| Author | Message | ||
     Ted Smith Username: ted_smith Registered: N/A |
Hi In X-Ways Forensics 15.2, when you add a physcial disk (via Tools --> Open Disk), the grey details pane on the bottom right of the screen can list the Cylinders Heads and Sectors values of the disk, and also the LBA values, or the LBA values without the CHS values. However, my colleague and I have different layouts and we can't remember where the option is that controls it - obviously one of us has done something different to the other? He has the CHS values, but no LBA. I have neither! How do I enable\disable the display of CHS values and LBA values in this pane (I realise the LBA can be looked up via 'Specialist --> Technical Details Report) Thanks Ted | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> the grey details pane on the bottom right of the screen > can list the Cylinders Heads and Sectors values of the disk Actually no, it cannot. There is no way of knowing these values. That is a common misconception, and the constant misinterpretation by users was the main reason why we have eventually removed that display for modern hard disks. The values would be of little value and in no way reflect the actual number of cylinders or heads. They are just a mathematical possibility of how the total number of sectors can be roughly approximated by three numbers within certain limits that are multiplied. > and also the LBA values No, no LBA (logical block addresses) are displayed in the Details Panel of a window that represents a physical hard disk. For both the LBA of the currently displayed sector and the total number of sectors (I think you rather mean the latter, but the total sector count is not an address) please see the Status Bar instead! > my colleague and I have different layouts and we can't > remember where the option is that controls it Whenever you think someone has nicer settings than yourself, in X-Ways Forensics it's easy to steal them by simply adopting that someone's .cfg file. However, in this case the behavior of the program is not controlled by an option. For a physical hard disk, the Details Panel always (regardless of any settings) shows the (usually) fictitious CHS values only if X-Ways Forensics has reason to believe that there is at least a chance that they could be genuine. Usually for very old, small hard disks only. | ||
| Ted Smith Username: ted_smith Registered: N/A |
Many thanks Stefan - that makes sense. My colleague was using an earlier version of X-Ways and the CHS was being displayed (or, as you say, an estimation of it) in the pane, whereas I am using 15.2 and there is no such data in the pane when I add the same physcial disk. I am glad you state what you have about the CHS. Some forensics units have a policy of recording it where possible, but I have thought for some time there was no point in doing this (LBA yes, CHS no). I think since disks got to about 2Gb (or was it the 512Mb barrier?) the CHS system became largely redundant? Ted | ||
| Ted Smith Username: ted_smith Registered: N/A |
Make that 8.4Gb I think...(based on the limitations of the 16-byte entries within an MBR partition table being limited to a total of 1024 cylinders, i.e. 1024 * 255 * 63 * 512 = 8,422,686,720 bytes (8.4 GB) ) | ||
| Jimmy Weg Username: jw Registered: 7-2006 |
In building VMs from images with VMware, the disk descriptor file (vmdk) wants CHS values for the image. Typically, it x-255-63, so we do the math from the Technical Details Report. |