Difference between pages "Error Correction Code" and "Slack"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
m
 
Line 1: Line 1:
'''Error Correction Code (ECC Errors)'''
+
{{Expand}}
  
:All modern hard disk drives are ATA (Advanced Technology Attachment) compliant. Part of this compliancy means that drives must have the ability to detect errors while reading data from individual sectors on the drive. This is to prevent corrupted data from being propagated through to the operating system which would lead to system crashes.
+
== Definition ==
  
:In order to accomplish this, every sector has a built in checksum and error correction code that is written at the time that data is written to the sector. Upon reading the sector, the drive recalculates the checksum and compares it to the one previously written. If it does not match, the error correction code will attempt to correct the data. Every sector has a standard 512 bytes of user data. A typical ECC is capable of correcting between 10 and 12 bytes. If the repairing the corruption is beyond the capability of the ECC, the data will not be returned to the operating system. The drive will then return an error. This is typically a UNC (uncorrectable) error.
+
In Computer Forensics ''slack'' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
 +
 
 +
== Slack Types ==
 +
 
 +
=== RAM Slack ===
 +
 
 +
=== File Slack ===
 +
 
 +
== External Links ==

Revision as of 11:18, 3 March 2008

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Contents

Definition

In Computer Forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

Slack Types

RAM Slack

File Slack

External Links