Assignment Directions:
The scope of this assignment is physical and logical disk structures, general file system identification, volume analysis, and the FAT file system. The basis of any file system begins with the partitioning scheme on the disk coupled with volume creation. In this assignment, you will examine the media with your tool(s) of choice and answer the following questions. In addition, you will provide feedback based on the scenario noted below.
Scenario: The suspect is accused of possessing child cornography (considered contraband) after a fellow employee observed him viewing the images on his computer. The suspect is an IT technician who was interviewed by Human Resources investigators. The suspect stated there is nothing on his computer that would constitute such a "disgusting act." HR investigators examined his primary hard drive and found nothing, but his secondary hard drive (a slaved drive) was seized but not examined yet. They have asked you to examine the hard drive to determine if the suspect is in possession of child cornography graphics (again, simulated contraband). He told investigators that they would not find anything and was certain this was an attempt by a fellow employee to get him fired.
1) There are ______ physical sectors contained in the forensic image of the media.
2) The size of the forensic image is approximately ______ gigabytes (enter a whole number, not a decimal value).
3) The MD5 Hash value of the physical media is ______.
4) The SHA1 hash value is ______.
5) The master boot record (MBR) is located in physical sector ______ (enter a numeric value, do not spell the number).
6) The partition table begins at sector offset ______.
7) The partition table contains 4entries, and each entry is ______ bytes in length.
8) The first partition begins in physical sector ______ and contains ______ sectors within the volume.
9) The first partition contains the ______ file system.
10) The file system type is identified by what hexadecimal value?
11) The file system type as noted in question #10 is located in the partition table at sector offset ______.
12) For the first partition, the volume name is ______.
13) For the first partition, the volume serial number is ______.
14) The second partition begins in physical sector ______.
15) The second partition contains ______ sectors within the volume.
16) On the second partition, the file system on the second partition is the ______ file system.
17) On the second partition, the volume name is ______.
18) On the second partition, the volume serial number is ______.
19) The third partition begins in physical sector ______.
20) The third partition contains ______ sectors within the volume.
21) The file system on the third partition is the ______ file system.
22) The identifier for the file system on the third partition is hex ______.
23) On the third partition, the volume name is ______.
24) On the third partition, the volume serial number is ______.
25) In the first partition, the backup copy of the volume boot record is located in physical sector ______.
26) In the second partition, the backup copy of the volume boot record is located in physical sector ______.
27) On the third partition, the backup copy of the volume boot record is located in physical sector ______.
28) How many user-created files exist on the first partition?
29) How many user-created files exist on the second partition?
30) How many user-created files exist on the third partition?
31) How many sectors per cluster are there on the first partition?
32) How many sectors per cluster are there on the second partition?
33) How many sectors per cluster are there on the third partition?
34) Excluding the first three partitions discussed in this assignment, did you locate any additional partitions in a deleted state (yes or no)?
35) What is the physical sector number of the volume boot record for the deleted partition?
36) What type of file system is contained within the deleted partition?
37) If any partitions were recovered, did you discover any text/document files that may describe the subject's intent to delete data?
38) The name of the file that contains reference to the subject's intent to delete or conceal data is _____.
39) How many contraband graphics (child cornography) did you recover?
40) For the file POP-CORN.JPG,what is the logical size of this file?
41) For the file POP-CORN.JPG,what is the physical size of this file?
42) For the file POP-CORN.JPG,what is the created date and time of this file?
43) For the file POP-CORN.JPG,what is the last written date and time of this file?
44) For the file POP-CORN.JPG,what is the last accessed date of this file?
45) For the file POP-CORN.JPG,the exact text on the box of popcorn is ______.
46) For the file POP-CORN.JPG, the starting cluster is ______.
47) For the file POP-CORN.JPG,there are ______ clusters allocated to this file?
48) There are______ folders on the deleted partition.
49) There are ______ sectors per cluster on the volume within the recovered partition?
50) The volume name of the deleted partition is ______.
Preparing a high-quality and high-scoring assignment paper on the topic Operating Systems and File System Forensics is not a cakewalk. And for that reason, we come up with the Operating Systems and File System Forensics Assignment Help service for resolving the queries of the students with ease.
Tags: Operating Systems and File System Forensics Assignment Help, Operating Systems and File System Forensics Homework Help, Operating Systems and File System Forensics Coursework, Operating Systems and File System Forensics Solved Assignments, Forensic Image Assignment Help, Forensic Image Homework Help