Forensics: What does “File Extent” mean in EnCase?

What does “File Extent” mean in EnCase?

The term “File Extent” in EnCase is reffers to how many different fragments or “data runs” there are for a file. A file that consists of 1 contiguous block of data, i.e one that is not fragmented, will have a File Extent of 1, any file that that a value greater than 1, will be fragmented. [This is for an NTFS file system]

This information is obtained from the MFT which gives exact details about the size, number, and location of all of the data runs associated with a file.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: