Digital Forensics Foundations · Training Module

Storage Foundations: Bits, Bytes, Offsets & Clusters

Master binary, hex, endianness, disk offsets, and file system geometry. Test your skills with interactive calculators and self-grading exercises before tackling the case image.

← Home Case CC-2026-017 Evidence Workbench →

1 Bits, Bytes & Number Bases

Everything on a digital storage medium is stored as physical state changes (voltage levels in NAND flash, magnetic orientations on hard disks) that represent binary digits: bits (0 or 1).

Why Hexadecimal?

Reading long binary streams like 0100110001101111 is exhausting and prone to human error. Humans think naturally in decimal (base 10), but computer architectures group bits into bytes of 8 bits.

Because $2^4 = 16$, exactly 4 bits (called a nibble) map to one hexadecimal digit (0–9, A–F). Therefore, exactly two hexadecimal digits represent one byte (0x00 to 0xFF, corresponding to 0 to 255 in decimal).

// Positional value in 8-bit byte:
Bit Index: 7 6 5 4 3 2 1 0
Weight ($2^n$): 128 64 32 16 8 4 2 1
Example: 1 0 1 0 0 0 1 1
Value = 128 + 32 + 2 + 1 = 163 (decimal) = 0xA3 (hex)

Interactive 8-Bit Register & Converter

Click any bit below to toggle its state ($2^7 \dots 2^0$), or type into any input box to see live conversions across bases.

b70128
b6164
b5032
b4016
b308
b204
b102
b011

Forensic Cheat Sheet: Common Magic & Boundary Numbers

  • 0x55AA (21,930): The 2-byte boot signature at the end of MBR and VBR sectors (offset 0x01FE–0x01FF).
  • 0x01BE (446): Byte offset of the first partition entry in an MBR.
  • 0x0200 (512): Size of a standard disk sector in bytes.
  • 0x1000 (4,096): Size of a 4 KiB cluster (8 sectors).
  • 0x100000 (1,048,576): Exactly 1 MiB (offset of LBA 2048, typical modern partition alignment).
  • 0xE5 (229): Marker placed into the first character of a deleted FAT directory entry.
  • FF D8 FF: JPEG image file header (magic bytes).

2 Endianness: Little-Endian vs Big-Endian

When an integer requires multiple bytes (e.g. 16-bit word = 2 bytes, 32-bit double-word = 4 bytes), computer architectures must decide in which order to write those bytes to memory or disk.

Little-Endian (Intel x86, FAT32, MBR, NTFS)

The least significant byte (LSB) is stored at the lowest memory address.

+078LSB
+156mid
+234mid
+312MSB

Reconstituted integer: 0x12345678 (decimal 305,419,896).

Big-Endian (Network Byte Order, Motorola, EXIF "MM")

The most significant byte (MSB) is stored at the lowest memory address (human reading order).

+012MSB
+134mid
+256mid
+378LSB

Reconstituted integer: 0x12345678 (decimal 305,419,896).

Interactive Endianness Byte Interpreter

Enter raw hex bytes from a disk dump (e.g. B8 08 00 00 from a FAT32 boot sector or 00 08 for 2048):

Little-Endian Decoded: 0x000008B8 (2,232 decimal)
Big-Endian Decoded: 0xB8080000 (3,087,532,032 decimal)

Notice how FAT32 boot sector values (like sectors per FAT or reserved sectors) must always be read in Little-Endian!

3 Offsets & Hex Editor Addressing

An offset is the distance (counted in bytes) from a fixed reference point, beginning at byte 0.

The 16-Byte Hex Grid Formula

Standard hex editors display data in rows of 16 bytes (columns 0 through F). Why 16? Because in base 16, row offsets naturally increment by 0x10 (16 in decimal):

Absolute Offset = Row Offset + Column Offset
Example: If row address is 0x000001B0 and the byte is under column 0E:
Offset = 0x01B0 + 0x000E = 0x000001BE (decimal 446)

Interactive Hex Grid Inspector

Click any byte in the MBR partition table snippet below to inspect its row, column, relative offset, and forensic interpretation:

Offset 0001020304050607 08090A0B0C0D0E0F ASCII
000001B0 00 00 00 00 00 00 00 00 5C 1D 2E 07 00 00 80 01 ........\.N...
000001C0 01 00 0C FE FF FF 00 08 00 00 00 F8 01 00 00 00 ....... ........
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U.
Relative Offset 0x01BE (446)
Hex Value 0x80
Decimal Value 128
ASCII Character '·'
Forensic Field Meaning Partition 1: Boot indicator (0x80 = Active / Bootable)

4 Sectors, Clusters & File System Geometry

Storage hardware organizes physical media into sectors (standard size is 512 bytes). Storage systems use LBA (Logical Block Addressing) to index them:

Byte Offset = LBA (Sector Number) × 512
Example: Partition starts at Sector 2048:
Byte Offset = 2048 × 512 = 1,048,576 bytes (hex: 0x100000 = 1 MiB)

Why Clusters?

A multi-gigabyte disk contains hundreds of millions of sectors. Tracking every individual 512-byte sector in an allocation table would take immense memory and cause extreme fragmentation. Operating systems therefore bundle sectors together into clusters (also called allocation units), such as 1 sector (512 B), 8 sectors (4 KiB), or 64 sectors (32 KiB).

The cluster is the atomic allocation unit for file content: a file always receives an integer number of clusters.

The Layout of a FAT32 Partition

A FAT32 volume consists of four sequential regions:

  1. Reserved Area: Begins at sector 0 of the partition. Contains the Volume Boot Record (VBR/BPB), FSInfo, and backup boot sectors. Length in sectors: $S_\text{res}$.
  2. File Allocation Table #1 (FAT1): The allocation map. Offset: $\text{PartStart} + S_\text{res}$.
  3. File Allocation Table #2 (FAT2): Backup copy of FAT1. Length of each FAT: $S_\text{FAT}$.
  4. Data Area: Begins immediately after the last FAT. Where actual files and directory entries live!

The Golden Cluster Formula

In FAT file systems, clusters are numbered starting from Cluster 2! Clusters 0 and 1 do not physically exist on disk (their FAT entries are reserved for media descriptors and end-of-chain markers).

Cluster Offset = Data Region Offset + (Cluster Number - 2) × Bytes Per Cluster
where Data Region Offset = Partition Start Offset + (Reserved Sectors + NumFATs × SectorsPerFAT) × Sector Size

Interactive FAT32 Geometry & Cluster Calculator

The parameters below are prefilled with the exact values from the case exhibit usb_evidence.img. Modify them to observe how offsets and boundaries change:

MBR
Reserved
FAT 1
FAT 2
Data Area (Cluster 2 … N)
MBR Reserved Area FAT #1 FAT #2 Data Region
Partition Start Offset: 1,048,576 (0x100000) [LBA 2048]
FAT #1 Offset: 1,064,960 (0x104000) [LBA 2080]
FAT #2 Offset: 1,581,056 (0x182000) [LBA 3088]
Data Region (Cluster 2) Offset: 2,097,152 (0x200000) [LBA 4096]
Target Cluster Offset: 2,097,152 (0x200000) [LBA 4096]

Slack Space (File Slack & RAM Slack)

Because files are allocated in whole cluster units, any file whose size is not an exact multiple of the cluster size leaves unallocated space in its final cluster:

5 Practice Exercises

Test your understanding with these self-grading exercises. Each exercise features instant answer validation, hints, complete step-by-step solutions, and a "New Problem" generator for infinite practice.

Forensic Practice Progress

Complete all five practice exercises to prepare for homework tasks T1 & T2.

0 of 5 Completed

Exercise 1 · Number Base Conversion

Practice

Loading question…

Exercise 2 · Little-Endian Decoding

Practice

Loading question…

Exercise 3 · Sector & Offset Arithmetic

Practice

Loading question…

Exercise 4 · FAT32 Cluster Offset Challenge

Practice

Loading question…

Exercise 5 · Cluster Allocation & Slack Space

Practice

Loading question…

Ready for the Case Investigation?

Now that you've mastered hexadecimal addressing, little-endian decoding, and cluster offset calculations:

  • Head to the Acquisition Lab on the case page to acquire and hash the USB evidence stick.
  • Or launch the Evidence Workbench to inspect the disk image in the browser hex viewer and terminal.