DFIR$-$FAT$-$Root$-$Entries$-$Assignment$4$

Based on what you can see in the first sector of the root directory of the partition in the forensic image file provided, answer the following questions:

a$)$ What is the size of the file file$1.$txt in bytes $($in decimal$)?$

b$)$ What is the size of the file file$1.$txt in clusters $($in decimal$)?$

c$)$ What is the size of the file file$1.$txt in sectors $($in decimal$)?$

d$)$ What is the size of the file file$2.$txt in bytes $($in decimal$)?$

e$)$ What is the size of the file file$2.$txt in clusters $($in decimal$)?$

f$)$ What is the size of the file file$2.$txt in sectors $($in decimal$)?$

g$)$ What is the starting cluster of file$1.$txt$?$

h$)$ What is the starting cluster of file$2.$txt$?$

i$)$ What is the creation date and time of file$1.$txt$?$

j$)$ What is the last access time of file$2.$txt$?$

k$)$ What is the last written time of file$2.$txt$?$

l$)$ How many total deleted files are there?

m$)$ Where does the deleted file $$file$3.$txt$$ start?

n$)$ What are the contents of the deleted file $$file$3.$txt$$ FAT Directories