DFIR$-$FAT$-$Root$-$Entries$-$

Based on what you can see in the first sector of the root directory of the partition in the forensic image file provided, answer the following questions:

a$)$ What is the size of the file file$1.$txt in bytes $($in decimal$)?$

b$)$ What is the size of the file file$1.$txt in clusters $($in decimal$)?$

c$)$ What is the size of the file file$1.$txt in sectors $($in decimal$)?$

d$)$ What is the size of the file file$2.$txt in bytes $($in decimal$)?$

e$)$ What is the size of the file file$2.$txt in clusters $($in decimal$)?$

f$)$ What is the size of the file file$2.$txt in sectors $($in decimal$)?$

g$)$ What is the starting cluster of file$1.$txt$?$

h$)$ What is the starting cluster of file$2.$txt$?$

i$)$ What is the creation date and time of file$1.$txt$?$

j$)$ What is the last access time of file$2.$txt$?$

k$)$ What is the last written time of file$2.$txt$?$

l$)$ How many total deleted files are there?

m$)$ Where does the deleted file $$file$3.$txt$$ start?

n$)$ What are the contents of the deleted file $$file$3.$txt$$ FAT Directories

BYTE OFFSET $($DECIMAL$)$

DESCRIPTION

First character of filename or status byte.

Characters $2-8$ of filename.

Three characters of the file extension.

Attributes

Reserved.

Creation time and date of file. Stored as MS$-$DOS $32-$bit date$/$time stamp.

Last accessed date$-$no time!

Two high bytes of FAT$32$ starting cluster. FAT$12/16$ will have zeros.

Last written time and date of file. Stored as MS$-$DOS $32-$bit date$/$time

stamp.

Starting cluster forFAT$12/16-$two low bytes of starting cluster for FAT$32.$

Size in bytes of file $(32-$bit integer$).$

Note: Will be o for directories.