Please Help with my File Systems Homework!

Purpose: Th e purpose of this assignment is to familiarize yourself with the NTFS file system and its implications for digital forensics Instructions: Write vour answers on a separate s heet and include your name & Banner ID. You may hand-write or type your answers (preferred), but they must be legible if hand-written. Questions: 1. Relative to the start of the partition/volume, where does the first addressable cluster begin? 2. File systems must store essential location & fragmentation data to help locate and reassemble files. In FAT, such metadata is stored in the respective file's directory entry and in the file allocation table (FAT). Regarding NTFS, answer the following questions a. In what file is this information stored for all files in NTFS? b. In which attribute is this information stored? 3. Briefly explain why the MFT (SMFT) has an entry for itself. 4. How large is an MFT entry typically? 5. In an NTFS file system, what is the maximum sized file that would be stored (i.e. the file's content) within the MFT SDATA entry? AND what is the term for such attribute content stored within the MFT entry? If a file is too big to be stored in the MFT entry, what is the term for such attribute content stored outside the MFT entry? AND what will be stored inside the attribute content area instead of the file content? 6. What are the two primary areas of an MFT entry called? Which one only contains information about the entry itself, and not any information really about the file or directory to which the entry pertains? 7. 8. Are MFT entry attributes static or dynamic data structures? 9. Which attribute(s) contain file MAC date/time information? If more than one, which one should you consider to be more reliablef? 10. Briefly explain the SBitmap file in NTFS