flash disk and TSK

[youcef b. <ybi...@ya...>]

Thanks for the clarification. I was using the last
sector instead of total sectors that's why I needed to
add 1.

regards

youcef


--- Brian Carrier <ca...@sl...> wrote:

> 
> On Sep 21, 2005, at 4:57 PM, youcef bichbiche wrote:
> 
> > Hi Brian,
> >
> >
> >> how many sectors do you get if you image the
> device?
> >>
> > this is the ouptut of the dd command:
> >
> > 252840+0 records in
> > 252840+0 records out
> > 129454080 bytes (129 MB) copied, 144.047 seconds,
> 899
> > kB/s
> 
> That is fewer than expected based on the mmls and
> fsstat output.
> 
> > Brian I was following your wondefull book for the
> FAT
> > analysis and I stumbled on page 225 when you gave
> a
> > formula on how to determine if there are unused
> > sectors.
> >
> > the fomular says:
> > (total sectors - address of cluster 2) / (number
> of
> > clusters per cluster)
> >
> > my understanding is that the formual should be:
> >
> > (total sectors - address of cluster 2)+1 / (number
> of
> > clusters per cluster)
> >
> > Am I correct or is it just one of my late night
> > reading syndrome.
> 
> nope, the formula in the book is correct. Consider a
> very small  
> example where there are 9 sectors (0 to 8) and
> cluster 2 starts in  
> sector 2 (i.e. 2 sectors before data area and 7 in
> the data area).  
> Let each cluster be 2 sectors:
> 
> (9 - 2) / 2 = 3.5
> 
> There is a remainder, which means there is an unused
> sector (sector 8  
> in this case).
> 
> brian
> 
> 



	
	
		
___________________________________________________________ 
Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com