From: "Mellen, Christopher" <cmellenat_private> To: "'forensicsat_private'" <forensicsat_private> Subject: sector CRC Date sent: Thu, 23 Aug 2001 20:21:25 -0400 > > If I understand it correctly the CRC at the end of the data area of a > sector is generated when a sector is written to. Subsequently, the CRC is > checked when the sector is read - if the CRC value doesn't match then it's > flagged as bad and some type of error should occur. > > So my question, if I use a disk utility such as diskedit and change the > data area (i.e. add a line of text to a document) in a sector. Why then > does the sector CRC not report an error when accessing the file normally > at a later time? or is this done with an ECC and it's correcting it on > the fly as there would be no physical issues with the sector...? > Very simple Christopher. The CRC is generated and tested by the disk controller hardware when the sector is written to/read from disk. When you use Diskprobe, you are actually amending a memory buffer which is not written to the disk sector until you commit. Michael D. Barwise, BSc, IEng, MIIE Computer Security Awareness tel +44 (0)1442 266534 http://www.ComputerSecurityAwareness.com Addressing the Human Equation in Information Security ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Aug 27 2001 - 12:28:25 PDT