Anything related to computer forensics (new section!)
December 12th, 2019, 9:25
Hello I have a drive which I am testing. I have formatted it and examined in FTK Imager. And partition size seems 156.297.216 sector length. But when I click properties on Windows it says disk size is 80.024.170.496 byte (156.297.208 sector) size. Where comes this 8 sector difference. I think this area is for partition boot code and OS doesnT show this area to user. What is the reason actually?
December 12th, 2019, 16:01
The IDEMA standard specifies the LBA count as ...
LBA count = (97,696,368) + (1,953,504 * (Advertised Capacity in GBytes – 50))
So ...
(97,696,368) + (1,953,504 * (80 – 50)) = 156,301,488 LBAs
That's a difference of 4272 sectors. I suspect that the formatter terminated the partition on a [logical] cylinder boundary.
Could we see the partition table (sector 0) and the volume boot sector?
December 12th, 2019, 16:19
I suspect that the 8 sector difference is because the drive uses AF 4K sectors. The higher number is the number of sectors available while the lower number is the maximum sector number.
December 12th, 2019, 16:35
The OP isn't clear, but AIUI the drive is an 80GB model, in which case it predates AF.
December 12th, 2019, 19:27
True. Then it makes no sense at all.
December 13th, 2019, 1:58
Hello again
Drive LBA Count is: 156301488 (like fzabkar said)
I have formatted disk and there is just one partition. And when I look at the first sector on FTK Imager it says partition begins at sector 2048 and it is 156297216 sector length.
But when I look at the properties of drive on windows it says 80024170496 byte which equals to 156297208 sector.
I send screenshots. So why there is difference between FTK and windows?
- Attachments
-
-
- OS size.JPG (40.61 KiB) Viewed 17074 times
-
Powered by phpBB © phpBB Group.