Ryan Benson - dfir.blog (Page 4)

Ryan Benson

Digital Forensics

Slack Space

Slack space can exist when a file's size is not a multiple of the file system's cluster size. As a little refresher, a sector is the smallest amount of data that a hard drive can read or write at one; in many cases, this is 512

Digital Forensics

Imaging Using dcfldd

In this post, a 128MB USB thumb drive will be imaged on a Linux system using dcfldd onto a 1GB USB thumb drive. dcfldd is an improved version of dd; most of the syntax is identical, just a few functions have been added. As a quick aside, this post is