CECS $7237$ Lab $2-$ The NTFS File System Instructions: Please complete the exercise $($perform the lab exercise$).$ Please answer all the premises and include a screenshot of each answer.

$1.$ Insert a USB drive into your computer. Do a right click format and $($if possible$)$ format as NTFS$.$ If this is not possible ascertain what is the drive letter of the usb drive $($probably E:$)$ and open a command prompt. Try to format the drive using

FORMAT E: $/$FS:NTFS

$2.$ Open notepad and create a test file test.txt$.$ Add some random text to the file for example bcbgmaxamaria or your name or whatever you like. Save the file to

the usb drive.

$3.$ Open windows explorer and navigate to the usb drive $($or the c drive$).$ Choose the file you just created and do a right click properties on the file.

what is the name of the file?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what is the size of the file?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what is the size of the file on disk?$\_\_\_\_\_\_\_\_\_\_\_\_$

when was the file created?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what does the advanced button tell you?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what are the other property tabs besides general?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

$4.$ Download and install disk editor freeware. Use it to open the usb drive or c:

where is the MFT located?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what are the first $5$ bytes of the MFT in hexadecimal?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

what are the first $5$ bytes of the MFT in ASCII?$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

use the mouse over capability to find $3$ file attributes of the file and their values:

attribute $1\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$ value:$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

attribute $2\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$ value:$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

attribute $3\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$ value:$\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_$

$5.$ Rename the file you created. What happens to the MFT entry for the file?

$6.$ Add a directory and see if you can find it with disk editor. Where is it located?

$7.$ Look up NTFS alternate data streams. Can you use this feature of NTFS to hide a secret message in your test.txt file? What is the command to do this?

$8.$ Delete the file you created. What happens to the MFT entry for the file?