Course 2, Module 3, signed integers.
A signed integer is how we would
get negative numbers in our operating system.
We know that we do need
negative numbers because sometimes we have fragmentation
where files for sector may
be in front of its preceding ones.
That's just one example of
why you would need a negative number.
But how do we get these negative values?
Well, whether a number has
the possibility of being a positive or a negative number,
it being one of these signed integers is determined by
the operating system code
or the programmer who wrote that code.
These values are what we call signed integers.
Now, just because it's a signed integer doesn't
necessarily mean it is a negative number.
Don't make that mistake.
What it means is it has
the possibility of being a negative number.
If a condition is met.
That condition is the most significant bit.
Remember back, I think in our last course we talked
about the most significant bit
is that bit farthest to the left,
and the least significant would be furthest to the right.
If that most significant bit,
that furthest to the left bit is turned on,
meaning there's a one in that column.
Like we saw when we did our binary conversions.
If that bit is turned on
and you're talking about a signed integer,
then yes, it is a negative number.
In order for a signed integer to be a negative number,
the most significant bit must be turned on.
Here's an example of a number 255.
We broke that out into its binary representation.
You can see that the furthest bit,
that 128 column for this to
the left has a one in it and it is turned on.
This would be considered
a negative number if it were a signed integer.
Down below, we can see a second example.
I use the 95 like we did the conversion
in our last block and that number,
you could see the most significant bit,
the 128 column is not turned on because 128 will not
go into 95.If that were a signed integer,
that would still be a positive number.
When we determine the actual numeric value
of a signed integer,
we want to use a tool
like data inspector or data interpreter.
Most of these tools are
built into all your forensic suite.
FTK Imager has one.
The tool we're going to use throughout this course,
active disk editor has one.
They are in most of your tools
and they're even in free tools.
But you don't just put
a negative sign in front of the positive value,
it has a different calculation for the negative value.
Use a data interpreter or
a data inspector or some type of data interpreting
tool to determine
the actual numeric value of that number.
Now, breaking a number all the way
out to binary to find out if
that last bit is turned on is a little bit tiresome.
Let's look at this value here on our screen.
It's 8A, 00,9B,00.The value furthest to the left is 8A.
If we look at the left nibble of eight,
if that is a signed integer,
and the nibble furthest to the left is eight or greater.
It will be a negative number because
that last bit is going to be turned
on like we saw when we did our conversions.
If that number is eight,
it is going to be a negative number,
eight or greater on the very last nibble.
The nibble furthest to the left,
the most significant value on
a signed integer will mean that is a negative number.
Because we know that last bit is going to be
flipped on if that number is eight or greater.
In our next course,
we're going to be talking about endianness,
how we read our bits or data on a disk.
This is becoming very important throughout the course.