4-1 Основи цифрової криміналістики / лб 1 fat / Методичка FAT

1. Format the flash drive with the FAT file system. Choose the cluster size yourself.

2. Write to a flash file (for example, with a jpg extension) of about 100 kb.

3. Open the flash using the Active@ File Recovery and its built-in application Hex – viewer.

4.Perform a boot sector analysis.

Learn how to read hexadecimal information.

We can find the cluster size:

512 (sector size) * 32 (sectors per claster) = 16384 byte.

5. Analyze the FAT table

Here you can see the addressing of our file. Remember how file addressing is implemented in FAT.

6. Root directory analysis and record of our file.

Compare the entries in decimal and hexadecimal. Learn to understand the hexadecimal notation.

We know the first cluster of our file - 3 (it is clickable), the number of clusters that our file occupies is 7 (and accordingly the size of these 7 clusters is 114688).

7. We pass to the analysis of the DATE area.

This is the first byte of our file - offset 4210688.

The last byte of our file is offset 4210688 + 114688 = 4325376.

Mark the first byte of our file

Go to the last byte of our file and mark it.

copy our file

Open the hex editor and insert our file. Save with extension jpg

Our file is saved.

Next, we carry out all the previous steps for: 1. The file is deleted and analyzed. 2. We carry out fast formatting Flash. We repeat the analysis, see what happened, draw conclusions. 3. We carry out deep flash formatting. We repeat the analysis, see what happened, draw conclusions.