Cyber Forensics: From Data to Digital Evidence

CHAPTER FIVE

The Boot Process and the Master Boot Record (MBR)

IN CHAPTER 4, OUR DISCUSSIONS further examined HEX. Also discussed was the relevance of HEX when examining file signature metadata. We noted that some data contained within a file cannot be viewed in a legible or searchable text format such as ASCII or Unicode, specifically data contained within file headers, such as the file signature, thus the necessity of a working knowledge of HEX.

This was made even more apparent as we explored complex files including compound and compressed files, files that contain even more data which is not legible in a text based code, specifically the instructions on how to assemble the complex file. In explaining these file structures we noted that these files needed to be “mounted” in order for the data to be “extracted” or “assembled.”

As we discussed previously, mounting a file is the process of making a file ready to be used by compatible software. The process described by the word “mount” may very well derive its name from a similar process that occurs on a larger, overarching scale with a computer’s operating system. This “system-wide” file-mounting process must occur in order for any data contained within a hard drive to be made accessible, and to be acted upon.

Mounting is the process of taking the raw data contained on a hard drive or other storage media and making it accessible, legible, and useable information. In essence, it is the process of taking the magnetically stored 0s ...