COMFIC lec 5- lab in progress

Lecture 5- Volume partitions

Volumes- used to store file system and data structures

Collection of addressable sectors that can be used

Partitions- collections of consecutive sectors IN a volume

Note how the partitions form the volume

Here we can see that partition 1 of the hard drisk starts at 0 and ends at 100- it is a FAT type file system and is PART of the hard disk volume

In Unix systems, the volume has different directories such as /etc/usr within it

Addressing explained

The LBA- logical book addressing starts from sector 0

It refers to the physical address of a sector (also the logical address volume)

Note: logical partition address is the address relative to the partition

So looking at the second one, its physical address is 50, logical is therefore 50

They are always the same

But address relative to partition is the logical partition address

So note that for the third arrow its 100 because 150-50=100

DOS partitions

Used for: IA32 hardware

Supports windows, linux and other systems

Disk has a MBR –Master Boot Record of 512 bytes, containing boot code, partition table and signature value

Boot code- first sector 0 of size 446 bytes, tells computer how to process table and locate os (this is where you’ll find most viruses)

Need to look out forc certain hex e.g 1c tells us of hidden FAT16, LBA

Needs work

Practical remarks

Boot code and partition table require only 1 sector 0

63 sectors usually allocated for MBR- 1-62 may have hidden data

If table destroyed- cover first partition with dd if=disk bs=512 skip=63 of=part

Apple partitions

Found in latest apple

First entry specifies how many partitions there are

Need more work

Digital Forensics