Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: cradom
New Today: 0
New Yesterday: 1
Overall: 29283

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Final Year Project
 Android devices with PIN screen lock and without USBdebb. on
 Can file creation and modifications on pendrives be found?
 Viewing real MAC times of a timestomped file
 software that can view files in Volume Slack

Computer Forensics World Forums


Pages Served
We received
49924906
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Clusters - File slack
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Clusters - File slack

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues: Peripherals
View previous topic :: View next topic  
Author Message
NiGhtMarEs0nWax
Newbie
Newbie


Joined: Jul 13, 2009
Posts: 3

PostPosted: Tue Jul 14, 2009 3:09 am    Post subject: Clusters - File slack Reply with quote

Hey, im kind of an all round nerd and have just spent the last week getting to know hard drive technology better. i have a couple of questions regarding clusters and mapped out sectors that i think would be best to ask on a forensic forum.

when copying a file from one drive to the next, is the cluster tip copied along with it? what information is copied besides the actual file data?

secondly, how would you go about accessing/reading and backing up sectors mapped out of user space by S.M.A.R.T? can information be accurately retrieved?

besides the HPA/DCO and bad sectors, (assuming only one partition) where else on the physical drive could i recover useful data? i notice a space when installing windows labelled "unpatitionable space" anyone know what that is for?


Thanks in advance.
Back to top
View user's profile
NiGhtMarEs0nWax
Newbie
Newbie


Joined: Jul 13, 2009
Posts: 3

PostPosted: Thu Jul 16, 2009 1:14 am    Post subject: Reply with quote

noone has an answer for this?
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Thu Jul 16, 2009 3:07 am    Post subject: Reply with quote

First. What OS? What method of "copying"?

Second. With a hex viewer or similar. Typically.

Third. It depends, slack, Windows Registry, etc. Useful data is not just in one place and it really depends on what constitutes useful.

Forth. This??? Article ID: 293281 - support dot microsoft dot com/kb/293281
Back to top
View user's profile
NiGhtMarEs0nWax
Newbie
Newbie


Joined: Jul 13, 2009
Posts: 3

PostPosted: Thu Jul 16, 2009 11:06 pm    Post subject: Reply with quote

Windows XP, standard drag and drop. i guess i really just want to ask is that if the entire cluster is copied? or juft the file data itself copied acroos then to fill a brand new cluster.

can a standard hex viewer (such as winhex) run within a windows environment bypass rules set at the hardware level? such as S.M.A.R.T.

i was thinking more of the sectors on disc, and not what's part of a windows environment. the lowest possible view of a disc, what sections make up a disc that data coule be retrieved from. obviously mapped out sectors would be one example, hpa & dco would be two more. is there any other "hidden" sectors that i can examine?

thanks, that article explained a bit.

Thanks for the reply. Smile
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues: Peripherals All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.