SMART Data
Raw data is at the heart of data forensics. Hex viewing is essential, so it’s essential to have a good hex viewer. Arbitrary data selections can be hashed, exported, logged, etc.
SMART’s raw data viewer can recognize certain data structures automatically. This screenshot shows the interpretation of a FAT directory entry.
Filesystem study extends its functionality to the entire SMART UI. Here, a studied filesytem can be seen with color-coding. The blue area is slack space, and the green area is the start of the next file’s data allocation (a GIF file as you can tell by the signature).
Next: SMART Reporting