Cyber Forensics: From Data to Digital Evidence

CHAPTER SEVEN

Volume versus Partition

IN CHAPTER 5 WE DISCUSSED the boot-up process after touching upon important key concepts, files in Chapter 4, and in Chapters 2 and 3, HEX and binary.

We have also discussed the importance of the Master Boot Record (MBR) and its contents such as the partition table, and how the system identifies the active partition (HEX 80) and its starting sector and its size.

In order to explain how some of the data contained within the partition table is interpreted we deviated and delved into endianness. Being that the order of some of the data contained within the MBR is subjected to this endianness, it was imperative to expound upon how data is ordered and the importance of endianness, as it affects data within the MBR.

To continue on to the next step in our sequence, the process of data being assembled into human interpretable information, it is necessary for those data to be located and identified by the system.

We know already how the active partition’s starting sector and its size are derived from the partition table; however, there are several additional byte offsets within the partition table which we have not yet discussed.

These offsets, called Cylinder, Head, and Sector (CHS) or, more currently, Logical Block Address (LBA), help to quantify partition location and size.

This chapter explains how partitions are located and identified and the significant role of volumes in making these data “mountable” or accessible and readable by your system ...