Encase Navigation

  1. What is PS?
    "Physical Sector Number" of data currently being accessed. Each device starts at sector 0 an ends with a number based on the number of sectors on that device, minus one (1000 sectors are numbered 0-999)
  2. What is LS?
    "Logical Sector Number" is number relative to the partition you are in. Each partition is numbered with sectors starting at 0 and ending on a number based on the number of sectors in the partition minus one. IF ONLY ONE PARTITION, THEN NO LS!
  3. What is CL?
    "Cluster Number" for data being accessed. Remember that clusters are logical constructs within a partition. If ;you are outside a partition, in the MBR for example, don't expect to see a cluster number!
  4. What is SO?
    "Sector Offset" is the byte offset value within the sector where the data currently accessed resides. With 512 bytes/sector, expect these values to range from 0 to 511.
  5. What is FO?
    "File Offset" the byte offset value within the file curretnly being accesssed. Values will range from 0 to the number of bytes in the file minus one. If you are sitting on the first byte in a file, the FO is 0. If you are sitting on the last byte of a 123-byte file, the FO is 122 (123-1=122)
  6. What is LE?
    "Length" of bytes currently highlighted/selected. It defautls to 1 until you select data by clicking and dragging to select data. This indicator is very useful when selecting ranges of data for analysis, bookmarking, or exporting.
Author
Curio
ID
8161
Card Set
Encase Navigation
Description
Navigation fields
Updated