Skip to Content
Cyber Forensics: From Data to Digital Evidence
book

Cyber Forensics: From Data to Digital Evidence

by Frederic Guillossou, Albert J. Marcella
May 2012
Beginner
342 pages
8h 6m
English
Wiley
Content preview from Cyber Forensics: From Data to Digital Evidence

CHAPTER SEVEN

Volume versus Partition

IN CHAPTER 5 WE DISCUSSED the boot-up process after touching upon important key concepts, files in Chapter 4, and in Chapters 2 and 3, HEX and binary.

We have also discussed the importance of the Master Boot Record (MBR) and its contents such as the partition table, and how the system identifies the active partition (HEX 80) and its starting sector and its size.

In order to explain how some of the data contained within the partition table is interpreted we deviated and delved into endianness. Being that the order of some of the data contained within the MBR is subjected to this endianness, it was imperative to expound upon how data is ordered and the importance of endianness, as it affects data within the MBR.

To continue on to the next step in our sequence, the process of data being assembled into human interpretable information, it is necessary for those data to be located and identified by the system.

We know already how the active partition’s starting sector and its size are derived from the partition table; however, there are several additional byte offsets within the partition table which we have not yet discussed.

These offsets, called Cylinder, Head, and Sector (CHS) or, more currently, Logical Block Address (LBA), help to quantify partition location and size.

This chapter explains how partitions are located and identified and the significant role of volumes in making these data “mountable” or accessible and readable by your system ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

AirBnbBlueOriginElectronic ArtsHomeDepotNasdaqRakutenTata Consultancy Services

QuotationMarkO’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
QuotationMarkI wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
QuotationMarkI’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
QuotationMarkI'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Mark W.
Embedded Software Engineer

You might also like

Cyber Crime and Cyber Terrorism Investigator's Handbook

Cyber Crime and Cyber Terrorism Investigator's Handbook

Babak Akhgar, Andrew Staniforth, Francesca Bosco
Cyber Crime Investigations

Cyber Crime Investigations

James Steele, Anthony Reyes, Richard Brittson, Kevin O'Shea
Digital Triage Forensics

Digital Triage Forensics

Stephen Pearson, Richard Watson

Publisher Resources

ISBN: 9781118273661Purchase book