Your walkthrough
Six guided stepsWalkthrough steps
1. Type this command
Type only the command, without the PS C:\Lab> prompt. Press Enter or choose Run command.
2. Read the result
3. Check your observation
You identified a device and volume, read their geometry, and calculated sectors per cluster.
Windows PowerShell
Administrator · SimulationPress Enter to run a command. Use Up and Down arrows to recall commands. cls clears the screen.
This browser simulation uses fictional devices and simplified sample output. It never runs commands on your computer.
Keep these relationships in view
A logical sector is the unit the drive exposes for addressing. A physical sector is its underlying sector unit. A cluster is the filesystem's unit for allocating file space.
Sectors per cluster = bytes per cluster ÷ logical bytes per sector. Read both sizes from the target volume before calculating.
PowerShell command reference
A cmdlet is a PowerShell command, often named Verb-Noun. A parameter narrows or changes what a command does. Get-Volume -DriveLetter E uses the DriveLetter parameter to request volume E. The separate Windows utility fsutil uses subcommands and a drive path with a colon, such as E:.
Supported here: Get-PhysicalDisk, Get-Volume, Get-Volume -DriveLetter E (using this case's letter), fsutil fsinfo sectorinfo E:, fsutil fsinfo ntfsinfo E:, division of two positive whole numbers, help, Get-Help, Clear-Host, and cls. In the PowerShell cases, capitalization does not matter. Other commands receive a simulation-specific message.
The case card supplies the device-to-volume mapping. Get-PhysicalDisk alone does not establish a drive letter. These examples use single-disk volumes formatted with the New Technology File System (NTFS).
Optional references: Microsoft Get-PhysicalDisk, Microsoft Get-Volume, and Microsoft fsutil fsinfo.
Compare PowerShell and Linux
| Task | PowerShell (cases 1 and 2) | Linux / Bash (case 3) |
|---|---|---|
| List storage | Get-PhysicalDisk | lsblk |
| Inspect a filesystem | Get-Volume -DriveLetter E | lsblk -f /dev/sdb1 |
| Read sector sizes | fsutil fsinfo sectorinfo E: | lsblk -o NAME,LOG-SEC,PHY-SEC /dev/sdb |
| Read NTFS cluster size | fsutil fsinfo ntfsinfo E: | sudo fsstat -b 4096 /dev/sdb1 |
| Calculate | 4096 / 512 | echo $((16384 / 4096)) |
| Clear the screen | cls | clear |
Linux identifies this disk with /dev/sdb and its first partition with /dev/sdb1. These paths may change between computers or connections. The intake mapping applies only to this case. Linux command names and paths are case-sensitive. NTFS is a filesystem format that forensic tools on either operating system can inspect.
The Linux case assumes The Sleuth Kit is installed and administrator access through sudo is already authorized. Output is shortened training data. The logical sector size supplied to fsstat with -b comes from the preceding device query. These examples use no mounted target filesystem.
Linux references: lsblk manual, The Sleuth Kit fsstat manual.