computer forensics
image file link: https://drive.google.com/file/d/1GyfI1aQ48UnSQRDBmtAhOjyOQrIcIMXl/view?usp=sharing
Can you briefly describe also how did you get the answer? Thankyou !
Paragraph Styles Open the image with FTK lmager and answer the following questions How many bytes are there in a cluster? What is the physical sector location of the beginning of the NTFS partition? How many sectors are there in a cluster? What is the logical cluster number for the $MftMirr? What is the logical cluster number for the $Mft? Go to cluster 7. That is the beginning of the MFT's that are not metadata (if you remember, metadata are contained in the rirst l6 MFT records). Look at the first MFT record in cluster 7 and answer the following questions: 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length 3. What is the create date and time of the attribute/s? Go to cluster 9 and look at the MFT record and answer the following question:s 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length 3. If there is a $File name attribute, what is the file name? Go to cluster 14 and look at the MFT record and answer the following questions 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length. 3. If there is a $File_name attribute, what is the file name? 4. Is the file a resident file or a non-resident file? 5. What is the data that is stored in this file? a. b. c. d. e. f. g. h. Paragraph Styles Open the image with FTK lmager and answer the following questions How many bytes are there in a cluster? What is the physical sector location of the beginning of the NTFS partition? How many sectors are there in a cluster? What is the logical cluster number for the $MftMirr? What is the logical cluster number for the $Mft? Go to cluster 7. That is the beginning of the MFT's that are not metadata (if you remember, metadata are contained in the rirst l6 MFT records). Look at the first MFT record in cluster 7 and answer the following questions: 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length 3. What is the create date and time of the attribute/s? Go to cluster 9 and look at the MFT record and answer the following question:s 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length 3. If there is a $File name attribute, what is the file name? Go to cluster 14 and look at the MFT record and answer the following questions 1. How many attribute/s are listed in this record? 2. List the attribute id for each attribute and its record length. 3. If there is a $File_name attribute, what is the file name? 4. Is the file a resident file or a non-resident file? 5. What is the data that is stored in this file? a. b. c. d. e. f. g. h
