Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: djksjk7
New Today: 0
New Yesterday: 3
Overall: 29625

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 How much can be found?
 Computer Forensic in responding to Data Breach issues
 A bunch of numbers about digital evidences collection
 Computer forensic issue
 A Survey on the Internet of Things Digital Forensic Research

Computer Forensics World Forums


Pages Served
We received
58315760
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - HxD FAT 16 flash drive..
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

HxD FAT 16 flash drive..

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Forensics
View previous topic :: View next topic  
Author Message
onymousillusion
Newbie
Newbie


Joined: Oct 31, 2011
Posts: 12

PostPosted: Wed Dec 14, 2011 11:21 am    Post subject: HxD FAT 16 flash drive.. Reply with quote

Ok so I just got done my first class of computer forensic for this semester. I download HxD and format my flash drive FAT16 (because I only learned about FAT 12 and 16). well when i decoded the boot i stumble onto some questions i was hoping someone could help me with.

bytes 14 - 15 I was told that this tells you "Number of reserved sectors. FAT 12/16 use 1. FAT 32 uses 32" well when i decoded it the number i got was "00 08 in little endian and when you go to big endian you get 08 00 and the number you get is 2048" not 1.. ?

I decoded the bytes 54-61 to see what file system is in use and it is FAT 16 so i know its the right FAT..

and is there any way to search by cluster instead of sectors in HxD.. Or if anyone has a good tutorial on HxD that would be great.. Smile

any help would be appreciated
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 241

PostPosted: Wed Dec 14, 2011 6:25 pm    Post subject: Re: HxD FAT 16 flash drive.. Reply with quote

onymousillusion wrote:
and is there any way to search by cluster instead of sectors in HxD..


'Cluster' is a concept which applies only 'inside' file systems -- at least as far a FAT is concerned. HxD doesn't do file systems, it only does raw data streams or sectored data, so you need to do the conversion to clusters on your own.

Or look for a tool that knows about file systems. I'd guess WinHex might be better in this respect.
Back to top
View user's profile
onymousillusion
Newbie
Newbie


Joined: Oct 31, 2011
Posts: 12

PostPosted: Thu Dec 15, 2011 1:40 pm    Post subject: Reply with quote

Thanks man, I have winHex but I'm still trying to figure it out. Thanks for the reply.
Back to top
View user's profile
onymousillusion
Newbie
Newbie


Joined: Oct 31, 2011
Posts: 12

PostPosted: Fri Dec 16, 2011 3:17 am    Post subject: Re: HxD FAT 16 flash drive.. Reply with quote

onymousillusion wrote:

bytes 14 - 15 I was told that this tells you "Number of reserved sectors. FAT 12/16 use 1. FAT 32 uses 32" well when i decoded it the number i got was "00 08 in little endian and when you go to big endian you get 08 00 and the number you get is 2048" not 1.. ?


sorry little endian its 08 00 in big endian 00 08 which makes it 8 but still not one.. Sad I been messing about with it but still can't figure it out... any help will be appreciated Smile
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 241

PostPosted: Fri Dec 16, 2011 6:03 am    Post subject: Re: HxD FAT 16 flash drive.. Reply with quote

onymousillusion wrote:

sorry little endian its 08 00 in big endian 00 08 which makes it 8 but still not one.. Sad I been messing about with it but still can't figure it out... any help will be appreciated Smile


A value of 8 is rather odd ... what formatting program did you use (and on what platform). How about posting the first 32 bytes or so of the boot sector (in hex).
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Forensics All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.