Data unit

From SleuthKitWiki
Revision as of 07:56, 5 February 2013 by Apriestman (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Data unit is the generic term used in TSK to refer to a grouping of consecutive sectors. Sectors are typically 512-bytes and file systems group them together to form larger storage units. For example, they may group 8 consecutive 512-byte sectors together to form units that are 4096-bytes each. The file system assigns an address to each of these data units. Typically, the file system does not provide an address to each sector. It only allocates and refers to the data units.

The following are the terms that are used by each of the file systems to refer to a data unit.

  • ExtX: fragment
  • FAT: sector (note that FAT groups sectors into clusters, but not all sectors are allocated to a cluster and therefore cluster addresses do not cover the entire file system. TSK uses sector addresses with FAT so that all parts of the file system can be referenced. See FAT Implementation Notes).
  • FFS: fragment (note that FFS also groups multiple fragments into blocks, but each fragment has an address)
  • HFS: block
  • NTFS: cluster
  • YAFFS2: chunk (note that YAFFS2 groups multiple chunks into blocks but each chunk has an address)