Question

Purpose:To begin investigating the FAT16 file system on a USB memory device. In particular, you will add a file to a FAT16 formatted device and observe the changes made to the FAT table.

Deliverables: For Steps 7, 8, 11, and 12 you are to describe, in detail, what happens to the FAT when a file is added. Be specific and explain WHAT happened and WHY. It is acceptable to add small screen shots to you DOC file, but only as an aid in describing your observations.

Activities:

1. Use a USB flash drive that contains NO data that you need.
   1. You will want this flash drive to be as small as possible!
   2. Really! You want this to be as small as possible.
2. Format the drive with the FAT16 file system.
   1. During the format process name your drive “YourName-1a”
3. Using FTK Imager add this device as an evidence item.
4. Select FAT1 and do a screen shot of the Hex View window.
5. Close FTK Imager.
6. Add a small text file to the root directory of the Flash drive.
7. Using FTK Imager add this device as an evidence item.
   1. Find FAT1 and do a screen shot of the Hex View window.
   2. Compare the 2 screen shots and write down the chain of sectors that contain the text file.
8. Select the text file in the File List window.
   1. Look at the Status Bar and identify the sector number.
   2. Compare that cluster number to the Cluster Chain. They should match (+1 offset) If they don’t match, repeat the process starting at step 7 to identify your problem.
9. Close FTK Imager
10. Add a medium sized image file to the root directory of the Flash drive.
11. Using FTK Imager add this device as an evidence item.
    1. Find FAT1 and do a screen shot of the Hex View window.
    2. Compare the 2 screen shots and write down the chain of sectors that contain the image file.
12. Select the image file in the File List window.
    1. Look at the Status Bar and identify the sector number.
    2. Compare that cluster number to the Cluster Chain. They should match (+1 offset) If they don’t match, repeat the process starting at step 7 to identify your problem.
13. Close FTK Imager

Answer 1

if you have any doubt then please ask me without any hesitation in the comment section below , if you like my answer then please thumbs up for the answer , before giving thumbs down please discuss the question it may possible that we may understand the question different way and we can edit and change the answers if you argue, thanks :)