Deleted file recovery and file carving . command line

In this exercise we will use USB image called usbimg1.dd. It should be located in /images directory.

Make sure that you have /evidence directory located in /home/caine/

Use the mmls command to check the layout of the usbimg1.dd image

what kind of file system is installed in the first partition?
hidden fat16 fat16 fat32 Novell Netware NTFS Linux Linux Swap

List all the files from the image by using fls command.

Are there any deleted files? List all the inodes of the deleted files in the format "1,2,3,4". Put the inodes in ascending order and do not includes spaces in the string.

What is the name of the first of these deleted files.

Inspect the metadata of both files by using istat command.

What is the Directory Entry status for inode 10?
No such thing Not Allocated File is not deleted File Atribute: File, Archive

Record the size and the first and last sector number for the inodes which relate to the first two deleted files found earlier.
First File: First Sector Last Sector
Second File: First Sector Last Sector

Inspect the first and the last sector of the inode 10 by using dd and hexdump (xxd) commands. Save the xdd output in to two seperate files called first_sector.txt and last_sector.txt. Make sure that you place both files in to /evidence directory.

Hint: Do not forget about offset 63

Open both files and check the signature and the footer of the jpg file. Record both values. Use hex in the format 0x0000.
First File: signature footer
Second File: signature footer

Based on the output from the last_sector.txt file calcuate the size in bytes of the slack space.
Slack bytes

Is there any data located in the slack space?
I am not sure Maybe, I need to Goole the answer No there is not Yes there is

Assume that there is a jpeg on the usb image which has lost its metadata. Use sigfind to find all files which contain the jpep signature. What is the second last one found by sigfind?
Second last block:

Using xxd and dd, go one block at a time (assuming that the file is not fragmented, and find the end block using what you know about the trailing marker for jpegs.
end block:

What is the overall length in bytes of this jpeg file?
length:

Extract the whole file using "dd". The starting offset in bytes is the first block * 512. So use:

  dd if=/images/usbimg1.dd bs=1 skip=START_IN_BYTES count=LENGTH_IN_BYTES of=/home/caine/evidence/img.jpg