Question 3: Please examine the $MFT FILE Record below and report on its content.

Question 3 (10 marks)

Please examine the $MFT FILE Record below and report on its content.

Hints: Read chapter 5 of the textbook and week 6 lecture slides to prepare for your response.

For conversion you can use DCode software (https://www.digital-detective.net/dcode/)

Your answers need to include the detail description of the following attributes and their corresponding values.

  • Attributes x010
  • Attributes x030
  • Attributes x080

In your Data run (0x80), show the calculations of starting cluster number, number of clusters. Carefully consider the VCN while calculating the starting position of cluster.

Expert's Answer

help

Hire Expert 

Get a Professional Help


200
Select FileChangeRemove

TOP