Data Runs and Signed Integers

After many difficult hours trying to understand this concept, I summarized it in a way I believe will be helpful to others.

Data runs are signed numbers, thus they can take both positive and negative values.  A negative value is determined by the most significant bit (MSB) which is the leftmost bit after a hex number has been converted to binary.  If the MSB is 1, that bit’s value is negative.  If the MSB is 0, the value is positive (or actually zero). 

The offset for the first run will be relative to the start of the file system (sector 0 offset 0), but all subsequent offsets (jump values) will be relative to the previous offset.  The polarity of the jump value ( + or - ) will determine the specific location of the fragment or data run on the disk.  The result is that the disk read and write head may jump forward and backwards to the different file fragments or data runs.  See the image below.

The chart below gives the full explanation.

Best ways to Format an External Drive for Windows and Mac

http://www.cnet.com/how-to/the-best-ways-to-format-an-external-drive-for-windows-and-mac/

FrostWire Forensics

http://articles.forensicfocus.com/2012/07/19/forensic-examination-of-frostwire-version-5/

Windows Registry Forensics Resource

This might be useful.

http://travisaltman.com/location-of-forensic-evidence-in-the-registry/

Mapping Network Drives from the Windows Command Prompt

http://www.howtogeek.com/118452/how-to-map-network-drives-from-the-command-prompt-in-windows/

Do I Mind that Android Knows Where I Am?

Our smart phones know where we are.  Is that okay?  I'm trying to decide.  I must admit that I like the location apps and services that are available, but it's almost shocking when I look at my location history and realize this phone keeps track of me AT ALL TIMES.

This article tells the entire story for Android and iOS.

http://lifehacker.com/psa-your-phone-logs-everywhere-you-go-heres-how-to-t-1486085759

For a quick look at your location history on your Android device, follow this link. You will need to log in with your Google credentials.

https://maps.google.com/locationhistory

To see your location history on your iOS device, look here.  You will need your Apple ID and password to log in.

http://www.iclarified.com/36198/how-to-view-the-location-history-of-your-iphone

Social Media Search Engine

This site searches social media and does a passable job:

http://whitepagesus.net/