The expertise needed on this assignment is a computer forensic.
The assignment requires examine the NTFS file at the binary level and resolve/interpret binary values . By using a forensic tool such as Winhex, the supplied hard drive on DD format is available for parsing.