Скачать или смотреть The challenges of storage devices using 4096 byte sectors - Mike Wilkinson

This all started with Adam from hexacorn (http://www.hexacorn.com/ ) asking some questions about a WD mybook on the win4n6 mailing list. It turns out that it and a handful of other devices are now using 4096 byte sectors rather than the standard 512. When drives using this sector size are formatted with NTFS the MFT uses 4096 byte file records, which appears to break many commercial software tools. Here I gave a quick overview of the problem, more details can also be found in my blog post on the topic http://www.writeblocked.org/index.php... .

DFIROnline is a monthly online meeting of digital forensic and incident response professionals. The purpose of these meetups is to enable information sharing among the DFIR community. These session are open to anyone, and occur on the third Thursday of every month at 2000 US eastern time. If you would like to get involved and present something please email meetup at writeblocked.org.

If you would like to recieve emails about the schedule and upcoming events you can subscribe to the DFIROnline mailing list http://mail.writeblocked.org/mailman/.... The list is only used for announcements and reminders and should not generate more than a few emails a month. The schedule of upcoming events is at: http://www.writeblocked.org/dfironlin...