As mentioned in the Introduction section, NTFS is the file system used by the professional versions...

Transcribed Image Text:

As mentioned in the Introduction section, NTFS is the file system used by the professional versions of Windows. Because of the way NTFS manages files, it is much easier to undelete them, as long as new files have neither overwritten the metadata nor the "deleted" data on the disk. Mount the virtual disk: sudo mount -o loop ntfs.img mnt Use the command 11 mnt/ to display the size (in bytes) of the files under the directory mnt. The file size is displayed before the Month. INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE COMMAND SHOWING THE FILES IN /MNT Delete file1 and securely delete file3, using the commands: rm mnt/filel shred -uxz mnt/file3 Un-mount the "disk" by doing the following: sudo umount mnt Verify that the data still exists on the virtual disk by entering the following command: strings -td ntfs.img | grep file INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE STRINGS COMMAND Use the ntfsundelete command to find information about deleted files, as shown below. Note that the inode number is the left-most number in the output. ntfsundelete -p 100 ntfs.img INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE COMMAND SHOWING THE INODE NUMBER FOR FILE1 Undelete file1 using the following command (replacing INODE with the number of the recoverable file): ntfsundelete --undelete --inodes INODE --output rfilel ntfs.img Use 11 to list the contents of the current directory. You should see the deleted file. Once again, this utility pulls the file out of the file system. Use the cat command to display the content of rfile1. INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE CAT COMMAND SHOWING THE CONTENT OF RFILE1 6) Add your own experiment to the lab that is not one of the tasks previously given that is related to the topic of the lab. ADD YOUR EXPERIMENT: Describe what you did and add screenshots to document the steps and results. Complete lab After finishing the lab, go to the terminal window that was used to start the lab and type: stoplab As mentioned in the Introduction section, NTFS is the file system used by the professional versions of Windows. Because of the way NTFS manages files, it is much easier to undelete them, as long as new files have neither overwritten the metadata nor the "deleted" data on the disk. Mount the virtual disk: sudo mount -o loop ntfs.img mnt Use the command 11 mnt/ to display the size (in bytes) of the files under the directory mnt. The file size is displayed before the Month. INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE COMMAND SHOWING THE FILES IN /MNT Delete file1 and securely delete file3, using the commands: rm mnt/filel shred -uxz mnt/file3 Un-mount the "disk" by doing the following: sudo umount mnt Verify that the data still exists on the virtual disk by entering the following command: strings -td ntfs.img | grep file INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE STRINGS COMMAND Use the ntfsundelete command to find information about deleted files, as shown below. Note that the inode number is the left-most number in the output. ntfsundelete -p 100 ntfs.img INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE COMMAND SHOWING THE INODE NUMBER FOR FILE1 Undelete file1 using the following command (replacing INODE with the number of the recoverable file): ntfsundelete --undelete --inodes INODE --output rfilel ntfs.img Use 11 to list the contents of the current directory. You should see the deleted file. Once again, this utility pulls the file out of the file system. Use the cat command to display the content of rfile1. INSERT YOUR SCREENSHOT OF THE RESULT OF THE ABOVE CAT COMMAND SHOWING THE CONTENT OF RFILE1 6) Add your own experiment to the lab that is not one of the tasks previously given that is related to the topic of the lab. ADD YOUR EXPERIMENT: Describe what you did and add screenshots to document the steps and results. Complete lab After finishing the lab, go to the terminal window that was used to start the lab and type: stoplab