Computer Hope

Software => Computer software => Topic started by: NiGhtMarEs0nWax on July 12, 2009, 05:25:35 AM

Title: WinHex - Cluster analysis
Post by: NiGhtMarEs0nWax on July 12, 2009, 05:25:35 AM

Does anyone here know much about WinHex?

i was wondering how to analyse individual clusters? more specifically the cluster slack space. i was thinking on a cluster by cluster basis, rather than gathering slack space of an entire drive.

Thanks

Title: Re: WinHex - Cluster analysis
Post by: NiGhtMarEs0nWax on July 14, 2009, 04:10:50 AM

** FIXED **

i managed to view the cluster tip by enabling "Open and search files incl. slack" option in the "Directory browser options" window.

on the pane to the right it shows the cluster size and the data file size,

you can deduce where the slack starts by counting the file size (in bytes) form the start of the cluster, anything outside the space allocated to the file is the slack.

Thanks.

Title: Re: WinHex - Cluster analysis
Post by: Rob Pomeroy on July 14, 2009, 09:45:42 AM

I wish I knew what this all meant...   :-X

Title: Re: WinHex - Cluster analysis
Post by: NiGhtMarEs0nWax on July 15, 2009, 05:34:32 AM

http://www.explorerplusplus.com/blog/54-file-slack

there is some links at the bottom, winhex is a free tool that you can utilize to view clusters and a ton of other forensic functions.

:)