Loading tools
Opening the laboratory, please wait…
Opening the laboratory, please wait…
Preparing the instrument, please wait…
Digital Forensics · Tools
Convert sectors, clusters and LBA offsets, and calculate allocated space and file slack.
capacity = sectors × sector size, slack = allocated − file size
Sectors, clusters and offsets
512 for legacy drives, 4096 for Advanced Format.
As reported by the imaging tool.
8 sectors of 512 bytes gives the common 4 KB cluster.
Converted to a byte offset for a hex editor.
Total capacity
931.51GiB
capacity = sectors x sector size = 1,95,35,25,168 x 512 = 10,00,20,48,86,016 bytes
File slack is the unused remainder of the last allocated cluster. It can retain data from a previously deleted file and is a routine source of recoverable fragments.
Drive manufacturers quote decimal GB while operating systems report binary GiB, which is why a 1 TB disk shows as roughly 931 GiB. Cluster size must be read from the file system's boot sector rather than assumed, and Advanced Format drives with 512-byte emulation report a logical sector size that differs from the physical one.
Examiners move constantly between sectors, clusters, logical block addresses and byte offsets. This converts between them, including the hexadecimal offset needed to jump straight to a location in a hex editor.
It also computes file slack, the unused remainder of the last cluster allocated to a file. Slack often retains fragments of previously deleted data and is a routine source of recoverable evidence.