QUESTION

(a) Being just employed as junior forensic examiner at SAI computer forensic Ltd, your supervisor told you, ‘hey Moona Tambi, we have received a hard disk for examination, I would like you to analyze the areas on this hard disk where we can get hidden information and document your findings'. Stunned I looked at his face. I said to myself, ‘how the hell will i do it'
Surprisingly the supervisor starts asking-

i. Where data could be hidden? Give two places and explain them in detailed

ii. What command would you use to take a backup and restore the first sector of the hard disk in Linux?

(b) After that your supervisor has asked the above questions, he realized that you have just been recruited and hence he himself did the analysis. When retrieving ‘a.ii' he could only get the below information about the hard disk. ‘Moona Tambi, I have already retrieved the required information, we need the hard disk size to finalize our report, please calculate the size of it and let me know', instructed my supervisor with a smile on his face and again added, ‘hope this time I will not have to come and do it. Don't forget it's a Windows machine with FAT 32.'

1. 16,384 cylinders

2. 80 heads

3. 63 sectors per track

(c) Briefly explain the different types of file systems that you as forensic expert would be experiencing