1. Justin Andrews
ACSG 591
Lab 4.1
1. What is the file system used in this image?
c. FAT32
2. What is the time zone where this image was located?
b. Central
3. What is the total number of clusters contained in this image?
b. 120574
4. How many hidden sectors are contained in this image?
d. 2
5. On what date were the three files deleted?
b. 06/22/2009
Lab 4.2
1. What is the total number of clusters contained in this image?
c. 31487
2. What is the total size of this storage device in kilobytes?
a. 125951
3. How many clusters did the deleted MS Word document occupy in the image?
d. 8
4. What time was the bank.jpg file deleted?
d. 10:56
5. How many sectors are contained in each cluster?
c. 8

2. Lab 4.3
1. In the File Overview link, how many Total File Items were recovered?
b. 59
2. What is the total number of deleted files?
c. 13
3. How much Slack/Free Space is listed?
a. 10
4. What is listed in the Case Log?
c. a running log of all the work performed and the evidence with date and time stamps
5. In the Deleted Files link, what is the physical size of the deleted graphics image flie?
a. 22,528
Lab 4.4
1. What is the number of Total File Items recovered from the NTFS image?
c. 91
2. What is the number of graphic images recovered from the NTFS image?
c. 10
3. How many unknown file types are listed in the report?
a. 45
4. What is the physical size of the deleted graphic image file?
b. 24,528
5. What is the sector number for the deleted spreadsheet file?
d. 118,544