Posted: Tue Jul 14, 2009 3:09 am Post subject: Clusters - File slack
Hey, im kind of an all round nerd and have just spent the last week getting to know hard drive technology better. i have a couple of questions regarding clusters and mapped out sectors that i think would be best to ask on a forensic forum.
when copying a file from one drive to the next, is the cluster tip copied along with it? what information is copied besides the actual file data?
secondly, how would you go about accessing/reading and backing up sectors mapped out of user space by S.M.A.R.T? can information be accurately retrieved?
besides the HPA/DCO and bad sectors, (assuming only one partition) where else on the physical drive could i recover useful data? i notice a space when installing windows labelled "unpatitionable space" anyone know what that is for?
Windows XP, standard drag and drop. i guess i really just want to ask is that if the entire cluster is copied? or juft the file data itself copied acroos then to fill a brand new cluster.
can a standard hex viewer (such as winhex) run within a windows environment bypass rules set at the hardware level? such as S.M.A.R.T.
i was thinking more of the sectors on disc, and not what's part of a windows environment. the lowest possible view of a disc, what sections make up a disc that data coule be retrieved from. obviously mapped out sectors would be one example, hpa & dco would be two more. is there any other "hidden" sectors that i can examine?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum