Call:   (888) 458-3222

 

What is a Sector?

 

Computer storage devices, e.g., floppy diskettes, zip disks and computer hard disk drives, are made of materials that retain magnetic imprints of bit patterns. A bit is the smallest unit of measure in the computing world and it essentially represents either a '1' or '0'. Bytes are made up of eight bits. Thus '10011101' is the binary representation of a byte. All possible combinations of these 1s and 0s can represent numbers anywhere between zero and 255. The computer uses these eight bit numbers to perform calculations but they are also being used to represent letters of the alphabet, i.e., the decimal number 65 when converted into binary math (01000001) represents the code for the capital letter 'A'.

 

Bits and bytes make it possible for computers to perform computations and to store data. For efficiency purposes, bytes are stored on disk in blocks of data called sectors. Most computer systems rely upon a sector size of 512 bytes of data (4096 bits) but that is not necessarily true of all computer storage devices. The sector is actually the smallest unit of storage on a computer storage device but you must remember that a sector is really just a bunch of bits (4096 to be exact) stored as data on disk. Sectors are generally a power of 2 bytes in size. Thus, a "regular" disk sector is 512 bytes, a CD-ROM sector is 2048 bytes, Read-Write Optical drives commonly have sector lengths of 512, 1024 or 2048 bytes.

 

All Microsoft operating systems read and write in blocks of data called clusters and they are made up of fixed blocks of data which consist of an even number of sectors, e.g. 1024 bytes, 4096 bytes, etc. The number of sectors needed for a cluster is dependent upon the type of storage device, the operating system involved and the size of the logical storage device.

 

Sectors are created and mapped when the computer storage device is low level formatted. For modern computer hard disk drives, low level formats are usually performed at the factory by the manufacturer of the hard disk drive. Special low level format utilities can also be obtained by computer specialists but they typically are tied to a specific hard drive brand and model. During the low level format, sectors are created and are written consecutively to disk on tracks. As the sector is created and written to disk, the storage media is verified for accuracy. The verification process involves writing 512 bytes (4096 bits) of data to disk. The data written is usually uniform and it is referred to as a format pattern. After the data is written, the write process is validated by comparing what is read back from disk with what was supposed to have been written. This comparison is done at a bit level. Bad sectors (those that don't pass the validation test) are noted as being unreliable and they are mapped by the hard disk controller so that attempts will not be made to write data to them in the future.

 

Clusters are defined during the high level format which is performed by the operating system. When floppy diskettes are involved, the low level format and high level format take place at the same time and they are performed by the operating system. If a bad sector is found during the high level format, the entire cluster will be marked as bad by the operating system in the File Allocation Table (FAT). However, from a computer forensics standpoint, you should be aware that data can be stored in clusters that have been marked as bad.

 

Center for Computer Forensics

21800 Melrose Ave

Suite 1

Southfield, MI 48075

 

info@computer-forensics.net

This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.