Cypher Technology Ltd V2.6 (03) December 2011
18
images. Alternatively, the Master may be restored back to a storage device (flash card
or USB drive) which is the same size or bigger than the original card. Standard data
recovery techniques can then be used on this restored drive as they would on the
original card.
5.1.4
Why archive the file system?
The file system used on removable flash media is the FAT file system.
A file is a digital container for digital data. As an example, one digital still image is
normally stored in one file. The file has a name and this is how it is referenced and
accessed by the computer and the user (e.g. DSC_0001.JPG).
A file entry on the disk or flash card is used to link this name with a FAT entry and
hence, the position of the file data on the medium. The file entry also contains other
information about the file such the time and date when the file was created and last
modified.
5.1.5
Partition Table
Sometimes it is useful to divide one physical disk (e.g. a hard disk) into multiple, virtual
drives (c: drive, e: drive etc.). A partition table describes how the drive is divided into
different virtual disks. Flash cards and USB pen drives are normally partitioned but with
only one partition. Strictly speaking they don’t need a partition table and some flash
cards don’t have one. Also, Windows XP will format a wiped, blank flash card with no
partition table.
The partition table is not normally updated after it is created but the way the partition
table is written will vary from system to system and thus can give some knowledge of
the history of the card.
5.1.6
File allocation information
Most flash media cards use the FAT16 or FAT32 file system. When a file (e.g. a JPEG
picture file in a camera) is created, two things happen. Firstly the file data is written to
the data area of the card and secondly the file system entry is created. This entry
consists of a file information (name, date etc) and the location of the file data on the
flash card stored in the File Allocation Table (FAT).
5.1.7
File un-deletion
When a file is deleted the actual file data is normally left unchanged on the storage
device. The deletion involves marking the file name in the file entry to show that the file
is no longer required and that the data space that was being used by the file can be
used for new files. Because of this, if no further data is written to the card, the original
deleted file may be retrieved or “un-deleted”. The Master allows for un-deletion of files
where it was possible on the flash card. (See “How is the Master Copy used?” above).
The Working Copy, of course, will not contain deleted files.
5.1.8
Historical file data
When a file is copied from the flash card to another storage device (as with the Working
Copy) information about its creation may be lost. Most obviously this may include the
original modification and creation times from the flash file table but also more subtle
historical information may be lost relating to the media history.