No Data, No Charge
Service Guarantee
Vital Solutions
provides you with a 'No Data, No Charge' policy on all recovery
projects. If for any reason we are unable to succeed in the recovery of
your data, we will not charge you.
This
inaugural “Technology You Should Know” column will feature a discussion about
file allocation tables and their interaction during a computer forensic
investigation. In the following months’ columns, deleted file retrieval, slack
and unallocated space, and more advanced technology topics such as encryption
and disk configuration, will be discussed.
File Systems determine
how and where files are placed on a hard drive, with the goal of trying
to optimize data retrieval, which is generally instructed by the
computer’s central processing unit (CPU). When looking for a file, the
File System uses the file allocation table (FAT) to determine where on
the hard drive the file has been placed, if it is a FAT based File
System. The file system can be likened to a library card catalogue
system that attempts to organize the location of books within the
library in the most optimal manner. To find a book, one looks up the
name in the card catalogue, which then points to the book's location.
Microsoft’s FAT and NTFS File Systems are two of the most common file
systems used in computer operating systems.
The FAT is used to
place files in free clusters of space on the hard drive (unlike a video
cassette tape or phonograph record where files are placed in a logical
order from beginning to end). Each entry in the FAT corresponds directly
to one cluster, with each cluster initially labeled as free or allocated
to a file. These cluster allocations can be 12, 16, or 32 bits long
(FAT12, FAT16, or FAT32). Only one file is allocated to a cluster, even
if that file does not fill up the entire cluster. A large file will be
allocated to several clusters
Read more
Copyright 2004,