forensic computing - a practitioner's guide, 2nd ed.

[...]... two stable states: in a memory chip, for example, a transistor switch may be on or off; in a communications line, a pulse may be present or absent at a particular place and at a particular time; on a magnetic disk, a magnetic domain may be magnetized to one polarity or to the other; and,on a compact disc ,a pit may be present or not at a particular place These are all examples of two-state or binary devices... defined American Standard Code for Information Interchange Any character we wish could be associated with any of the 256 binary patterns So, for example, we could define quite arbitrarily that the character A be represented by “00001000” and the character “B” be represented by “00001001” and so forth In practice, the association between a particular character and particular binary pattern has to be standardized... that a standard approach can be taken to its analysis This is not the case with organizers, where few standards are apparent and each organizer or PDA typically has to approached differently The chapter 6 Forensic Computing begins by outlining the technical principles associated with electronic organizers and identifying their major characteristics We then go on to consider the application of the ACPO... binary value of the mantissa field is clearly 1 × 2–1 = 0.5 However, with this format, by definition and as indicated in the diagram, the value of the mantissa always has an implied 20 = 1 added to it (note that it starts at 2–1 in the diagram) As a result, the actual value of the mantissa is 0.5 + 1 = 1.5 The overall decimal value of the number is thus: 1.5 × 22 = 1.5 × 4 = 6.0 As we have seen above,... data extraction of resident data from the MFT record is demonstrated The various attributes are each described in detail and a second example of an MFT file record with non-resident data is then deconstructed line by line at the hexadecimal level This leads to an analysis of virtual cluster numbers and data runs Analysis continues with a sample MFT directory record with resident data and then an examination... of the translation algorithms LBA is discussed and a number of BIOS related problems are considered New features in the later ATA specifications, such as the Host Protected Area, are mentioned and a summary of the interface and translation options is then given Details of fast drives and big drives are given, with particular reference to 48 bit addressing, and mention is made of Serial ATA This is... known languages It was originally defined as a 31 bit character set and sub-sets within it which differ only in the least significant 16 bits are known as planes The most commonly used characters have been placed into what is called the Basic Multilingual Plane (BMP) or Plane 0, and, within that plane, the UCS characters U+000010 to U+007F are identical to those of ASCII The value U+00 5A, for example,... cannot exist independently of the receiving person who gives it meaning and somehow acts upon it That action usually includes analysis or at least interpretation, and the differences between data and information must be preserved, at least in so far as information is data arranged in a meaningful way for some perceived purpose.” This last view suits our needs very well: “ information is data arranged... and Appendix 11 explains the significance of alternate data streams A detailed technical understanding of where and how digital information can be stored is clearly of paramount importance, both from an investigative point of view in finding the information in the first place and from an evidential point of view in being able to explain in technically accurate but jury-friendly terms how and why it was... International Organization for Standardization (ISO)9 Fortunately, in the early 1990s, members of the two project teams commenced working together on creating a single code table, and the two standards are now compatible The Universal Character Set (UCS), defined by ISO 10646, is a superset of all other character set standards It contains those characters that are required to represent practically all