Cyber Forensics: From Data to Digital Evidence

CHAPTER SIX

Endianness and the Partition Table

When 900 years you reach, look as good, you will not.

—Yoda

Speak in Big Endian, most of us do.

—Authors

SOME HUMAN LANGUAGES are read and written from left to right; others from right to left; some from bottom to top and others from top to bottom. The order in which data is assembled can vary dramatically from culture to culture, region to region, and country to country.

In the United States and many North American countries, for example, the following date 12/09/12 would represent December 9th, 2012; in the United Kingdom (UK), and many European countries, however, this would represent the date September 12th, 2012. What happened? Why do we have this confusion? This is because the order and interpretation of the numeric values are viewed differently by different society groups.

In the United States the date has been and continues to be traditionally written as MM/DD/YYYY, whereas in many other societies/countries around the globe, representation of the current date is written and viewed as DD/MM/YYYY. That said, even in the United States, the recording and displaying of the date is sometimes shown as DD/MM/YYYY (e.g., U.S. customs immigrations entry forms for all persons arriving into the United States from a foreign country use the DD/MM/YYYY date format). Thus, data representation is not consistent, even within the same country.

In order to correctly interpret these data in the given date format used, the order in which the information ...