Chapter 2 — Exercises

Thirty problems in seven groups (A–G), mixing concept checks, by-hand conversions, offset arithmetic, judgment calls, and hands-on labs ("read this dump," "recover from this image," "calculate and verify the hash," "write the report"). Work the arithmetic on paper before you reach for a tool — the muscle memory you build here is used in every later chapter, from acquisition to testimony. (answer in Appendix) marks problems with a full worked solution in Answers to Selected Exercises. ⭐ marks a stretch problem that pushes past the chapter. Keep your written work; several problems feed directly into your Forensic Case File.

Groups A–C build raw literacy (binary/hex/ASCII, dumps and signatures, endianness); Group D grounds it in the physics of the two media; Group E is the offset arithmetic you must own cold; Group F is the heart of the chapter (slack and "deleted ≠ destroyed"); and Group G puts a tool in your hands. If you can only do part of this set, do all of Group E and all of Group G — the calculation and the labs are where the chapter becomes a skill rather than a fact.

Group A — Binary, hexadecimal, and ASCII fluency

2.1 Take the byte 0110 0001. Work the full round trip: (a) split it into two nibbles; (b) convert each nibble to a single hex digit; (c) write the whole byte in 0x notation; (d) convert it to decimal, showing the place-value sum; and (e) name the ASCII character it represents. This binary → hex → decimal → character cycle is the single most basic skill in the chapter, and you must be able to run it without a tool. (answer in Appendix)

2.2 Answer each in one or two sentences. (a) How many distinct values can a single byte hold, and a single nibble? (b) Why is the largest value a byte can represent 255 and not 256 — what does the difference between "count of values" and "largest value" come down to? (c) Drive and network speeds are usually quoted in megabits per second (Mbps, lowercase b) while sizes are in megabytes (MB, uppercase B). Roughly how many megabytes per second does a 100 Mbps link move, and why is getting this wrong an error of a factor of eight?

2.3 ⭐ In the chapter, the byte 0x4D appears wearing several different "costumes." (a) List every interpretation the chapter gives that one byte. (b) State, in your own words, the deeper principle the example teaches. (c) Explain what professional habit "a byte has no intrinsic meaning" forces on you every time you make a claim about evidence — i.e., what you must always document alongside any value you report.

2.4 Convert 0x1F4 to decimal, showing the place-value arithmetic (powers of 16: 256, 16, 1). Then convert the decimal number 500 back to hexadecimal, showing the division/remainder work. The two answers must agree, and you should be able to do both directions cold. (answer in Appendix)

2.5 Without a tool, give the decimal value and ASCII character for each byte: 0x41, 0x61, 0x30, 0x20, 0x21, 0x7E. Then (a) state the constant numeric offset between any uppercase letter and its lowercase twin and explain why it exists; (b) state the contiguous hex range of printable ASCII and explain why a hex dump prints . for anything outside it; and (c) explain why the character '7' (the byte 0x37) is not the same as the number seven (the byte 0x07) — a confusion that has crashed parsers since the 1960s.

Group B — Reading hex dumps and recognizing signatures

2.6 Decode the ASCII column of each dump line by hand (use the landmark ASCII values from the chapter), and state what each line spells:

(a)  00000000  44 61 74 61 46 69 65 6c  64 00 00 00              ............
(b)  00000000  46 6f 72 65 6e 73 69 63  73 21 00 00              ............

Then explain why the tool printed . for the trailing 00 bytes rather than a character, and what kind of byte 0x00 is.

2.7 (a) Match each signature to the file type it identifies: FF D8 FF, 50 4B 03 04, 25 50 44 46, 4D 5A. (b) For the JPEG, also give the two-byte footer a carver reads forward to. (c) For 4D 5A, name the person whose initials those bytes are and the kind of file they sit at the front of. (d) The Windows string SMITH stored as UTF-16 appears in a raw dump as 53 00 4D 00 49 00 54 00 48 00 — explain the interleaved 00 bytes and why you should read them as "Windows/UTF-16 string," not "corruption."

2.8 ⭐ A file arrives named quarterly_report.pdf. You dump its first bytes and see 50 4B 03 04. (a) State what the file actually is and how you know. (b) Give two innocent explanations and one suspicious explanation for the name/byte mismatch. (c) Which principle of the chapter governs your conclusion, and which later chapter builds an entire technique on "trust the bytes, not the name"?

2.9 (Lab — read this dump.) Using xxd, HxD, or PowerShell's Format-Hex, dump the first 16 bytes of three files of different types on your own machine — a .jpg, a .pdf, and a .zip or .docx. (a) Record each signature you see. (b) Confirm all three against Appendix A — File Signatures Reference. (c) For the JPEG, note whether the bytes after FF D8 FF spell JFIF or Exif in the ASCII column, and look up what that distinction tells you. Keep the output — it is the first page of your case file's technical notes.

Group C — Endianness and multi-byte fields

2.10 A 32-bit (4-byte) field on disk reads E8 03 00 00. It is an NTFS field, and NTFS stores its multi-byte values little-endian. (a) What integer does the field hold? (b) If you mistakenly read those same four bytes as big-endian, what (wildly different) value would you compute? (c) State the one-sentence lesson about why a parsed value that "looks absurd" is itself a diagnostic clue. (answer in Appendix)

2.11 Inside a JPEG you find a segment-length field reading 00 43, and JPEG's internal fields are specified big-endian. (a) What length does it encode in decimal? (b) Explain why the "NTFS is little-endian" rule from 2.10 does not apply here. (c) Name one more class of data that is conventionally big-endian regardless of the machine it lives on. (d) Within a single forensic image of a Windows drive, you may parse an NTFS structure (little-endian) describing a JPEG (big-endian internals) that was transferred over a network (big-endian). In one sentence, state the only reliable way to know which byte order applies to any given field you are reading.

2.12 ⭐ You parse what you believe is an 8-byte little-endian file-size field in a file-system structure, and your script reports a file of roughly 16 exabytes — physically impossible. (a) List the two most likely causes, one about byte order and one about where you placed the field boundary. (b) Describe how you would test which one bit you. (c) Explain why "this number is absurd" is a more reliable first alarm than trusting the parser's output.

Group D — The physical layer: HDD and SSD

2.13 In one or two sentences each: (a) how does a hard disk drive store a single bit, and (b) how does a solid-state drive store a single bit? Name the physical phenomenon in each case (magnetic orientation vs. trapped charge). (c) For both media, does reading a bit disturb it, and why does the answer matter to a forensic examiner who must read evidence without altering it? (d) Both media retain data with the power off — but one of them can slowly lose data over years of unpowered storage. Which one, and what physical process causes the loss?

2.14 Explain the "critical asymmetry" of NAND flash. (a) Name the smallest unit that can be read or written (programmed) and the smallest unit that can be erased. (b) Explain why a page that already holds data cannot simply be overwritten in place. (c) Name the three firmware mechanisms — by name — that exist to cope with this asymmetry, and state in one phrase what each does. (d) Consider a block of 128 pages where the operating system wants to change the contents of just one page that already holds data. Walk through, in plain language, what the controller must actually do to honor that one small change — and explain why this "read-modify-erase-rewrite" dance is why an SSD relocates data constantly and why deleted data does not stay put the way it does on a platter.

2.15 A QLC cell stores four times as much data as an SLC cell, yet wears out faster and reads more slowly. Explain why, tying your answer explicitly to the "noise immunity" argument from the top of the chapter — that distinguishing more charge levels per cell makes each level harder to tell apart. Why is this a direct restatement of the same physics that made two-state storage attractive in the first place? (answer in Appendix)

2.16 ⭐ (Judgment.) A client says, "I deleted some files from my laptop about 36 hours ago — can you get them back?" (a) Before asking which files, what is the one diagnostic question you must ask about the medium? (b) Explain how the answer can swing your estimate from "almost certainly recoverable" to "possibly nothing left," referencing TRIM and the HDD/SSD difference. (c) Why is it unprofessional to quote a price or a confidence level before you have that answer? (d) Two clients describe the identical action — "I emptied the Recycle Bin two days ago" — but one has a 2015 desktop with a spinning disk and the other a current ultrabook with an NVMe SSD. Without examining either machine, state which one you are more optimistic about and articulate, in one sentence each, the physical reason for the difference.

Group E — Sectors, clusters, and the offset arithmetic

2.17 A partition begins at LBA 2048 on a drive with 512-byte logical sectors. (a) Compute the byte offset where it starts, using byte offset = sector × sector size. (b) Express the result in decimal, in hexadecimal, and in MiB. (c) Explain in one sentence why modern partitioning tools deliberately start partitions at this offset rather than at sector 1. (answer in Appendix)

2.18 A file-carving tool reports a JPEG header at byte offset 3,221,225,472. (a) On a 512n drive, what sector number contains that offset? (b) On the same image analyzed at a 4 KB (4,096-byte) cluster size, what cluster number? Show byte offset ÷ size for each, and verify each answer by multiplying back to confirm you land exactly on the original offset. (c) The offset happens to be 0xC0000000 and exactly 3 GiB — confirm both of those facts, and note why "round" offsets like this are convenient checkpoints when you navigate an image by hand.

2.19 You assumed a drive was 512n and did all your offset math on that basis, but the drive is actually 4Kn. A field your notes record as "sector 786,432": (a) recompute the byte offset that sector actually begins at on the real 4Kn drive; (b) compare it to the offset you would have computed assuming 512-byte sectors; (c) state the general rule about confirming logical sector size before any calculation, and where in your workflow you record it.

2.20 ⭐ A drive's imaging tool reports 1,953,525,168 logical sectors at 512 bytes each. (a) Compute the total capacity in bytes. (b) Express it both in decimal "marketing" gigabytes (÷ 10⁹) and binary gibibytes (÷ 2³⁰). (c) Explain why a drive a store sells as "1 TB" appears in the operating system as roughly 931 GiB. (This is the exact sector count of a standard 1 TB drive — a number worth recognizing on sight.)

Group F — Slack space and "deleted ≠ destroyed"

2.21 A 1,500-byte file is written into a single 4,096-byte cluster made of eight 512-byte sectors. (a) Compute the RAM slack (bytes from the end of the file's data to the end of the sector it ends in). (b) Compute the drive slack (the remaining full sectors of the cluster). (c) Confirm that RAM slack + drive slack equals total slack, and that total slack equals cluster size − file size. (d) Now redo the total-slack figure for a 9,000-byte file on the same volume — how many clusters does it occupy, and how much slack results? (answer in Appendix)

2.22 In your own words, explain why drive slack so often contains fragments of a previously deleted file. (a) What does the operating system do — and crucially, not do — to that space when it writes the current file into the cluster? (b) Why is this "forensic treasure"? (c) Modern Windows zeros RAM slack but leaves drive slack alone; what historical information-disclosure bug gave "RAM slack" its name? (d) Suppose a 200-byte text note is written into a cluster that previously held part of a deleted 50 KB image. Sketch what a keyword or signature search of that single cluster might turn up that has nothing to do with the 200-byte note, and explain why an examiner who reports only the note's logical contents has missed evidence.

2.23 State exactly what changes on disk when a file is deleted, for each file system: (a) on FAT/exFAT, name the specific byte value written into the first character of the directory entry, and what happens to the cluster-chain entries; (b) on NTFS, name the specific flag, the bit, and the byte offset within the MFT record header, and what happens in $Bitmap. (c) In both cases, what is conspicuously left untouched — and what recovery method does each leave the door open to? (d) On a FAT volume, a directory entry that once read wedding.jpg now reads ?edding.jpg in a hex editor, with one specific byte standing where the w was. Write that byte's hex value, and explain why recovering the original filename means guessing a single character.

2.24 ⭐ (Judgment / ethics.) While searching the slack space of an authorized examination, you encounter material clearly outside the scope of your warrant or engagement — it concerns a different person and a different matter entirely. (a) Describe what you should and should not do. (b) Name the principle from this chapter and the two later chapters that govern incidental, out-of-scope finds. (c) Explain why "I found it while doing authorized work, so I can act on it" does not follow, and what step you take instead. (d) Why is slack space especially likely to surface out-of-scope material, given what it physically is? Tie your answer to the fact that slack is residue from earlier, unrelated files that have nothing to do with the file you are nominally examining.

Group G — Hands-on labs and the Progressive Project

2.25 (Lab — recover from this image.) Using a practice disk image (see Appendix J — Practice Images and Lab Setup) opened read-only in a hex editor: (a) seek into unallocated space and locate a JPEG header FF D8 FF; (b) record the exact byte offset and convert it to a sector number; (c) describe, step by step, how you would carve the file — where you start, what footer (FF D9) you read forward to, and what you write out; (d) state explicitly why carving still works even when the file system's index has been destroyed. As a sanity check before you carve, confirm that the bytes at offset +6 from the header spell JFIF (4A 46 49 46) or Exif — if neither appears, you may be looking at a coincidental FF D8 FF byte run rather than a real image, and you should note that ambiguity.

2.26 (Lab — calculate and verify the hash.) Image a small practice USB stick (or use a provided image). (a) Compute a SHA-256 hash of the image, then compute it a second time, and confirm the two values match exactly. (b) In two sentences, explain how this hash functions as a "tamper-evident seal." (c) Name the recurring theme of the book this practice enforces, and explain why a recovery shop — not just a forensic lab — benefits from it. (d) Now suppose you re-hash the image a week later and a single bit of it has changed; the two SHA-256 values will differ completely, not "by one character." Explain why even a one-bit change cascades into an entirely different hash, and what that property buys you in court. (Hashing is developed fully in Chapter 5 — The Forensic Process; here you are just proving the workflow.)

2.27 (Lab — the extension that lies; Progressive Project.) Copy your practice .jpg to a new file whose name ends in .txt. (a) Dump the first bytes of the copy and record the signature. (b) Confirm it is unchanged (FF D8 FF) despite the new name. (c) Write one sentence for your case file explaining why this matters to a forensic examiner, and name the later chapter (Chapter 7 — File Carving) built on the fact that identification trusts bytes, not names.

2.28 ⭐ (Lab — write the report.) You have carved a single JPEG whose FF D8 FF E0 header began at byte offset 3,221,225,472 (sector 6,291,456) of unallocated space on an imaged drive whose SHA-256 you recorded. (a) Write the weak, inadmissible version of the finding ("I found a JPEG on the drive"). (b) Rewrite it as a court-grade statement recording the offset, the sector, that the data was in unallocated (deleted) space, the working-copy/hash discipline, and enough detail that a second examiner could independently reproduce the find. (c) State what, specifically, makes the second version testimony rather than an assertion. (d) Mark, in your court-grade version, which single phrase you would most expect opposing counsel to challenge on cross-examination, and explain how the rest of your documentation defends it. (Templates: Appendix F — Chain of Custody and Report Templates.)

2.29 (Progressive Project — establish your byte-level baseline.) For the practice drive or image you will use throughout the book: (a) record its logical sector size and total sector count (your OS or imaging tool reports both); (b) compute its capacity with total sectors × sector size; (c) as a drill, compute the byte offset of sector 2048 and the sector number that contains byte offset 1,073,741,824 (1 GiB). Keep these results — they become the opening technical page of your Forensic Case File. (answer in Appendix)

2.30 ⭐ (Synthesis / judgment.) A potential client calls and asks you to promise, sight unseen, that "the photos are definitely recoverable." (a) Drawing on the chapter's Limitations section, list the four conditions under which the data may genuinely be gone (overwriting; TRIM + garbage collection; encryption without the key; physical destruction/degradation). (b) Write the honest, professional one-sentence answer you should give before examining the medium. (c) Explain how that answer protects both the client's expectations and your own reputation, tying it to the theme know your limitations. (d) For each of the four "data is gone" conditions, state in a few words whether it is, in principle, detectable before you commit to a recovery attempt — for instance, can you tell a volume is encrypted, or that a drive is a TRIM-enabled SSD, up front? Why does knowing which conditions are detectable in advance shape how you triage incoming work?

Self-check. You have mastered this chapter when you can read a hex dump's three columns at a glance, name a file from its first three bytes, convert fluidly among binary/hex/decimal/ASCII, compute a byte offset from a sector (and back) without hesitating over the sector size, calculate RAM and drive slack for any file-in-cluster, and — most importantly — explain and bound the principle that deletion removes the pointer, not the data. If the offset arithmetic in Group E still feels slow, drill 2.17–2.20 until it is automatic; everything from acquisition in Chapter 5 to testimony in Chapter 27 assumes it. Next, build out the machines themselves in Chapter 3 — Storage Technology.