Bits, Bytes, and Hexadecimal: The Language of Digital Evidence

If you are new to digital forensics, terms such as **bits, bytes, binary, and hexadecimal** may sound highly technical. Fortunately, the basic concepts are not difficult to understand. More importantly, they help explain what digital forensic tools actually examine when they process a computer, phone, USB drive, or other digital device.

Every photograph, email, document, web page, database, and deleted file ultimately consists of bits and bytes. Forensic tools organize and interpret this information for the investigator. Understanding the information underneath the tool helps a new investigator recognize what the software is doing and, eventually, verify important findings independently.

Start With the Bit

A **bit** is the smallest unit of digital information. The word bit comes from **binary digit**.

A bit has only two possible values:

**0 or 1**

Think of a bit as a simple switch. The switch can exist in one of two states, such as on or off. Computers use enormous numbers of these two-state values to store and process information.

One bit by itself cannot represent very much information. When computers combine bits, however, the number of possible values grows quickly.

Two bits provide four possible combinations:

* 00

* 01

* 10

* 11

Three bits provide eight possible combinations:

* 000

* 001

* 010

* 011

* 100

* 101

* 110

* 111

Every additional bit doubles the number of possible combinations.

The formula for determining the number of combinations is:

**2ⁿ**

The *n* represents the number of bits.

For eight bits:

**2⁸ = 256**

This means eight bits can produce 256 different combinations.

Eight bits also have a special name: a **byte**.

Eight Bits Make a Byte

A byte consists of eight bits.

For example:

**01000001**

Count the numbers and you find eight binary digits. Therefore, this sequence represents one byte.

Because eight bits provide 256 possible combinations, one byte can represent 256 different values. When we use a byte as an unsigned number, its values range from **0 through 255**.

You already encounter bytes every day, even if you do not think about them.

When a computer reports that a file is 500 kilobytes, 10 megabytes, or 2 gigabytes, it measures the amount of digital data stored in that file. Kilobytes, megabytes, gigabytes, and terabytes are all units built from bytes.

For a forensic investigator, however, bytes mean much more than file size.

Digital evidence consists of bytes.

Files contain bytes. Hard drives store bytes. Computer memory contains bytes. Databases organize bytes. Network communications transmit bytes. A forensic image preserves the bytes from the original evidence.

Understanding bytes therefore helps you understand what you actually examine during a digital forensic investigation.

How Bytes Become Information

Consider this byte:

**01000001**

It represents a binary number, but software can also interpret that value as something else.

The binary value **01000001** equals decimal **65**.

Under a common character-encoding system called ASCII, the number 65 represents the uppercase letter:

**A**

So:

**01000001 = 65 = A**

These are not three different pieces of information. They are three different ways to represent or interpret the same value.

This concept becomes very important in digital forensics.

Read me