In this section, we're going to talk about bits, bytes, and endianness. We're going to talk about how data is laid out on disk, how your tools are reading that data to give you the results that they do, and how we would go look at that data in its native format to validate our tools. Our core concepts, what we want to understand, is we want to understand that how the data is stored on the disk. We want to be able to recognize data and data patterns. We want to understand how the operating system interprets this data and shows it to us. We want to be able to read the data like I said, the way it is stored on disk so we can interpret it the way that our tools would. What I want you to come away with, the learning objectives are, I want you to understand the different numbering systems that we're going to use in computer forensics, computer science. We're going to talk about decimal, which we all know decimal, that's the one we use every day. That's a base 10 numbering system. We have our ones column, our tens column, our hundreds column, our thousand column. We're going to talk about binary, which is a base 2 numbering system, which would be one, and then 2, 4, 8, 16, continuing down the line, and we're going to talk about hexadecimal, which is a base 16 numbering system, which goes 0, 16, 32, 64, 128, etc. We're also going to talk about endianness, big-endian versus little-endian. This talks about how we read the data on the disk, which direction, left to right or right to left. We're going to talk about signed integers, and this is how we get negative numbers. We're going to talk about hexadecimal and how to convert it to a decimal number or a binary number. We're going to talk about pact bytes, we're going to talk about bits, bytes, and nybbles. We're going to talk about flags, file attributes, registry values, dates, and times. Our first module, we're going to talk about converting decimal to binary. What is binary? Binary is actually how the data is stored on your disk. Your data is not stored in hex on the hard drive, it is stored in binary. In binary we only have two possible values, a one or a zero, there's nothing else. Bit is one binary digit. A nybble is four bits or half a byte. Because there's eight bits in a byte. A nybble has a possibility of 16 values. A byte, I just gave it away is eight bits, and that has 256 possible values. Two bytes is called a word, and that has 16 bits, two bytes, and that has 65,536 possible values. You see how the more bits and bytes we have, the more possible values we have. Next, we have what's called the double word or dword. This is four bytes long, which means it's 8 times 4 is 32, so it's 32 bits. You could see on the screen it has quite a large number of possible values. Next, we go up to what's called a quadword. A quadword is 64 bits. A quadword is eight bytes long. It's a quadruple word, so it's double a double word. Instead of four bytes, it has eight bytes. You can see as the number of bytes we have go up, the possible values go up. This would be one reason why you want to have at least an eight-digit password. Because it would be a lot harder to crack that many possible values than say if you had a four-digit password. You can see the drastic change in possible values you have from dword to qword. Now, we talked about decimal being a base 10 numbering system. On the screen, you can see we have our ones, tens, hundreds, thousands, ten thousands, hundred thousands column. Binary is a base 2 numbering system. Again, only two choices on or off. With that same number, 11,111, you can see it there represented in decimal base 10, we can see it down below represented in binary. Converting the decimal number 95 to binary. The first thing we would have to do is we would write out our column values. Again, we would need eight columns, eight bits in a byte. We have our ones our twos, our fours, our eights, our 16s, our 32s, our 64s, and our 128s. Now, the next thing you would have to do is you would take the highest column value that will go into the number we're trying to convert. In this case, it is 95, so 128 will not go into 95, so we would put a zero in the 128 column. Sixty-four will go into 95, so we would put a one there. We would then subtract 64 from 95, which would give us a remainder of 31. Thirty-two cannot go into 31 so we put a zero in the 32 column. Sixteen will go into 31, so we would put a one in that column, and again, we would subtract 16 from 31. When we subtract 16 from 31, we get a remainder of 15. Eight will go into 15, so we would put a one in the eight-column, and then we would go ahead and subtract and we get a remainder of seven. Four will go into seven so we would put a one in the fours column. Again we would subtract 4 from 7, which would give us a remainder of three. Two will go into three with a remainder of one and one will go into one. Now, once we have all our values in our columns, we would add those numbers up. Every column with a one we would add. We add 64 plus 16, plus 8, plus 4, plus 2, plus 1, which gives us a total of 95. In our next module, Module 2, we're going to talk about converting binary to hexadecimal.
