Using the hex editor of your choice, explore the image provided and try to locate evidence of contraband pictures.

Using the Image Lab05.E01:

Found at: https://drive.google.com/open?id=1NkUl6YnZitspBZFp8m9ysb19IWs2zAOI

Find the root directory and take a screenshot.

Are there deleted files in the root directory? How do you know they are deleted?

For the deleted files, find the FAT and see if you can determine what clusters are storing the remnants of the files. Take screenshot of the FAT, and circle the cluster numbers of at least one deleted file.

Using a search for JFIF, see if you can locate any of the deleted images in the file system. Take a screenshot.

Search for any textual information in the image that might indicate that the pictures are there on purpose and not by accident. Again, take a screenshot.