Magic Numbers

           Magic numbers are common in programs across many operating systems. Magic numbers implement strongly typed data and are a form of in-band signaling to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between many file formats and can yield further run-time information.

Example:

GIF image files have the ASCII code for "GIF89a" (47 49 46 38 39 61) or "GIF87a" (47 49 46 38 37 61)

PDF files start with "%PDF" (hex 25 50 44 46).

"jpeg" File Structure

           JPEG (Joint Photographic Experts Group) refers to a standards organization, a method of file compression.File Interchange Format (JFIF) is a development of C-Cube Microsystems for the purpose of storing JPEG-encoded data. JFIF is designed to allow files containing JPEG-encoded data streams to be exchanged between otherwise incompatible systems and applications.

A JFIF file is basically a JPEG data stream with a few restrictions and an identfying marker. In order to understand the JFIF format, you'll need to understand JPEG

Unallocated Space

        Unallocated space, sometimes called “free space”, is logical space on a hard drive that the operating system, e.g Windows, can write to. To put it another way it is the opposite of “allocated” space, which is where the operating system has already written files to.

Examples.

If the operating system writes a file to a certain space on the hard drive that part of the drive is now “allocated”, as the file is using it the space, and no other files can be written to that section. If that file is deleted then that part of the hard drive is no longer required to be “allocated” it becomes unallocated. This means that  new files can now be re-written to that location.

Slack Space

  Slack space or sometimes referred to as file slack is the areabetween the end of a file and end of the last cluster or sector used by the file in question. Area is an area that will not be used again tostore the information there, so the area is "wasted" useless. Slackspace is common in file systems that use a large cluster size, while the file system that uses a small cluster size can organize the storage media more effectively and efficiently. Amount of wasted disk space can be thought is estimated by multiplying the number offiles (including the number of directories) with half the size of acluster. For example, a 10 000 personal computer that stores files in a file system that uses a cluster size of 4 kilobytes will haveapproximately 10 000 x 2 MB ~ = 20000 KB. On a large file server,slack space and even reached the size of tens of gigabytes.

Structure File system

     File system is a logical structure that is used to control access to data on the disk. File system functions to provide a mechanism for storing data and programs are owned by the operating system and all users of computer systems.There are two parts to the file system, namely:A. Collection of files each of which stores data related.2. Directory structure to organize and provide information on all files in the system.All operating systems from DOS, Windows, Macintosh and UNIX derivative has its own file system to put the files in a hierarchical structure. Examples of file systems including FAT, NTFS, HFS and HFS +, EXT2, EXT3, ISO 9660, ODS-5, and UDF. Some file systems also include journaling file system or a versioning file system, file system also determines the file naming convention and the laying of the file in the directory structure.Here is a third type of naming files on a Windows system: 

MBR (Master Boot Record )

MBR is a special room and a very important presence in the hard disk. master boot record is created automatically when you create the first partition diharddisk.

MBR is a very important data structure that contains the partition table and a number of executable code for the boot start (way to hard to make loading the operating system). location is always on the first disk sector.