1. Computer System Basics 1 Number Systems & Text Representation Computer Forensics BACS 371

2. Computer System Basics  Number Systems  Decimal (base 10)  Binary (base 2)  Octal (base 8)  Hexadecimal (base 16)  Conversions  Little Endian vs. Big Endian  Text Representation  ASCII  EBCDIC  Unicode

3. Number Systems  Decimal – base 10  Binary – base 2  Octal – base 8  Hexadecimal – base 16

4. Decimal Number System  Base 10  Uses digits 0~9  Based on powers of 10 10 5 10 4 10 3 10 2 10 1 10 0 100,00010,0001000100101 327194 3 * 10 5 = 300,000 2 * 10 4 = 20,000 7 * 10 3 = 7,000 1 * 10 2 = 100 9 * 10 1 = 90 4 * 10 0 = 4 ------------------------------- TOTAL = 327,194

5. Binary Number System  Base 2  Uses digits 0~1  Based on powers of 2 25252525 24242424 23232323 22222222 21212121 20202020 32168421 110101 1 * 2 5 = 32 1 * 2 4 = 16 0 * 2 3 = 0 1 * 2 2 = 4 0 * 2 1 = 0 1 * 2 0 = 1 ------------------------------- 110101 2 = 53 10 Base 10 Base 2 00 11 210 311 4100 5101 6110 7111 81000 91001 101010 111011 121100 131101 141110 151111

6. Octal Number System  Base 8  Uses digits 0~7  Based on powers of 8 84848484 83838383 82828282 81818181 80808080 40965126481 70265 7 * 8 4 = 28,672 0 * 8 3 = 0 2 * 8 2 = 128 6 * 8 1 = 48 5 * 8 0 = 5 ------------------------------- 70265 8 = 28,853 10 Base 10 Base 8 00 11 22 33 44 55 66 77 810 911 1012 1113 1214 1315 1416 1517

7. Hexadecimal Number System  Base 16  Uses digits 0~9 and A, B, C, D, E, F  Based on powers of 16 16 5 16 4 16 3 16 2 16 1 16 0 1,048,57665,5364096256161 3F7A0E 3 * 16 5 = 3,145,728 F * 16 4 = 983,040 7 * 16 3 = 28,672 A * 16 2 = 2560 0 * 16 1 = 0 E * 16 0 = 14 ------------------------------- 3F7A0E 16 = 10,451,470 10 Base 10 Base 16 00 11 22 33 44 55 66 77 88 99 10A 11B 12C 13D 14E 15F

8. Number System Comparison DecimalBinaryOctalHexadecimal 0000 1111 21022 31133 410044 510155 611066 711177 81000108 91001119 10101012A 11101113B 12110014C 13110115D 14111016E 15111117F

9. Number System Representations  Binary  01001101b  01001101 2  Octal  115o – note: trailing charter is a lowercase ‘oh’  115 8  Hexadecimal  0x4D -- note: leading character is a zero  4Dh  4D 16

10. Little Endian vs. Big Endian http://www.noveltheory.com/TechPapers/endian.asp Please read this. Deals with the order that bytes are stored in Intel-based versus non Intel-based computers.  Intel-based are normally PC-type computers  Non Intel-based are normally mainframe computers  Little Endian – stored left-to-right (Intel-based)  Big Endian – stored right-to-left (mainframe)

11. Text Representations  Text values stored in a computer can be in several formats  ASCII  EBCDIC  Unicode

12. ASCII  ASCII, pronounced "ask-key", is the common code for microcomputer equipment  American Standard Code for Information Interchange  Proposed by ANSI in 1963, and finalized in 1968ANSI  The standard ASCII character set consists of 128 decimal numbers ranging from zero through 127 assigned to letters, numbers, punctuation marks, and the most common special characters  The first 32 codes are reserved for “non-printing” or “control” characters – supported original teletype systems  The Extended ASCII Character Set also consists of 128 decimal numbers and ranges from 128 through 255 representing additional special, mathematical, graphic, and foreign characters

13. ASCII Table

14. Extended ASCII Table

15. Text Binary Converters  http://students.washington.edu/cwei/t ools/binary.shtml http://students.washington.edu/cwei/t ools/binary.shtml  http://www.sitinthecorner.com/binary/ binary.php http://www.sitinthecorner.com/binary/ binary.php TEXT Hello World BINARY 01001000 01100101 01101100 01101100 01101111 00100000 01010111 01101111 01110010 01101100 01100100 Hex 48 65 6C 6C 6F 20 57 6F 72 6C 64 TextBinaryOctalHex H0100100011048 e0110010114565 l011011001546C l011011001546C o011011111576F 0010000004020

16. WinHex View

17. EBCDIC  Extended Binary Code Decimal Interchange Code  Originally used by IBM-based mainframes  Totally different encoding scheme from ASCII and Unicode  Still used, but not as prevalent as in the past

18. Unicode  Character coding standard used in NTFS  “Unicode provides a unique number for every character, no matter what the platform, no matter what the program, no matter what the language.” http://www.unicode.org http://www.unicode.org  Three varieties of Unicode Transformation Format  UTF-8 – identical to ASCII for western languages  UTF-16 – 16-bits per character  UTF-32 – 32-bits per character