From SleuthKitWiki
Jump to: navigation, search

Cluster is the term used in the FAT and NTFS file systems to refer to a grouping of consecutive sectors. Sectors are typically 512-bytes each and it is more efficient for a file system to allocate and use multiple sectors at a time. Each file system uses a different term for the resulting group. TSK uses the term data unit to refer to the grouping.

See the FAT Implementation Notes for a description of why TSK uses sector and not cluster addresses when dealing with FAT file systems.