Reference no: EM132438789

CIS 6386 - Operating Systems and File System Forensics - University of Central Florida

Directions:

The scope of this assignment is physical and logical disk structures, general file system identification, volume analysis, and the FAT file system. The basis of any file system begins with the partitioning scheme on the disk coupled with volume creation. In this assignment, you will examine the media with your tool(s) of choice and answer the following questions. In addition, you will provide feedback based on the scenario noted below.

Scenario: The suspect is accused of possessing child cornography (considered contraband) after a fellow employee observed him viewing the images on his computer. The suspect is an IT technician who was interviewed by Human Resources investigators. The suspect stated there is nothing on his computer that would constitute such a "disgusting act." HR investigators examined his primary hard drive and found nothing, but his secondary hard drive (a slaved drive) was seized but not examined yet. They have asked you to examine the hard drive to determine if the suspect is in possession of child cornography graphics (again, simulated contraband). He told investigators that they would not find anything and was certain this was an attempt by a fellow employee to get him fired.

1) There are      physical sectors contained in the forensic image of the media. 

2) The size of the forensic image is approximately       gigabytes (enter a whole number, not a decimal value).

3) The MD5 Hash value of the physical media is     .

4) The SHA1 hash value is      .

5) The master boot record (MBR) is located in physical sector      (enter a numeric value, do not spell the number).

6) The partition table begins at sector offset      .

7) The partition table contains 4entries, and each entry is      bytes in length.

8) The first partition begins in physical sector       and contains       sectors within the volume.

9) The first partition contains the      file system.

10) The file system type is identified by what hexadecimal value?       . 

11) The file system type as noted in question #10 is located in the partition table atsector offset      . 

12) For the first partition, the volume name is      .

13) For the first partition, the volume serial number is      .

14) The second partition begins in physical sector      .

15) The second partition contains       sectors within the volume.

16) On the second partition, the file system on the second partition is the       file system.

17) On the second partition, thevolume name is      .

18) On the second partition, thevolume serial number is      .

19) The third partition begins in physical sector      .

20) The third partition contains       sectors within the volume.

21) The file system on the third partition is the       file system.

22) The identifier for the file system on the third partition is hex      . 

23) On the third partition, the volume name is      .

24) On the third partition, the volume serial number is      .

25) In the first partition, the backup copy of the volume boot record is located in physical sector      .

26) In the second partition, the backup copy of the volume boot record is located in physical sector      .

27) On the third partition, the backup copy of the volume boot record is located in physical sector      .

28) How many user-created files exist on the first partition?      

29) How many user-created files exist on the second partition?      

30) How many user-created files exist on the third partition?      

31) How many sectors per cluster are there on the first partition?      

32) How many sectors per cluster are there on the second partition?      

33) How many sectors per cluster are there on the third partition?      

34) Excluding the first three partitions discussed in this assignment, did you locate any additional partitions in a deleted state (yes or no)?  

35) What is the physical sector number of the volume boot record for the deleted partition?      

36) What type of file system is contained within the deleted partition?      

37) If any partitions were recovered, did you discover any text/document files that may describe the subject's intent to delete data?      

38) The name of the file that contains reference to the subject's intent to delete or conceal data is     .

39) How many contraband graphics (child cornography) did you recover?      

40) For the file POP-CORN.JPG,what is the logical size of this file?      

41) For the file POP-CORN.JPG,what is the physical size of this file?      

42) For the file POP-CORN.JPG,what is the created date and time of this file?      

43) For the file POP-CORN.JPG,what is the last written date and time of this file?      

44) For the file POP-CORN.JPG,what is the last accessed date of this file?      

45) For the file POP-CORN.JPG,the exact text on the box of popcorn is     .

46) For the file POP-CORN.JPG, the starting cluster is     .

47) For the file POP-CORN.JPG,there are      clusters allocated to this file?

48) There are       folders on the deleted partition.

49) There are       sectors per cluster on the volume within the recovered partition?

50) The volume name of the deleted partition is      .