DFSC 1317 Introduction to Digital Forensics and Information Assurance

18
02 NUMBERING SYSTEMS: BINARY, DECIMAL, AND HEXADECIMAL DFSC 1317 Introduction to Digital Forensics and Information Assurance

description

DFSC 1317 Introduction to Digital Forensics and Information Assurance. 02 NumberING Systems: b I nary, dec I mal, and hexadec I mal. Basic operation performed by a computer. Arithmetic Operations : Addition, subtraction, multiplication and division - PowerPoint PPT Presentation

Transcript of DFSC 1317 Introduction to Digital Forensics and Information Assurance

Page 1: DFSC 1317 Introduction to Digital Forensics and Information Assurance

02NUMBERING SYSTEMS: BINARY, DECIMAL, AND HEXADECIMAL

DFSC 1317 Introduction to Digital Forensics and

Information Assurance

Page 2: DFSC 1317 Introduction to Digital Forensics and Information Assurance

2

Basic operation performed by a computer

Arithmetic Operations: Addition, subtraction, multiplication and division

Logical operations: the sign or the comparative magnitude of two numbers

Data transfer: Moving data from one location to another in the memory.

Input-output operations: Controlling the reading/writing of information into or out of the computer

Page 3: DFSC 1317 Introduction to Digital Forensics and Information Assurance

3

On Digital Computers

Digital computers store numbers in an entity (or unit) called a word which consists of a string of binary digits, or bits. Various number systems are used to represent mathematical numbers. Some commonly used number systems are: hexadecimal (base 16), decimal (base 10), octal (base 8), and binary (base 2). For example, in a decimal system the number 8,410 is represented in powers of ten as:

8103 + 4102 +1101 + 0100 = 8000 + 400 + 10 + 0 = 8,410

Page 4: DFSC 1317 Introduction to Digital Forensics and Information Assurance

4

On Digital Computers (Cont’d)

A method known as the doubling procedure is as follows. Given a decimal number N, it can be decomposed as:

N = 2Q1 + R1 (Q1 = N/2 - remainder)

Q1 = 2Q2 + R2 (Q2 = Q1/2 - remainder). .. .

. .

Qk = 0 + Rk+1 etc.

The corresponding binary number is obtained by writing the remainders Rk+1, Rk, ... , R1 in the reverse order as:

B = Rk+1RkRk-1 ... R1

Page 5: DFSC 1317 Introduction to Digital Forensics and Information Assurance

5

Example

Convert the decimal number N = 8,410, to a binary number.

Solution:Perform sequential division by 2 as follows:8,410 = (24,205) + 0 65 = (232) + 14,205 = (22,102) + 1 32 = (216) + 02,102 = (21,051) + 0 16 = (28) + 01,051 = (2525) + 1 8 = (24) + 0 525 = (2262) + 1 4 = (22) + 0 262 = (2131) + 0 2 = (21) + 0 131 = (265) + 1 1 = (20) + 1

The binary equivalent of 8,410 is then given by collecting the remainder digits from the last to the first:

10000011011010 = 11213 + 0212 + 0211 + 0210 + 029 + 028

+ 127 + 126 + 025 + 124 + 123 + 022 + 121 + 020

Page 6: DFSC 1317 Introduction to Digital Forensics and Information Assurance

6

Representations of Numbers

Numbers are usually represented using the normal form notation. That is,

x = m.10E for 10-1 < m < 1

where for x 0, m is called the mantissa and E is the exponent. By convention, the number zero has the normal notation, 0.100.

Page 7: DFSC 1317 Introduction to Digital Forensics and Information Assurance

7

Significant Digits

If a number is written in standard decimal, floating-point form, or in normal form such that:

x = 0.d1 d2 d3 ... dk10n

with d1 0 and dk 0, we say that this number has k significant digits (or significant figures) which indicates those digits that can be used with a confidence relative to the true value of the number.

Page 8: DFSC 1317 Introduction to Digital Forensics and Information Assurance

8

Significant Digits (Cont’d)

Note that the zeros which are used only to shift the decimal point are not counted as significant figures. The leading zeros may or may not be significant. For example,

x = 0.0002815 has 4 significant figures!x = 1,200 may have 4 significant figures!

Some examples are:

46.45072800 = 0.46450728102 (with 8 significant digits) -335.12 = -0.33512103 (with 5 significant digits) 0.00517 = 0.51710-3 (with 3 significant digits)

0.74 = 0.74100 (with 2 significant digits)

Page 9: DFSC 1317 Introduction to Digital Forensics and Information Assurance

9

Computer Representation of Numbers

The decimal equivalent of the binary number represented in Figure 1 is given by:

-(026 + 025 + 024 + 123 + 022 + 121 + 120)= -(0 + 0 + 0 + 8 + 0 + 2 + 1)= -11

{sign} Value

1 0 0 0 1 0 1 1

Figure 1 Binary representation of an integer using an

8 bit word (or Byte)

Page 10: DFSC 1317 Introduction to Digital Forensics and Information Assurance

10

Example

Determine the largest integer that can be represented by an 8 bit machine.

Solution:

Imax = +(126 + 125 + 124 + 123 + 122 + 121 + 120) = +( 64 + 32 + 16 + 8 + 4 + 2 + 1 ) = +(127) = +(27 - 1)In general:

Imax = +[2(n -1) - 1]; Imin = -[2(n -1) - 1]

For a binary computer utilizing 32 bit words, Imax = 2,147,483,647

Page 11: DFSC 1317 Introduction to Digital Forensics and Information Assurance

11

Floating-Point Representation

A floating-point number is written as:

x = (sign)m.b(sign)E

where m is the mantissa, b is the base (b = 2 for a binary system), and E is the exponent.

Sign of Mantissa Digits of Mantissa Sign of Exponent Digits of Exponent

d1 d2 d3 d4 d5 d6 d7 d8

Page 12: DFSC 1317 Introduction to Digital Forensics and Information Assurance

12

Example

Determine the smallest, positive, nonzero, floating point number that can be represented by an eight bit machine using binary system with one bit spared for the sign of the mantissa, one bit for the sign of the exponent, and two bits for the digits of the exponent:

Sign of Mantissa Digits of Mantissa Sign of Exponent Digits of Exponent

0 0 0 0 1 1 1 1

Solution:m = +(023 + 022 + 021 + 120)m = +( 0 + 0 + 0 + 1 ) = 1E = -[(121) + (120)] = -(2+1) = - 3Number = 12-3 (which is equal to 0.1250 in decimal

system)

Page 13: DFSC 1317 Introduction to Digital Forensics and Information Assurance

Decimal Numeral System

Base 10 positional notation 1010 = 1*103 + 0*102 + 1*101 + 0*100

= 1*1000+ 0*100 + 1*10 + 0*1 = 1010

Number set : (0, 1, 2, …, 8, 9)Operations: addition, multiplication, etc.Numbers of same value are longer than Hex

but shorter than BinNot so easy to convert into Bin or Hex

Page 14: DFSC 1317 Introduction to Digital Forensics and Information Assurance

Binary Numeral System

Base 2 positional notation 1010 (B) = 1*23 + 0*22 + 1*21 + 0*20

= 1*8 + 0*4 + 1*2 + 0*1 = 10 (in decimal)

Number set : (0 & 1)Operations: addition, multiplication, etc.

Addition: 1001 + 1100 = 10101

Good for computer systems – logical gates with only two different values or states; Can be easily converted into Hex (4 Bin bits 1 Hex bit)

Page 15: DFSC 1317 Introduction to Digital Forensics and Information Assurance

Hexadecimal Numeral System

Base 16 positional notation 1010 (H) = 1*163 + 0*162 + 1*161 + 0*160

= 1 *4096 + 0* 256 + 1* 16 + 0 * 1 = 4112 (in decimal)

Number set : (0 ~ 9, A, B, C, D, E, F)Operations: addition, multiplication, etc.Numbers of same value are shorter (vs.

binary and decimal)Can be easily converted into Binary (1 Hex

bit 4 Bin bits)

Page 16: DFSC 1317 Introduction to Digital Forensics and Information Assurance

Binary HexadecimalDecimal

Page 17: DFSC 1317 Introduction to Digital Forensics and Information Assurance

File Extension Description Hex SignatureBMP Windows Bitmap Image 42 4D xx xxGIF Graphics Interchange Format File47 49 46 38 39 61 xx xxGIF GIF87a 47 49 46 38 37 61 xx xxGIF GIF87b Trailer: 00 3B xx xxICO Windows Icon File 00 00 01 00 xx xxJPEG, JPG Compressed graphics file FF D8 FF E0 xx xx 4A 46 49 46 00 xx xx FF D8 FF E1 xx xx 45 78 69 66 00 xx xxPNG Portable Network Graphics File 89 50 4E 47 0D xx xxTIFF, TIF Tagged Image File Format 49 49 2A 00 xx xx

Page 18: DFSC 1317 Introduction to Digital Forensics and Information Assurance

Hash Table