SMART Data
Raw data is at the heart of data forensics. Hex viewing is essential, so it's
essential to have a good hex viewer. Arbitrary data selections can be hashed, exported,
logged, etc.
 |
SMART's raw data viewer can recognize certain data structures automatically. This screenshot shows the interpretation
of a FAT directory entry.
|
Filesystem study extends it's functionality to the entire SMART UI. Here, a studied filesytem can be seen
with color-coding. The blue area is slack space, and the green area is the start of the next file's data allocation
(a GIF file as you can tell by the signature).
|
 |
|
