Encase: Download a $.$jpg from the Internet or your thumb drive and place it in a location where you can find it easily on your hard drive. Open up EnCase and click on new case and call this case Case $1.$jpg and be sure to have your name in the examiners field. The default export folder and temporary folders can stay as the default. Click finish and you are ready for a new case.

Now click add device and select the local drive which should be your C drive. Just place a check in the box next to your local drive. Hit Next. Now you choose the device again which is your C drive and click next and finish. EnCase will now read your C drive. Be sure to uncheck any boxes after you add device. This may take some time but be patient.

You will now have to drill down in the left pane by clicking on the $+$ sign to the location your $.$jpg is located. Check the $.$jpg and you should see the picture in the bottom screen.

Change to Hex view.

$7.$ What are the first few Bytes of information for that $.$jpg$?$

Print out the report or attach for this $.$jpg

$8.$ How many sectors does this $.$jpg use?

$9.$ How many clusters does it use?

$10.$ Where would any slack space be located if there were some available slack space in reference to this file?

$11.$ Does the physical size of the $.$jpg match the logical size? If not why?

$12.$ What sector is FF D$9($footer$)$ in$?$

$13.$ Is there any information after the FF D$9?$ Why or why not?