the types of space and file system structure

1. Slack space

Slack space refers to portions of a hard drive that are not fully used by the current allocated file and which may contain data from a previously deleted file.

 Illustration of slack space on a hard drive:

    In the example above, saving a 768 byte file (named User_File.txt) requires only sector 1 and 1/2 of sector 2 in the cluster. 
Depending on the operating system, the remaining 256 bytes in sector 2 might be filled with 1′s or 0′s or might simply remain intact.  Both sectors 3 and 4 would not be overwritten and are thus considered slack space.

   If the slack space previously contained data from a deleted file, this information could be recovered with forensic tools. Additional Details Operating systems allocate files on a hard drive using clusters, which are a collection of contiguous sectors. Because a cluster is the smaller allocation unit an operating system can address, if a file does not utilize the full cluster, a portion of the space remaining may not be overwritten and might contain data from a previously deleted file.

For forensic analysts, it is important to understand that slace space is considered allocated space since it is part of an allocated cluster.  As such, special tools must be used to extract and analyse slace space.  An analysis of unallocated data will not contain any slack space data.

   2. unallocated space

Unallocated space is simply defined as the area or space on the hard drive of the computer that is available to write data to.

   The unallocated space is not viewable to the typical computer user and requires specialized computer forensic software to view and analyze. Unallocated space can contain deleted files or partially deleted files. When a file is deleted, the pointers to the file are removed, but the data remains in unallocated space until such time as the operating system stores another file in the same space, thereby over-writing the data.

A good analogy for what the content of unallocated space would look like is if two boxes of paper were tossed into the air and allowed to fall to the floor. The first box would contain all documents written in the English language. The second box would contain all documents written in a foreign language. Someone would then collect all the paper and put the pages into a larger box , unsorted in no particular order. The English pages Could be easily read, but the foreign language Could not and the pages would be all jumbled together.

3. magic number (programming)

A numeric value or constant text used to identify the file format or protocol; to file,

 magic number in files :

Magic numbers are common in programs across many operating systems. Magic numbers implement strongly typed data and are a form of in-band signaling to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between many file formats and can yield further run-time information.

example:

• Compiled Java class files (bytecode) start with hex CAFEBABE. When compressed with Pack200 the bytes are changed to CAFED00D.
• GIF image files have the ASCII code for "GIF89a" (47 49 46 38 39 61) or "GIF87a" (47 49 46 38 37 61)
• JPEG image files begin with FF D8 and end with FF D9. JPEG/JFIF files contain the ASCII code for "JFIF" (4A 46 49 46) as a null terminated string. JPEG/Exif files contain the ASCII code for "Exif" (45 78 69 66) also as a null terminated string, followed by more metadata about the file.
• PNG image files begin with an 8-byte signature which identifies the file as a PNG file and allows detection of common file transfer problems: \211 P N G \r \n \032 \n (89 50 4E 47 0D 0A 1A 0A). That signature contains various newline characters to permit detecting unwarranted automated newline conversions, such as transferring the file using FTP with the ASCII transfer mode instead of the binary mode.
• Standard MIDI music files have the ASCII code for "MThd" (4D 54 68 64) followed by more metadata.
• Unix script files usually start with a shebang, "#!" (23 21) followed by the path to an interpreter.
• PostScript files and programs start with "%!" (25 21).
• PDF files start with "%PDF" (hex 25 50 44 46).

4. structutre filesystem

File is a collection of related information that is named and stored in secondary storage. File is useful to represent data or program.
A file system is part of a hard disk that has been allocated to contain the file. Part of the hard disk is accessed by mounting the file system through the directory. Once the filesystem is mounted, it looks just like any other directory to the end user.
However, due to structural differences between file systems and directories, data in these entities can be managed separately.

When the operating system is installed for the first time, it is loaded into the directory structure, as shown in the following figure.

To the right directory (/ usr, / tmp, / var, and / home) is all the system files so they have a separate section of the hard disk is allocated for their use. This file system is mounted automatically when the system starts up, so end users do not see the difference between system files and directories listed on the left (/ bin, / dev, / etc and / lib).

Tree file has the following characteristic:

• File that can be shared by machines of the same hardware architecture is in file system / usr.
• Variable per-client file, for example, spool and mail files, located in the file system / var.
• File systems / (root) contains the files and directories critical for system operation. For example, it contains 

          -  A directory of the device (/ dev)

       -  Mount points where file systems can be installed into the root file system, for example, / mnt 

• File system / home is the mount point for the user's home directory.
• For the server, the directory / export file contains the paging-space, per-client (not shared) file system root, dump, home, and / usr / share directory for the diskless client, as well as exported / usr directory.
• The file system / proc contains information about the state of processes and threads in the system.
• The file system / opt contains optional software, such as an application.  

    

The types of files:

• Text files: the sequence of characters may be arranged into rows and pages.

• Source file: the sequence of the various subroutines and functions, each of which then governed as declarations followed by statements that can diexecute.

• Object files: the sequence of bytes are arranged into blocks that can be understood by the connecting system.

• Executable file: a collection of sections of code that can be brought into memory and executed by the loader.

 concepts of file naming and extensions:

here I will try to discuss the structure file. mp3
--------------------------------------------------------------------------------------
 the MP3 files are divided into several small blocks - frames. Each frame has a length of time constant 0.026 seconds.
But the size of one frame (in Bytes) varies according to the bitrate. For example. to 128kbps it (usually) 417 Bytes 626 Bytes and for 192kbps. First 4 Bytes of each frame is a frame header and the rest is audio data.

Frame header consists of information about frame (bitrate, stereo mode ...) and therefore frame independent item. Each can have its own characteristics. It is used for example. Variables in Bitate file, where each frame can have a different bitrate.

Frame headers have this structure (each letter is one bit):
AAAAAAAA AAABBCCD EEEEFFGH IIJJKLMM

Variable Bitrate (VBR):
is a system created to meminimaljan length of the file and is useful also to maintain sound quality.


VBR file structure:
byte
 0-3       Mostly it contains values ​​FF FB 30 4C, from which you can rely   
            FrameLen = 156 Bytes. And thats just enough space to store the info 
            VBR.
            This header contains some important information applicable to the  
            entire file:
            - MPEG (MPEG1 or MPEG2)
            - Sampling rate frequency index
            - CHANNEL (JointStereo etc.)
4-x       This string is used as the main VBR file identifier. If not found, the file              should be CBR. This string can be placed at different locations in 

             accordance with the values ​​of MPEG and CHANNEL36-39    "Xing" for MPEG1 and CHANNEL != mono (mostly used)
21-24    "Xing" for MPEG1 and CHANNEL == mono
21-24    "Xing" for MPEG2 and CHANNEL != mono
13-16    "Xing" for MPEG2 and CHANNEL == mono
After a string of "Xing" no flags are placed, the number of frames in a file and file size in Bytes. Each item has 4 Bytes and will be recorded as the number of 'int' in memory. The first is the most significant byte and the last is the least.

The following scheme is for MPEG1 and CHANNEL = mono!
40-43     Flags
                 Value          Name          Description
            00 00 00 01|Frames Flag|set if value for number of frames in  file is 
                                                       stored
            00 00 00 02|Bytes Flag|set if value for filesize in Bytes is stored
            00 00 00 04|TOC Flag|set if values for TOC (see below) are stored
            00 00 00 08|VBR Scale Flag|set if values for VBR scale are stored
                                    All these values can be stored simultaneously.   
44-47     Frames
              Number of frames in file (including the first info one)
48-51     Bytes
              File length in Bytes
52-151   TOC (Table of Contents)
              Contains of 100 indexes (one Byte length) for easier lookup in file.
              Approximately solves problem with moving inside file.
              Each Byte has a value according this formula:
             (TOC[i] / 256) * fileLenInBytes
            So if song lasts eg. 240 sec. and you want to jump to 60. sec. (and file
              is 5 000 000 Bytes length) you can use:
              TOC[(60/240)*100] = TOC[25]
              and corresponding Byte in file is then approximately at:
              (TOC[25]/256) * 5000000
If you want to trim VBR file you should also reconstruct Frames, Bytes and TOC properly.

 152-155 VBR Scale

my reference: viaforensics.com

www.computer-forensics.net
en.wikipedia.org
www.multiweb.cz