User manual

Cypher Technology Ltd 2008
16
5 Technical Background
5.1 Master Copy (bit for bit copy)
The Master Copy contains a single file called “flash.img” which is a bit for bit copy of the
whole of the Flash card. Because the whole of the card is copied, the Master includes
hidden files, deleted files, historical file data fragments, original time-accessed and time-
modified data, the filing system (FAT), and the boot sector and partition information.
As such it provides the most secure, evidential backup and allows the most complete
evidential audit trail. It contains everything that was on the Flash card and is the same
size (in Kbytes) as the Flash card.
Simple card copiers only copy the undeleted, non-hidden files. This leaves the exhibit
open to legal challenge.
5.1.1 Why archive the file system?
First some technical background on how files (such as pictures in a digital camera) are
stored on a Flash card.
A file is a digital container for digital data. As an example, one digital still image is
normally stored in one file. The file has a name and this is how it is referenced and
accessed (e.g. DSC_0001.JPG).
A filing system on a disk or Flash card is used to show where all data in the files is
located on that disk or Flash card.
A filing system (such as the FAT16 or FAT32 system ) consists of two parts: a file
allocation table and the file data itself.
5.1.2 Partition Table
Sometimes it is useful to divide one physical disk (e.g. a hard disk) into multiple drives
(c: drive, e: drive etc.). A partition table describes how the drive is divided into different
virtual disks. Flash cards and USB pen drives consist normally of one partition, but still
normally contain a partition table. Strictly speaking they don’t need a partition table and
some flash cards don’t have one. Also, Windows XP will format a wiped, blank flash
card with no partition table.
The partition table is not updated after it is created but the way the partition table is
written will vary from system to system and thus can give some knowledge of the history
of the card.
5.1.3 File Allocation Information
Most Flash media cards use the FAT16 or FAT32 file system. When a file (e.g. a JPEG
picture file in a camera) is created, two things happen. Firstly the file data is written to
the data area of the card and secondly the file allocation table is updated. The file
allocation table contains such information as the file name, the file creation/modification
times and dates and of course where the file data lives on the card.