What does “File Extent” mean in EnCase?
The term “File Extent” in EnCase is reffers to how many different fragments or “data runs” there are for a file. A file that consists of 1 contiguous block of data, i.e one that is not fragmented, will have a File Extent of 1, any file that that a value greater than 1, will be fragmented. [This is for an NTFS file system]
This information is obtained from the MFT which gives exact details about the size, number, and location of all of the data runs associated with a file.
