Problem

(a) Distinguish between how NTFS and FAT store time. Describe your answer.

(b) Unix epoch starts as from January 1, 1970, 00:00:00 GMT. Provide that Unix stores time (timestamp) as a 32-bit integer. Explian how time is calculated based on the 32 bit value.

(c) When a file is deleted in Windows Vista or higher, it goes to Recycle Bin and two files are created. These filenames start with $R and $I respectively.

(i) What is the importance of these two files.

(ii) What is the consequence, should the $I file be corrupted?

(d) Consider that evidence is required to prove that a suspect has downloaded a pirated movie named "Lost.avi".

(i) Which Windows OS artifact makes it possible to know if the suspect has viewed the file "Lost.avi" after it has been downloaded on his/her computer?

(ii) Where is this artifact often stored on the suspect's computer?

(iii) Is it possible to know when the last time the file "Lost.avi" was accessed through this artifact? Justify your answer.

(e) Consider a computer running Windows 2000 operating system and that there are no previous items in the Recycle Bin. If the user performs the subsequent actions, list down in the correct order the file name entries in the INFO2 file.

(i) user deletes the file named "ProgDescription.doc" from the D: drive.

(ii) user deletes the file named "budget2012.xls" from the C: drive.