Create a sparse FAT filesystem image named recovery. img using mkfs fat. You can choose the size of the filesystem as long as it is less than 2GB. Copy 3 files of your choice into the filesystem, e.g., by using mcopy or by mounting the filesystem and using cp. Note that the size of each file must be between 4KB and 6KB. Pick one of the files (say foo.jpg) and identify which byte offsets and which clusters are used to store it using mshowfat. The ranges that you give should be inclusive of the last byte/cluster. Record your answers in a file named recovery.txt with a table of this form: FILENAME: foo.jpg | byte offset range | cluster range 0x04200-0x047ff 0x06400-0x0651c 2-4 | 19-19 | Now find the part of the File Allocation Table that corresponds to your choice of file. Add a hexdump of the part of File Allocation Table you find to your file recovery.txt and annotate it to show the clusters. If you have a FAT12 filesystem, then it can look like the following example from lecture slides. If you have a FAT16 or FAT32 filesystem, then you will have to take 16 bits or 32 bits respectively at a time (see the Carrier book). 00000200: foff ff64 4000 0560 eoff 8f00 09a0 000b AA BABB CCDC DDEE FEFF GGHG HHII 00000210: c000 Ødeo 000f foff 1120 01ff ffff 1560 JIJJ KKLK LLMM NMNN OOPO PPQQ RQRR SSTS 00000220: 0117 8001 19a0 011b c001 1de0 01ff 0f02 TTUU VUVV WWXW XXYY ZYZZ aaba bbcc dcdd 00000230: 2120 02ff 4f02 25f0 ff27 8002 29a0 022b eefe ffgg hghh iiji jjkk 1k11 mmnm nnoo 00000240: c002 2de0 022f 0003 3120 0333 4003 3560 popp qqrq rrss tstt uuvu vvWW xwxx yyzy AAA=064, BBB=004, CCC=005, DDD=006, EEE=fff, FFF=008, GGG=009, HHH=00a, III=00b, JJJ=00c, KKK=00d, LLL=00e, MMM-00f, NNN=fff, 000=011, PPP=012, QQQ=fff, RRR=fff, SSS=015, TTT=016, UUU=017, VVV=018, WWW-019, XXX=01a, YYY=01b, ZZZ=01c, aaa=01d, bbb-01e, ccc=fff, ddd=020, eee=021, fff=022, ggg=fff, hhh-024, iii-025, jjj=fff, kkk=027, 111=028, mmm-029, nnn-02a, ooo=02b, ppp=02c, qqq=02d, rrr=02e, sss=02f, ttt=030, uuu=031, vvv=032, Next, delete your file from the filesystem stored in recovery. img, e.g., by mounting and using rm or by using mdel. Then use £ls on the filesytem image to see the deleted file entry (with a *). Finally, read about the icat command in the Carrier textbook and then use it to recover your deleted file from recovery.img. Add the icat command you used to your recovery.txt file. It is part of the assignment to figure out how to create the filesystem image and complete the other steps, but you can adapt the ideas, commands, and scripts shown in lecture slides/videos. Your recovery.txt file should end up looking something like this: FILENAME: foo.jpg byte offset range | cluster range 0x04200-0x047ff 0x06400-0x0651c 2-4 | 19-19 | 00000200: foff ff64 4000 0560 0eff 8f00 09a0 000b AA BABB CCDC DDEE FEFF GGHG HHII 00000210: c000 0de0 000f foff 1120 01ff ffff 1560 JIJJ KKLK LLMM NMNN OOPO PPQQ RQRR SSTS 00000220: 0117 8001 19a0 011b c001 1de0 01ff 0f02 TTUU VUVV WWXW XXYY ZYZZ aaba bbcc dcdd 00000230: 2120 02ff 4f02 25f0 ff27 8002 29a0 022b eefe ffgg hghh iiji jjkk 1k11 mmnm nnoo 00000240: c002 2de0 022f 0003 3120 0333 4003 3560 popp qqrq rrss tstt uuvu vvww xwxx yyzy AAA=064, BBB=004, CCC-005, DDD-006, EEE=fff, FFF=008, GGG=009, HHH=00a, III=00b, JJJ-00c, KKK=00d, LLL=00e, MMM=00f, NNN=fff, 000=011, PPP-012, QQQ=fff, RRR=fff, SSS=015, TTT-016, UUU=017, WVV-018, WWW-019, XXX=01a, YYY=01b, ZZZ=01c, aaa-01d, bbb-01e, ccc=fff, ddd=020, eee=021, fff=022, ggg=fff, hhh=024, iii-025, jjj=fff, kkk=027, 111=028, mmm-029, nnn=02a, ooo=02b, ppp=02c, qqq=02d, rrr=02e, sss-02f, ttt-030, uuu=031, vvv-032,

Create a sparse FAT filesystem image named recovery. img using mkfs fat. You can choose the size of the filesystem as long as it is less than 2GB. Copy 3 files of your choice into the filesystem, e.g., by using mcopy or by mounting the filesystem and using cp. Note that the size of each file must be between 4KB and 6KB. Pick one of the files (say foo.jpg) and identify which byte offsets and which clusters are used to store it using mshowfat. The ranges that you give should be inclusive of the last byte/cluster. Record your answers in a file named recovery.txt with a table of this form: FILENAME: foo.jpg | byte offset range | cluster range 0x04200-0x047ff 0x06400-0x0651c 2-4 | 19-19 | Now find the part of the File Allocation Table that corresponds to your choice of file. Add a hexdump of the part of File Allocation Table you find to your file recovery.txt and annotate it to show the clusters. If you have a FAT12 filesystem, then it can look like the following example from lecture slides. If you have a FAT16 or FAT32 filesystem, then you will have to take 16 bits or 32 bits respectively at a time (see the Carrier book). 00000200: foff ff64 4000 0560 eoff 8f00 09a0 000b AA BABB CCDC DDEE FEFF GGHG HHII 00000210: c000 Ødeo 000f foff 1120 01ff ffff 1560 JIJJ KKLK LLMM NMNN OOPO PPQQ RQRR SSTS 00000220: 0117 8001 19a0 011b c001 1de0 01ff 0f02 TTUU VUVV WWXW XXYY ZYZZ aaba bbcc dcdd 00000230: 2120 02ff 4f02 25f0 ff27 8002 29a0 022b eefe ffgg hghh iiji jjkk 1k11 mmnm nnoo 00000240: c002 2de0 022f 0003 3120 0333 4003 3560 popp qqrq rrss tstt uuvu vvWW xwxx yyzy AAA=064, BBB=004, CCC=005, DDD=006, EEE=fff, FFF=008, GGG=009, HHH=00a, III=00b, JJJ=00c, KKK=00d, LLL=00e, MMM-00f, NNN=fff, 000=011, PPP=012, QQQ=fff, RRR=fff, SSS=015, TTT=016, UUU=017, VVV=018, WWW-019, XXX=01a, YYY=01b, ZZZ=01c, aaa=01d, bbb-01e, ccc=fff, ddd=020, eee=021, fff=022, ggg=fff, hhh-024, iii-025, jjj=fff, kkk=027, 111=028, mmm-029, nnn-02a, ooo=02b, ppp=02c, qqq=02d, rrr=02e, sss=02f, ttt=030, uuu=031, vvv=032, Next, delete your file from the filesystem stored in recovery. img, e.g., by mounting and using rm or by using mdel. Then use £ls on the filesytem image to see the deleted file entry (with a *). Finally, read about the icat command in the Carrier textbook and then use it to recover your deleted file from recovery.img. Add the icat command you used to your recovery.txt file. It is part of the assignment to figure out how to create the filesystem image and complete the other steps, but you can adapt the ideas, commands, and scripts shown in lecture slides/videos. Your recovery.txt file should end up looking something like this: FILENAME: foo.jpg byte offset range | cluster range 0x04200-0x047ff 0x06400-0x0651c 2-4 | 19-19 | 00000200: foff ff64 4000 0560 0eff 8f00 09a0 000b AA BABB CCDC DDEE FEFF GGHG HHII 00000210: c000 0de0 000f foff 1120 01ff ffff 1560 JIJJ KKLK LLMM NMNN OOPO PPQQ RQRR SSTS 00000220: 0117 8001 19a0 011b c001 1de0 01ff 0f02 TTUU VUVV WWXW XXYY ZYZZ aaba bbcc dcdd 00000230: 2120 02ff 4f02 25f0 ff27 8002 29a0 022b eefe ffgg hghh iiji jjkk 1k11 mmnm nnoo 00000240: c002 2de0 022f 0003 3120 0333 4003 3560 popp qqrq rrss tstt uuvu vvww xwxx yyzy AAA=064, BBB=004, CCC-005, DDD-006, EEE=fff, FFF=008, GGG=009, HHH=00a, III=00b, JJJ-00c, KKK=00d, LLL=00e, MMM=00f, NNN=fff, 000=011, PPP-012, QQQ=fff, RRR=fff, SSS=015, TTT-016, UUU=017, WVV-018, WWW-019, XXX=01a, YYY=01b, ZZZ=01c, aaa-01d, bbb-01e, ccc=fff, ddd=020, eee=021, fff=022, ggg=fff, hhh=024, iii-025, jjj=fff, kkk=027, 111=028, mmm-029, nnn=02a, ooo=02b, ppp=02c, qqq=02d, rrr=02e, sss-02f, ttt-030, uuu=031, vvv-032,