Cyber Crime and Cyber Terrorism

82
CHAPTER 7
Seizing, imaging, and analyzing digital evidence
MASTER BOOT RECORD
The MBR is stored on the first sector of the hard disk and is created along with the first 
partition on the drive. It is loaded into memory as one of the first actions during system 
start up. The MBR is comprised of a small section of operating system independent 
code, a disk signature, the partition table and an MBR signature. The disk signature is a 
unique four byte identifier for the hard drive, that is to say it should be unique for each 
drive attached to a system. It is used for purposes such as identifying the boot volume, 
and associating partitions and volumes with a specific drive. The MBR signature, some-
times referred to as the magic number, is set to value 0xAA55, which simply identifies 
it as a valid MBR. The partition table informs of the start position and length of each 
partition on the hard disk. During system start up the MBR code is executed first, and is 
responsible for parsing the partition table and identifying which partition is marked as 
active. Once the active partition is identified control is passed to that partitions boot sec-
tor, sometimes referred to as the volume boot record (VBR). The VBR is created when 
the drive is high level formatted for the use with a particular operating system.
THE VBR AND BIOS PARAMETER BLOCK
The VBR contains the operating system specific code necessary to load the operating 
system, along with a BIOS parameter block (BPB) which describes the partitions file 
system format, e.g., the number of tracks per sector and the number of sectors per 
cluster. Clusters, often referred to as allocation units or AUs, are the smallest stor-
age area accessible by the operating system. The file system allocates multiple sec-
tors, e.g., eight, to an individual cluster to reduce the overhead of disk management, 
this results in faster read and write speeds but also results in some disk space being 
wasted when storing files, or parts of files, which are smaller than the cluster size. 
This wasted space in the clusters is referred to as slack space.
FILE SYSTEM
Numerous file systems exist which support numerous different operating systems, 
each works differently yet all have the same primary aim; namely to manage how 
files and directories are stored, indexed, written and read. Along with the VBR they 
are created at the point at which the drive is formatted, and are loaded during the boot 
process from the VBR. Examples of file systems are NTFS, FAT32, ext4, XFS, and 
btrfs. Detailed discussion of file systems is beyond the scope of this chapter.
FILE TABLE
File tables hold information about each and every file, including its location, size, 
permissions, time stamps and whether it has been deleted, i.e., has the space been 

---