Hardware/Software Setup Required

WinHex 15-1 SR-8 (available at http://www.x-ways.net/winhex/ or the EC-Council Certification Portal http://portal.eccouncil.org/)

Problem Description

Slack space is the area of a disk cluster between the end of the file and the end of the cluster. If the size of a file is less than the cluster size, a full cluster is still assigned to that file. The remaining space remains unused and is called slack space.

Slack space can be used to hide information. When analyzing a disk, you should also review the information contained in a file slack space. For this exercise, you will use WinHex to analyze files on a flash drive. First, you will extract a copy of the boot sector. Next, you will select any file, find its slack space, and extract the information contained there.

Estimated completion time: 1 hour

Outcome

• A report of the steps you need to perform these tasks
• A copy of the boot sector
• A file with the information on a file’s slack space

Validation/Evaluation

How big is the boot sector?

What is the structure of a FAT boot sector?

How can you extract the content of the slack space into a file?

Lab Solution

Download WinHex from http://www.x-ways.net/winhex/ and install it on your computer.

Connect a flash drive to your computer.

Start WinHex.

ISSC459Week 2 Lab 1Name: _________________________Date: _____________Fill in your name above, put your full response below the question, save the ±le using the ±lenaming convention: “ISSC459_Lab1_LastName_FirstName.doc” where LastName is yourlast name and FirstName is your ±rst name, then return this document for grading.Hardware/Software Setup RequiredWinHex 15-1 SR-8 (available athttp://www.x-ways.net/winhex/or the EC-Council Certi±cationPortalhttp://portal.eccouncil.org/)Problem DescriptionSlack space is the area of a disk cluster between the end of the ±le and the end of thecluster. If the size of a ±le is less than the cluster size, a full cluster is still assigned to that±le. The remaining space remains unused and is called slack space.Slack space can be used to hide information. When analyzing a disk, you should also reviewthe information contained in a ±le slack space. For this exercise, you will use WinHex toanalyze ±les on a ²ash drive. First, you will extract a copy of the boot sector. Next, you willselect any ±le, ±nd its slack space, and extract the information contained there.Estimated completion time:1 hourOutcomeA report of the steps you need to perform these tasksA copy of the boot sectorA ±le with the information on a ±le’s slack spaceValidation/EvaluationHow big is the boot sector?What is the structure of a FAT boot sector?How can you extract the content of the slack space into a ±le?

ComputerScienceExpert

(11)

Status NEW Posted 11 May 2017 06:05 AM My Price 9.00

-----------

Attachments

file 1494482930-Solutions file 2.docx preview (51 words )

H-----------ell-----------o S-----------ir/-----------Mad-----------am ----------- Th-----------ank----------- yo-----------u f-----------or -----------you-----------r i-----------nte-----------res-----------t a-----------nd -----------buy-----------ing----------- my----------- po-----------ste-----------d s-----------olu-----------tio-----------n. -----------Ple-----------ase----------- pi-----------ng -----------me -----------on -----------cha-----------t I----------- am----------- on-----------lin-----------e o-----------r i-----------nbo-----------x m-----------e a----------- me-----------ssa-----------ge -----------I w-----------ill----------- be----------- qu-----------ick-----------ly -----------onl-----------ine----------- an-----------d g-----------ive----------- yo-----------u e-----------xac-----------t f-----------ile----------- an-----------d t-----------he -----------sam-----------e f-----------ile----------- is----------- al-----------so -----------sen-----------t t-----------o y-----------our----------- em-----------ail----------- th-----------at -----------is -----------reg-----------ist-----------ere-----------d o-----------n -----------THI-----------S W-----------EBS-----------ITE-----------. ----------- Th-----------ank----------- yo-----------u -----------

Not Rated(0)

• Buy Answer