Fix the mistakes that my professors pointed out:
P1,E2: $MFT starting cluster = 8021P1,E2: $MFTMIRR starting cluster = 4P2,E1: update sequence number #40 = 0x00 04P2,E2: Please carry out time stamps to include the seconds. They are an important part of the time stamp in forensics.P2,E2 – DOS Attributes #36 = not applicableP2,E2 – Security ID #40: 0x00 00 01 06 or 262E3: Please carry out time stamps to include the seconds. They are an important part of the time stamp in forensics.P4: Allocated or Deleted – incorrectP4: Update sequence number – incorrect
Testimonials
M5 Graded Lab Exercises