Back to basics - data structures

Many forensic analysis starts with a button click, but validated by looking at recoded data structures on storage devices in its native format.  Non-programmers have a hard time learning and understanding what we mean by stored data.  In this post, I wanted to show a code that can be compiled and run to see exactly how data is stored based on the given data type.

#include <iostream>  
#include<string>        
#include<fstream>     

using namespace std;

  typedef struct zoltan{    
      int age;                     
      string fName;            
      string lName;            
      float earnings;           
      bool isGraduated;     
  }me_t;                         

int main(){    
me_t student;

 student.age=34;                        //change the RED values and experiment                        
 student.earnings=34.45;                                                                                                 
 student.fName="Zoltan";                                                                                               
 student.lName="Szabo";                                                                                                
 student.isGraduated=true;                                                                                             
 
 ofstream output_file("students.data", ios::binary);           //change the output file name if needed   
 output_file.write((char*)&student, sizeof(student));                                                                      
 output_file.close();                                                                                                                      

 return 0;
}

As we can see, age is an integer data type with a value of 34 hat was saved as hex value 22 00 00 00 since it is a 32 bit value stored in little endian format.   Reading it as hex value 00000022 will give us 32 decimal.  The string values for the first and last name are structures with default of 15 character array storage ( 0f000000 ) and a value that stores the current size of the used characters as an integer right before the size value.  The floating point and boolean values are stored next.  Unused available bytes are filled with a so called "garbage value", in this case, cc.  There are 4 bytes before the string values that current state of this paper did not explore further at this time.