[Home] 

Probability of finding contraband from sampling sectors

If we sample a disk a number of times (n) for a disk with a number of sectors (N) which contains a number of sectors of contraband data (M):

Disk size:   which gives   sectors on the disk (N), assuming 512 byte sectors
File size of contraband:    which gives     sectors (M), assuming 512 byte sectors
Sectors to be sampled:  which is n

 Source: Garfinkel (2010), Using purpose-built functions and block hashes to enable small block and sub-file forensics, Digital Investigation, 7.