Evidence Workbench

Go to

Find

File system parameters

Work these out from the boot sector. They enable Go to cluster, cluster numbers in the FAT template and the → links in the ext and NTFS templates (bytes per cluster = block size there).

Volume start offset FAT #1 offset Cluster 2 offset (data region) Bytes per cluster

Bookmarks

Data interpreter at cursor

Selection

Template applied at cursor

Put the cursor where the structure starts, then apply. Directory and FAT templates cover the selection, or one sector if nothing is selected.

This view shows the stick the way an operating system would: existing files and folders only. Anything that was deleted is not listed here. Look for it in the raw directory entries.

Name	Size	Created	Modified	Accessed	Attr

examiner@workbench: forensic terminal

EXIF viewer (exiftool-style)

Source Open file…