Intro to digital fornesics

P a g e | 1

CSCI 352 - Digital Forensics Assignment #3

Spring 2020

Due Date: Tuesday, April 14, 2020

Total Points: 100

Answer the following questions, using TSK. Make sure to justify your answers and include the

commands you used and the output you got from those commands.

Given Q.E01:

1. What is the type of the file system?

2. What is the volume label?

3. What is the sector size?

4. What is the cluster size?

5. List the first four undeleted files that are stored in the image file. Make sure to indicate the

following information: file name, file size, starting sector, ending sector, and whether the file is

fragmented or not.

6. What is the command that extracts all the unallocated blocks and saves it in a file called

unallocated.dd?

7. What is the command that extracts all the allocated blocks and saves it in a file called

allocated.dd?

8. Using fls command list all the files that were deleted in the image file.

9. Using fls command list all the directories that are undeleted in the image file.

10. Recover the first four deleted files. The first two using fcat, and the other two using icat.

Make sure to display the contents of each recovered file and whether it is recovered properly

or not.

What to hand in

Submit your project electronically through D2L. Please hand in the following:

P a g e | 2

• Your answers (report) in Word or PDF format.

• In addition to the contents of the reports, the grade will also be based on the readability and

formatting/presentation.