Answer the following questions using XXD, dd, file and stat commands, and use th

Question

Answer the following questions using XXD, dd, file and stat commands, and use the image below (Dropbox Link). You can use Windows, and Linux even on a VMWare.

https://www.dropbox.com/s/irktq6p0vsu4m4a/4860.1.whole.2015.zip?dl=0

Questions:

1. What is the physical size of the partition (run “stat ”)?

2. What is the MD5 hash of the partition?

3. What is the SHA-1 of the partition?

4. What is the file system?

5. At what offset does the first FAT start (that is, the hex offset)?

6. At what offset does the second FAT start (that is, the hex offset)?

7. At what offset does the root directory start (this is different from the videos. Search for “FILE”). Show this in HEX (e.g., in previous videos the root directory started at 0x2600)?

8. How many files are on the partition (deleted or undeleted files)?

File name

File Type

Physical Size

Logical Size

Starting Cluster

File1.jpg

JPG

138835

139264

0x5600

?

?

?

?

0x27600

File3.docx

Word document

22422

22528

0x4d640

?

?

?

?

0x4e190

File5.txt

Text file

23

2048

0x5de00

File name

MD5 hash

File1.jpg

38940ec5b3a309bca46e44f9aa2b4e12f67d5269

?

74fd (the first four bytes)

File3.docx

8bef5c51c67d3a58015c63dcb69e668b8f000a63

?

d880 (the first four bytes)

File5.txt

b99ca9cb2419b487eb04c15fe9a9499367e22566

File name

File Type

Physical Size

Logical Size

Starting Cluster

File1.jpg

JPG

138835

139264

0x5600

?

?

?

?

0x27600

File3.docx

Word document

22422

22528

0x4d640

?

?

?

?

0x4e190

File5.txt

Text file

23

2048

0x5de00

Explanation / Answer

Hi,

Below is the solution to your problem:

Answer:

a.What is the physical size of the partition?

For file 1: Command:stat file2.png

Output:152463

For file 2:Command:stat file5.txt

Output:23

b.What is the MD5 hash of the partition

For file 1: Command:md5sum file2.png

output:17cc37497337b2d217ed46711f65cd58

For file 2:Command:md5sum file5.txt

Output:4913483f328480828b0de16cb52f0c76

c.What is the SHA-1 of the partition?

For file 1: Command:sha1sum file2.png

output:74fde2180dfb04b16c31e9e85dd0dd41f38b97fe

For file 2:Command:sha1sum file5.txt

Output:b99ca9cb2419b487eb04c15fe9a9499367e22566

d.What is the file system?

For file 1:Command:df -T file2.png

Output:ext4

For file 2:Command:df -T file5.txt

Output:ext4

e.At what offset does the first FAT start?

For file 1:Output:0x27600

For file 2:0x4e190

f.How many files are on the partition

There are totally 5 files on the partition.

File name

File Type

Physical Size

Logical Size

Starting Cluster

File1.jpg

JPG

138835

139264

0x5600

File2.png

JPG

152463

152554

0x27600

File3.docx

Word document

22422

22528

0x4d640

File4.txt

Text File

23

2048

0x4e190

File5.txt

Text file

23

2048

0x5de00

File name

MD5 hash

File1.jpg

38940ec5b3a309bca46e44f9aa2b4e12f67d5269

File2.png

74fde2180dfb04b16c31e9e85dd0dd41f38b97fe

File3.docx

8bef5c51c67d3a58015c63dcb69e668b8f000a63

File4.txt

b99ca9cb2419b487eb04c15fe9a9499367e22566

File5.txt

b99ca9cb2419b487eb04c15fe9a9499367e22566

Hope that helps..HAPPY ANSWERING

File name

File Type

Physical Size

Logical Size

Starting Cluster

File1.jpg

JPG

138835

139264

0x5600

File2.png

JPG

152463

152554

0x27600

File3.docx

Word document

22422

22528

0x4d640

File4.txt

Text File

23

2048

0x4e190

File5.txt

Text file

23

2048

0x5de00

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.