TIME == OFFSET 22, length = one word (2 bytes)

• Each Word has bits from 15 to 0.
• Well have to show our Word in that order in binary to find out what time it is.
• Bits 15-11 are Hours (0-23)
• Bits 10-5 are Minutes (0-59)
• Bits 4-0 are Second/2 (0-29) (only even seconds are stored.

REMEMBER we are Little Endian so we REVERSE THE ORDER of the two Bytes we find at Offset 22.

TIME EXAMPLE: 1b b5

• First we reverse our order: b5 1b
• Then we convert o Binary: 1011 0101 0001 1011
• Bits 15 11 are our hours 10110
• (1 x 16) + (0 x 8) + (1 x 4) + (1 x 2) + (1 x 0) = 22
• Bits 10-5 are our minutes 101000
• (1 x 32) + (1 x 8) = 40
• Bits 0-4 are our seconds 11011
• (1 x 16) + (1 x 8) + (0 x 4) + (1 x 2) + (1 x 1) = 27 x 2 = 54
• So this file was created at 22:40:54 (or 10:40 pm)

DATE == OFFSET 24, length = one word (2 bytes)

• Each Word has bits from 15 to 0.
• Well have to show our Word in that order in binary to find out what time it is.
• Bits 15-9 are the year (0 = 1980) add to 1980
• Bits 8-5 are the month (0-12)
• Bits 4-0 are the day of the month (0-31)
• Date is ALSO Little Endian, so we will reverse the bytes at offset 24 and 25.

DATE EXAMPLE: 30 36

• First we reverse our order: 36 30
• Then we convert to Binary: 0011 0110 0011 0000
• 00110110 00110000
• First 7 bits is the year (0 = 1980)
• 0011011
• (16 x 1) + (8 x 1) + (2 x 1) + (1 x 1) = 27 + 1980 = 2007
• Next 4 bits is the month (0-12)
• (1 x 1) = 1 = January
• Last 5 bits is the date (0-31)
• (1 x 16) = 16
• So our date of last modification was:
• January 16, 2007

ASSIGNMENT PORTION

Make an Image of your thumb drive.

Use Fsstat to determine the starting location of your Root Directory.

Choose at least THREE FILES that are listed in the directory.

Take a screenshot of your Frhed Hex Editor showing the file entry for the three files you have chosen.

Calculate the DATE and TIME of each of those files, showing your work in the following steps:

FOR EACH OF THREE FILES:

1. My value at Offset 22-23
2. Reverse the Bytes, and convert to Binary
3. Indicate which bits are the HOUR and calculate
4. Indicate which bits are the DAY and calculate
5. Indicate which bits are the SECONDS and calculate
6. Give the Timestamp
7. My value at Offset 24-25
8. Reverse the Bytes and convert to Binary
9. Indicate which bits are the YEAR and calculate
10. Indicate which bits are the MONTH and calculate
11. Indicate which bits are the DAY and calculate

REMEMBER TO DO THIS THREE TIMES FOR CREDIT!!!!