v

Answer the questions below using xxd, dd, file and stat commands.

1. What is the physical size of the partition (run stat )?

2. What is the MD5 hash of the partition?
3. What is the SHA-1 of the partition?
4. What is the file system?
5. At what offset does the first FAT start (that is, the hex offset)?
6. At what offset does the second FAT start (that is, the hex offset)?
7. At what offset does the root directory?
8. How many files are on the partition (deleted or undeleted files)?
9. Complete the table below. List the file names, types, physical and logical sizes, and starting logical cluster below for each deleted file:

File name	File Type	Logical Size	Physical Size	Starting Offset
file1.png	PNG	73380	73728	0x4400
?	?	?	?	0x16400
file3.jpg	JPG	53996	54272	0x21600
?	?	?	?	0x2EA00
file5.txt	Text file	37591	37888	0x37200

10. Use dd to recover deleted files and sha1sum to hash the files. Copy and paste the calculated hashes in the second column for the recovered files. The hashes for the allocated files have been provided for you along with the first four bytes of the deleted files so you can check your work.

File name	Sha1 hash
file1.jpg	98652815708b00e377043c6587c545e52cc42e50
?	f1a0 (the first four bytes)
file3.jpg	d6b5b17969b086bf6a329fbb1dc1a5b54c468785
?	00ba (the first four bytes)
file5.txt	0b4290da0b0b7d4d9babce8bf76bf9900f9247bd

11. Why are there two entries in the root directory for each file? Be specific in your answer.
12. Why is the physical size of a file usually greater than or equal to the logical size of the file? Be specific in your answer.