Name:\t\tStudent Number: U<\/p>\n
Part I \u2013 File Tracking in FAT
\nExercise 1
\nReview the following volume boot record:<\/p>\n
1.\tWhat are the number sectors per cluster (Decimal) ? __________
\n2.\tWhat is the number of bytes per sector (Decimal) ? _________
\n3.\tWhat are the number bytes per cluster (Decimal) ? _________<\/p>\n
Using the following directory of files, complete the file allocation table using EOF for the End of File marker.<\/p>\n
File Name\tSize\tStarting Cluster
\nMYFILE1.PDF\t8534\t3
\nMYFILE2.MP3\t2876\t12
\nMYFILE3.XLS\t764\t15
\nMYFILE4.DOC\t19754\t16<\/p>\n
File Allocation Table \u2013 insert pointers (hints are shown in red)<\/p>\n
2\t3\t4\t5\t6\t7\t8\t9
\n4\t\t\t\t8
\n10\t11\t12\t13\t14\t15\t16\t17
\nEOF
\n18\t19\t20\t21\t22\t23\t24\t25
\n20\t\t\t\t\t\t26
\n26\t27\t28\t29\t30\t31\t32\t33
\n31
\n34\t35\t36\t37\t38\t39\t40\t41
\n0<\/p>\n
Exercise 2
\nReview the following volume boot record:<\/p>\n
1.\tWhat are the number sectors per cluster (Decimal) ?
\n2.\tWhat is the number of bytes per sector (Decimal) ? __________
\n3.\tWhat are the number bytes per cluster (Decimal) ?<\/p>\n
In this scenario, files are not contiguous, and the file allocation table reflects bad clusters. Using the following directory of files, complete the file allocation table using EOF for the End of File marker.<\/p>\n
File Name\tSize\tStarting Cluster
\nTEXT1.DOC\t5478 \t3
\nTEXT2.DOC\t4178 \t13
\nTEXT3.DOC\t14846 \t8
\nTEXT4.DOC\t15047 \t17
\nTEXT5.DOC\t47 \t5
\nTEXT6.DOC\t4097\t22<\/p>\n
File Allocation Table \u2013 insert pointers (hints are shown in red)<\/p>\n
2\t3\t4\t5\t6\t7\t8\t9
\nBAD\t\t9
\n10\t11\t12\t13\t14\t15\t16\t17
\nBAD\t\t\t\tBAD\tBAD\t\t19
\n18\t19\t20\t21\t22\t23\t24\t25
\nBAD\t\t21<\/p>\n
Part II \u2013 FAT Cluster Tracking<\/p>\n
Open the disk image 4.2-Exercise.001 using FTK Imager.<\/p>\n
1.\tWhat are the number sectors per cluster (Decimal) ?
\n2.\tWhat is the number of bytes per sector (Decimal) ? __________
\n3.\tWhat are the number bytes per cluster (Decimal) ?<\/p>\n
Complete the following table for each directory entry in the disk image. Exclude any folders, but include their contents. Hints are shown in red.<\/p>\n
Filename\tActual File Size
\n(Bytes)\tStarting
\nCluster
\nList the clusters
\nEmployer_Status.pdf\t\t\t4 – 14
\n15<\/p>\n
algae.html\t2249\t\t25<\/p>\n
30
\n2370
\n32
\n1706
\nsigmet.pdf
\n37<\/p>\n
Part III \u2013 RAM Slack and Residual Slack<\/p>\n
Open the disk image 4.2-Exercise.001 using FTK Imager.
\nComplete the following table. Hints are shown in red.<\/p>\n
Filename\tActual File Size
\n(Bytes)\tFile Slack\tRAM Slack
\nResidual Slack
\nEmployer_Status.pdf\t\t\t129<\/p>\n
311<\/p>\n
hybrid_email.txt\t\t\t\t3584<\/p>\n
190<\/p>\n
sigmet.pdf\t\t\t41
\n512<\/p>\n
Part IV \u2013 FAT File Recovery
\nExercise 1<\/p>\n
Start Active @ Disk Editor. Close the Getting Started screen if it appears. Select Add Disk Image and open the disk image 4.4-Exercise.001.<\/p>\n
Select the volume NO NAME and then Open in Disk Editor<\/p>\n
Examine the volume boot record.<\/p>\n
1.\tWhat are the number sectors per cluster (Decimal) ?
\n2.\tWhat are the number of bytes per sector (Decimal) ?
\n3.\tWhat are the number bytes per cluster (Decimal) ?<\/p>\n
Select the Navigate menu and then choose Root Directory.<\/p>\n
The first directory entry lists a deleted file with the name \u00e5NE.TXT<\/p>\n
4.\tWhat is its file size (Decimal)?
\n5.\tWhat is the first used cluster?
\n6.\tHow many clusters are needed for the file?<\/p>\n
Since the file was deleted, the first byte of the file was changed to \u00e5. Right-click on the first byte of the file, E5, and select Allow Edit Content.<\/p>\n
In the left pane, double-click the value for the file name, and change the \u00e5 to an underscore, _. The file name should now be _NE. Click Save and when prompted to confirm the changes, select Yes.<\/p>\n
7.\tAfter editing the file name, what is the value for the file name in hex?<\/p>\n
8.\tProvide a screen shot of the hex values of changed directory entry.<\/p>\n
To \u201cundelete\u201d the file, the file allocation table needs to be updated to link the clusters of the file. Select the Navigate menu and then choose FAT1.<\/p>\n
Using the information derived for the file from the directory entry of the file, edit the cluster(s) to reference the file. Navigate to FAT2 and do the same. Save your changes.<\/p>\n
9.\tProvide a screen shot of the hex values of the updated FAT.<\/p>\n
Following the same process, recover all other files in the image.<\/p>\n
10.\tFollowing the same process, recover all other files in the image. Provide a screen shot of the hex values of the all the changed entries in the root directory<\/p>\n
11.\tProvide a screen shot of the hex values of the completed file allocation table.<\/p>\n
12.\tMount the image in FTK Imager, highlight the root directory, and provide a screen shot of the root directory file list.<\/p>\n
Exercise 2 (Two Parts)<\/p>\n
Using Active @ Disk Editor, open the disk image 4.5-Exercise.001 and recover the 6 contiguous files. Remember to save your changes.<\/p>\n
HINT \u2013 the template feature of Active @ Disk Editor will be VERY helpful with this exercise.<\/p>\n
There are 3 basic ways to recover the images:
\n1.\t Manually. A manual recovery would require that you reassemble the Directory and the FAT tables based on available data. You should be able to view the images in FTK Imager afterwards.
\n2.\tSemi-Auto. Many tools and hex editors will allow you to highlight (or otherwise select) the clusters after you have identified them and perform a simple “save as a new file”. You would then click on the new file and your image will appear. The copy of WinHex on your disk should have this feature available. You can also do this with a source code editor such as NotePad++.
\n3.\tAutomatic – Many advanced tools will allow you to simply click a button to recover files from unallocated space. It is that simple. For example, try using Autopsy. Autopsy may be downloaded at:<\/p>\n
http:\/\/www.sleuthkit.org\/autopsy\/<\/p>\n
\u2022\tAutopsy is free.
\n\u2022\tBe sure to select the appropriate version, either the 32-bit (x86) version or the 64-bit (x64) version appropriate for your Windows installation.
\n\u2022\tA version of Autopsy compiled for Mac OSX is available from Surmuri on their ISO for the latest release of Paladin.<\/p>\n
Two Parts:<\/p>\n
Part 1: Manually recover File1.JPG by reassembling the directory and the FAT tables.<\/p>\n
All that you need to do is:<\/p>\n
(1) open the existing image 4.5-Exercise.001 (as is) in a hex editor
\n(2) fill in the information for the 4.5-Exercise.001 directory and the FAT directly in the existing image itself
\n(3) save the changes and close the existing image
\n(4) load the image into FTK Imager.<\/p>\n
A.\tPaste a screen capture of the reassembled directory entry here:<\/p>\n
a.\tIMPORTANT: Before you save your directory, type your first name in ACSII on the line below the directory entry. Take the screenshot with your name in the directory. Afterwards, overwrite your name with the values of 0x00 or the correct values. Then save the directory. You will NOT receive credit unless your screen capture contains your first name.<\/p>\n
B.\tPaste a screen capture of the one of the two reassembled FATs here:<\/p>\n
a.\tIMPORTANT: Before you save your first FAT, type your first name in ACSII on the line below the FAT entry. Take the screenshot with your name in the FAT. Afterwards, overwrite your name with the values of 0x00 or the correct values. Then save the directory. You will NOT receive credit unless your screen capture contains your first name.<\/p>\n
C.\tPaste a screen capture of the image as viewed in FTK Imager here. You must include enough of the surrounding Imager window so as to demonstrate that the image is being viewed from within FTK Imager. Your screen capture MUST display the Properties pane with the Starting Cluster and Starting Sector clearly displayed. You will NOT receive credit otherwise.<\/p>\n
Part 2: Recover the remaining images and complete the table below. You may use either automated or semi-automated methodologies, or even manual methods if you like.<\/p>\n
Please provide all answers in decimal or ASCII.<\/p>\n
Complete the following table for each file. Hints are shown in red.<\/p>\n
Filename and Extension\tClusters Used\tFile Size\tDescription
\nFILE1.JPG\t3-4\t\tSunset
\nPaste a copy of this photo below this table.
\nFILE2.BMP\t\t93690\tPaste a copy of this photo below this table.
\nFILE3.JPG\t\t\tPaste a copy of this photo below this table.
\nFILE4.GIF\t29-37\t\tGrapes
\nPaste a copy of this photo below this table.
\nFILE5.PNG\t\t30581\tPaste a copy of this photo below this table.
\nFILE6.JPG\t\t\tSailboat
\nPaste a copy of this photo below this table.<\/p>\n","protected":false},"excerpt":{"rendered":"
Name: Student Number: U Part I \u2013 File Tracking in FAT Exercise 1 Review the following volume boot record: 1. What are the number sectors\u2026<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7724,7548,8080,8079,8077,8078,8081],"tags":[187,22,181,175,186,177,180,97,179,91,73,9,7,178,182,77,184,183,185],"class_list":["post-98660","post","type-post","status-publish","format-standard","hentry","category-best-dissertation-writing-services","category-dissertation-writing-services-cost","category-master-thesis-writing-service","category-online-thesis-writing-services","category-phd-dissertation-help-and-editing-helper-in-usa","category-professional-dissertation-writing-service","category-write-my-dissertation","tag-best-assignment-help-websites-in-canada","tag-best-nursing-paper-writing-service","tag-buy-psychology-essay","tag-cheap-psychology-essay-writing-service","tag-dissertation-assignment-help","tag-history-dissertation-writing-services-by-uk-writers","tag-nursing-assignment-acers","tag-nursing-assignment-help","tag-nursing-assignment-help-canada","tag-nursing-assignment-writers","tag-nursing-dissertation-writing-help-online","tag-nursing-paper-writing-service","tag-online-nursing-essay-writing-service","tag-online-nursing-papers","tag-online-psychology-assignment-help-writing-services","tag-pay-for-nursing-essay","tag-psychology-assignment-topics","tag-psychology-homework-market","tag-write-my-history-essay-for-me"],"_links":{"self":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/98660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/comments?post=98660"}],"version-history":[{"count":0,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/98660\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/media?parent=98660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/categories?post=98660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/tags?post=98660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}