Practice Feb 19

• Open FTK Imager
• Add Clampet18.aff image
• Highlight Volume name (look for [NTFS])
• Find the size of the cluster in bytes
• Go to $MFT
• Search for funny
• Follow steps we learned in class to extract file data. This file is jpg file so make sure you save your selection as .jpg file
• Pay attention on the size of the cluster while calculating the size of the file in bytes!