October 14th, 2017, 14:11
Link to case 2:
https://rusolut.com/page-structure-analysis/#case2In the last second, just after defining LBN in SA, the two last bytes in SA is left untouched. What are these two bytes? How can I be sure that these are not LBN, or a part of it? I'm aware that the trained eye of an expert can see this immediately, but I cannot (yet).
If I get into a spare area like this, are there any tests / tricks I can apply to make sure I define the correct LBN bytes?
October 16th, 2017, 15:51
Empty bytes (FF or grey in bitmap) you just leave undefined usually, software will ignore it.
Usually LBN consists of 2 bytes of counter, one byte grows slow another fast so that you can see a dynamically changed patterns in SA from block to block.