Homework 03 - Alternate
1) What is the difference between imaging and copying? Which technique should be used in forensics? Justify your answer.
- Imaging is ....
- Copying is ....
- In forensics, we should use because
2) The hex dump provided below is from the Partition Table in a device's Master Boot Record.
\begin{tabular}{|l|l|l|l|l|l|l|l|l|}
\hline Offset & 0 & 2 & 4 & 6 & 8 & A & C & E \\
\hline 01B0: & CD10 & AC3C & 0075 & F4C3 & 1CBE & 0B00 & 0000 & 0020 \\
01C0: & 2100 & 0751 & 0110 & 0008 & 0000 & \( 00 F 8 \) & 0300 & 0051 \\
01D0: & 0210 & 835B & 0912 & 0000 & 0400 & 0080 & 0000 & \( 005 B \) \\
01E0: & OA12 & OBFE & FFFF & 0080 & 0400 & 0080 & D601 & 0000 \\
01F0: & 0000 & 0000 & 0000 & 0000 & 0000 & 0000 & 0000 & \( 55 A A \) \\
\hline
\end{tabular}
How many partitions are on the device? Justify your answer.