Chapter 1 — Exercises

These problems move from definitions to judgment to hands-on work. Some need only a pen; several put your hands on a hex viewer, a hashing tool, and a file listing — the same perceptions Chapters 2–7 will automate millions of times. (answer in Appendix) marks problems with a worked solution in Answers to Selected Exercises; ⭐ marks a stretch problem that reaches past this chapter. You will not have a real forensic image yet, so the labs use files already on your own computer and tiny data you can create in a minute — no lab kit, no special hardware, nothing that risks any data of yours.

Group A — The two definitions

Begin with the bedrock. If you cannot define the two disciplines crisply, nothing downstream will hold. Answer these in full sentences, the way you would explain them to a nervous client or a new colleague on their first day.

1.1 In one sentence each, define data recovery and digital forensics. Then underline the single word or phrase in each definition that most sharply distinguishes it from the other. (answer in Appendix)

1.2 The chapter gives data recovery the phrase "on behalf of the owner" and digital forensics the phrase "for a legal or official process." In 3–4 sentences, explain how those two phrases — not any of the technical steps — are what truly separate the disciplines. Why does the chapter call the owner's consent "the quiet center" of recovery's definition?

1.3 List the four verbs that make up the working definition of digital forensics. For each, write one sentence describing exactly what a forensic examiner is doing during that phase, and name the one phase that "has no equivalent in casual computing." (answer in Appendix)

1.4 The chapter says success in recovery is measured by "what the owner can use afterward," while success in forensics is measured by whether findings are "documented, defensible, and admissible." Pick a single deleted spreadsheet and describe what "success" looks like for each discipline when that one file is the deliverable. Notice how the same recovered bytes produce two different definitions of done.

1.5 ⭐ The chapter claims forensics "serves a process," not a person, and that the device's owner is "often the very person under investigation." Construct a short, concrete scenario in which the owner of a device actively wants the examination to fail, and explain why this situation is normal — even routine — rather than exceptional. Then explain what this fact implies about why the examiner cannot simply trust the owner's account.

Group B — Overlap and divergence

The book's central claim is that the two disciplines are "roughly seventy percent shared." These problems test whether you can locate the seam — the line where shared technique gives way to divergent purpose. The number itself is a teaching heuristic, not a measurement; the skill these problems build is being able to point at any given task and say this part serves both, and this part is unique to one.

1.6 Name five specific bodies of knowledge that sit in the shared technical core, and for each, give a one-line reason it serves both restoration and proof. (Hint: the chapter's center diagram lists them.) (answer in Appendix)

1.7 The divergence runs along three axes: purpose, methodology, and legal framework. Reproduce this table from memory, then check it against the chapter and correct anything you missed:

1.8 "Good enough is frequently a complete success" is true for recovery and dangerous for forensics. Explain in a short paragraph why the same sentence flips from virtue to vice the moment you cross from one discipline to the other. What, specifically, does the fast "good enough" path quietly sacrifice — name at least three things (a timestamp, a hash that proves faithfulness, a piece of unallocated context) — that recovery does not need but forensics cannot live without? Then give one example of a recovery shortcut that would be perfectly professional on the wedding-photo job and disqualifying on the engineer job.

1.9 ⭐ Recovery "may repair or read the original in place when forced"; forensics says "image always, never alter the original." These sound contradictory. Reconcile them. Under what narrow, specific circumstance does recovery touch the original, why is it justified there, and why would the identical act be malpractice in a forensic matter? Frame your answer around the principle the original is sacred and explain why both disciplines obey it from opposite motives.

Group C — Which discipline am I on?

This is the chapter's first professional skill, made into drills. For each scenario, decide whether the job is primarily recovery, primarily forensics, or a job that should be treated with forensic rigor because it could become forensic. State the single question you would ask the caller first, and justify your call in two sentences. Resist the urge to answer from the technique ("I'd carve the files") — answer from the purpose and audience ("this serves an owner who consented" vs. "this may serve a court that will judge my method"). The technique is often identical; the discipline is decided by who the work is for and what could become of it.

1.10 A grandfather calls: he dropped his camera's SD card in a gravel driveway, backed over it, and wants the only photographs of his late wife's last birthday. There is no dispute, no lawsuit, no employer — just a man and a cracked card. (answer in Appendix)

1.11 An HR director calls: an employee will be terminated for cause on Friday, and she wants "everything off his laptop" beforehand to see what he has been doing. She mentions, almost in passing, that the employee has hinted he might "lawyer up." Pay attention to that passing detail — it should change your answer, and your first question to her should be aimed at it.

1.12 A solo attorney calls: opposing counsel produced a USB drive in discovery, and she wants to know whether the files on it were really created on the dates the metadata claims, or backdated.

1.13 A friend calls in a panic: his small business was hit by ransomware overnight, the file server is encrypted, the ransom note demands payment in cryptocurrency, and he must be operating again by Monday or he misses payroll. Decide the discipline, then add a wrinkle: name one reason this job carries both a recovery urgency and a potential forensic obligation, and which you would address first without sacrificing the other. (answer in Appendix)

1.14 ⭐ A new walk-in client drops a laptop on your counter and asks you to recover deleted files "from the last few weeks." Nothing about the request sounds legal — no lawyers, no employer, no dispute mentioned. Using the chapter's war story, explain what you would do differently from a pure, fast recovery anyway, and articulate why "preserve optionality" is the safe default even when the client swears it's nothing. What single thing can you never add to your work after the fact, and how does that asymmetry — rigor can be added now but never retroactively — drive the entire decision? Finally, name the modest extra cost the rigor imposes and argue whether it is worth paying on every job or only some.

Group D — Hands-on: signatures, hex, and hashing

These labs use files already on your computer and a free hex viewer — HxD on Windows, or xxd file | less on Linux/macOS. Nothing here writes to or risks any of your data; you are only reading and hashing. The point is to make the foundation tactile: file signatures and hashes are not abstractions you will trust on faith, they are things you can see and verify with your own eyes today, before you own a single forensic tool.

1.15 Open any .jpg on your computer in a hex viewer. Record the first four bytes and the last two bytes, with the offset at which each appears. Confirm the header begins FF D8 FF and the file ends FF D9. You have just verified a file signature by hand — the exact perception that file carving automates. (answer in Appendix)

1.16 Repeat the inspection on a .png and a .pdf. Look up their signatures in Appendix A — File Signatures Reference and confirm what you see (a PNG begins 89 50 4E 47 0D 0A 1A 0A; a PDF begins 25 50 44 46 2D, which is the ASCII %PDF-). Now read the hex dump below, taken from the start of a recovered fragment, and identify the file type from its first bytes alone:

Offset       00 01 02 03 04 05 06 07  08 09 0A 0B 0C 0D 0E 0F   ASCII
0x00000000   89 50 4E 47 0D 0A 1A 0A  00 00 00 0D 49 48 44 52   .PNG........IHDR
0x00000010   00 00 04 00 00 00 03 00  08 06 00 00 00 5A 1C ...   .............Z..

(a) What kind of file is this, and which bytes prove it? (b) In one sentence, explain why a carving tool can find this file even when the file system that once indexed it is completely gone. (c) What would you expect to see in the bytes at the end of this file, and why does a carver need both ends?

1.17 Prove the avalanche effect to yourself. Create a one-line text file containing the quick brown fox. Compute its SHA-256. Now change exactly one character — make it the quick brown fix — and compute the SHA-256 again. Compare the two values and describe, in one sentence, roughly how much of the 64-character output changed and why that property is precisely what makes a hash useful for proving that nothing changed. (answer in Appendix)

1.18 Make a copy of any file. Hash the original and the copy with sha256sum (Linux/macOS) or Get-FileHash -Algorithm SHA256 (PowerShell). Confirm the two values are byte-for-byte identical. You should see something like this:

$ sha256sum report.pdf report_copy.pdf
4f8e2a1c... (64 hex chars) ...b3d9   report.pdf
4f8e2a1c... (64 hex chars) ...b3d9   report_copy.pdf
#  ^ identical -> the copy is a faithful, bit-for-bit duplicate

Then write two sentences: one stating what that match does prove about the copy, and one stating what it does not prove about the original (in particular, whether the match says anything about the state of the original before you hashed it).

1.19 ⭐ The chapter calls MD5 "cryptographically broken" yet notes examiners still record it alongside SHA-256. Compute both the MD5 and the SHA-256 of the same file (md5sum/Get-FileHash -Algorithm MD5). Then argue, in a short paragraph, whether recording a known-broken hash beside a strong one is sloppy or sensible. Be precise about what MD5 collisions do threaten (an adversary who controls both files) and what they do not threaten (verifying that a copy you made matches a source you did not craft).

Group E — Reading the evidence

You cannot defend a finding you cannot derive by hand. These problems make you do the arithmetic and read the listings the tools produce — because on the witness stand, "the software said so" is not an answer, and on a recovery bench, a tool that gives the wrong offset will quietly hand you the wrong bytes. The math here is simple (sector × size = byte offset); the discipline is in always doing it.

1.20 A drive with 512-byte sectors has its first partition beginning at logical block address (LBA) 2,048. Compute the byte offset where that partition starts, and show the arithmetic. Then state where in the chapter this exact number appears and what it conventionally represents. (answer in Appendix)

1.21 A file's data begins at LBA 1,000,000 on a 512-byte-sector disk. (a) At what byte offset would you seek in a raw image to reach its first byte? (b) If the identical disk used 4,096-byte ("4Kn") sectors instead, what would the offset be? Show both calculations. (answer in Appendix)

1.22 Read this Sleuth Kit listing and answer the questions beneath it:

$ fls -r -o 2048 case_drive.dd
r/r 4123-128-1:    Users/sam/Documents/budget.xlsx
r/r * 4124-128-4:  Users/sam/Documents/offer_letter.pdf
r/r * 4125-128-4:  Users/sam/Pictures/site_plan.jpg
d/d 4130-144-1:    Users/sam/Desktop

(a) Which entries are deleted, and what single character told you? (b) For a deleted entry, what three things does the chapter say the file system still knows about the file? (c) Why are the bytes of site_plan.jpg "very probably still on the platter," and what one event would change that answer? (answer in Appendix)

1.23 Using the listing in 1.22, describe how a 💾 recovery engineer and a 🔍 forensic examiner would each treat site_plan.jpg. Your answer should name at least four things the examiner records that the recovery engineer does not bother with (think: source device, partition offset, MFT/inode entry, cluster run, tool and version, date, custody), and explain why the bytes are identical but the handling is not. Then answer the deeper question: at what moment, and for what reason, might the recovery engineer's job suddenly require the examiner's discipline — and what would the engineer wish, at that moment, that they had done from the first minute?

1.24 ⭐ A laptop's offer_letter.pdf shows a "date modified" of three years ago in the Windows file-properties dialog, but you have reason to believe it was actually written last week. An examiner pulls both sets of NTFS timestamps and sees this:

File: offer_letter.pdf
  $STANDARD_INFORMATION  Created: 2022-03-14   Modified: 2022-03-14   (shown in Properties)
  $FILE_NAME             Created: 2025-06-19   Modified: 2025-06-19   (kept by the file system)

Name the two parallel sets of NTFS timestamps in play, say which set the properties dialog displays, which set is far harder to forge through ordinary tools, and explain precisely how the disagreement above becomes evidence of timestomping rather than evidence the file is genuinely three years old. (Introduced here; developed fully in Chapter 21 — Timeline Analysis.)

Group F — Principles, limits, and ethics

The six principles are the chapter's conscience. These problems test whether you have internalized them — including the hardest one, which is knowing when to stop. A practitioner who can recite the six but cannot apply them under a desperate client's pressure has memorized nothing that matters; these problems put them under pressure.

1.25 State all six recurring principles in your own words. Then mark the two the chapter says you will use "literally every working day," and explain in two sentences why those two in particular form the load-bearing pair. (answer in Appendix)

1.26 For each item, say whether the data is likely recoverable, likely unrecoverable, or it depends — and on what it depends: (a) a file deleted from a hard drive's Recycle Bin an hour ago; (b) a file deleted 30 seconds ago from a TRIM-enabled SSD; (c) a quick-formatted hard-drive volume; (d) a hard drive overwritten end to end with zeros; (e) a correctly configured BitLocker volume whose passphrase nobody knows. (answer in Appendix)

1.27 "The evidence is insufficient to support a conclusion" and "the data is unrecoverable" are described as valid, valuable, professional findings. Explain why offering such a finding is sometimes more professional than producing an answer, and name one specific pressure — from a desperate client or from a prosecutor who wants more — that pushes practitioners to overstate their certainty anyway. Then rewrite this over-claim into a defensible form: "The timestamps prove the suspect opened the file on March 3rd." (Consider who was logged in, what a timestamp actually records, and the gap between what a device did and what a person did.)

1.28 ⭐ The Ethics Note warns that you will one day encounter data you wish you had never seen. Without describing any content, write a short personal policy (4–6 bullet points) for the moment you stumble onto something disturbing or clearly outside your authorized scope: what you will do first, what you will not do, who you will and will not tell, how you will document it, and how you will look after your own well-being. (Ethics are owned by Chapter 28 — Ethics; mandatory reporting and examiner trauma are real obligations, not afterthoughts.)

Group G — Progressive project: start your Forensic Case File

Chapter 1's job in the running project is simple but non-negotiable: create the case file. These tasks build the deliverable you will carry, one skill and one evidence type at a time, all the way to the capstone in Chapter 38.

1.29 Create your project folder (physical or digital) and write the case-intake page. Because you do not have a real case yet, write it for your own learning goal: name your target path (💾 Data Recovery, 🔍 Forensic Examiner, 🛡️ Incident Response, or 📜 Legal/eDiscovery), state the discipline(s) it lives in, name the one capability you want to have by Chapter 40, and answer the four intake questions every real case opens with — Which discipline is this? Who is the client/authority, and what authorizes the work? What is the question I must answer? What is the deliverable? Keep this page; in Chapter 38 you will write a real one for the capstone case, and comparing the two will show you how far you have come.

1.30 Start your personal glossary with the terms this chapter introduced — forensic image, chain of custody, file signature, hash, unallocated space, write blocker, deleted ≠ destroyed — defining each in your own words rather than copying. You will add to this page every chapter; building it in parallel with the book's full glossary is how the vocabulary becomes yours.

1.31 Create a blank chain-of-custody log and a contemporaneous notes page from the templates in Appendix F. Do not fill them in yet — just create them, so the reflex that they come first, before any analysis, is built into your workflow before you ever touch evidence.

1.32 ⭐ Write your own "which discipline am I on?" checklist — the 4–6 questions you will ask at the start of every future job to decide how much rigor it demands. Then test it: run scenarios 1.10–1.13 through your checklist and confirm it produces the same calls you made in Group C. If it disagrees with your earlier judgment, decide which one was right and fix the other.

Self-check. You have mastered Chapter 1 when you can: state both definitions without hesitating; sort any incoming job into recovery, forensics, or "treat it as forensic" and say why in a sentence; recognize a JPEG by its bytes and read a deleted-file listing by eye; explain what a hash match does and does not prove; and name the moment a routine recovery quietly becomes evidence. If any of those still feel shaky, reread the relevant section before moving on — every later chapter assumes this foundation is solid. Next, Chapter 2 — How Data Is Stored turns "deleted is not destroyed" from a slogan into something you can locate at a precise byte offset and prove.