There is a deleted partition on the image disk01.dd (/images/disk01.dd)

Most of the time files are stored in directories for easy management. In FAT file system directories and files are located in the "Root Directory". If the file system is corrupted or missing for any reason, it would be very hard to see and analyse files/directories stored on the physical media. To search for directories in unallocated space and when file system is not available, you have to use sigfind command and search for 0x2e202020 directory signature (ASCII representation of a "period" and three "spaces", e.g. ". "). Then by using dd command open the location of that possible directory and see if there are any file located in that directory.

Use sigfind command to locate a FAT directory on the image. There is only 1 FAT directory on the image. What sector is this directory in?
FAT directory sector:

Examine the disk sector you discovered in the previous question using a hex/ascii data viewer.

What is the first 6 characters of the first filename located in the FAT directory identified in the previous question? Do not type any spaces and remember the filename is case sensitive.
First directory entry:

Staying in that directory used above, use the record metadata information to answer the following questions.

To complete the task you need to recall the FAT directory structure, shown below.

The File Attributes are an OR of the following information:

Using dd and xxd, scan this FAT directory you have discovered and calculate the offset for the file IMAGES.JPG. Format it in three digit hex, e.g. 0x000.
Offset:

The creation time, held in the FAT record for IMAGES.JPG starts at offset 13. The first byte is the ms part of the time, so for simplicity focus on the two bytes starting at offset 14 (which relates to hours, minutes, and seconds).
Bits 0-4 are seconds/2: 10001 = 17, then *2 is 34 seconds.
Bits 5-10 are Minutes: 000100 = 4 minutes.
Bits 11-15 are Hours: 01000 = 8 hours.
So the creation time is 08:04:34

What is the hex native endian creation time (at offset 14) of IMAGES.JPG? Format as 0x0000.
Native endian:

What is the hex big endian creation time of IMAGES.JPG? Format as 0x0000.
Big endian:

What is the binary big endian creation time of IMAGES.JPG? Format as 10000000000 with no leading zeros.
Big endian binary:

What is the creation time in hr:mn:sc?
Creation Time:

Dates are similar in procedure to convert, except that:
Day is bits 0-4
Month is bits 5-8
Year is bits 9-15 + 1980

What is the creation day of IMAGES.JPG in the format 1 JAN 2012.
Creation Date: January February March April May June July August September October November December

What is the starting cluster shown in this directory entry?

What is the file size in bytes?