HW 01 Computer Foundations
Purpose: The purpose of this assignment is to solidify your understanding of topics covered in chapter 2. Such understanding is gained through practice.
Instructions: Answer all questions. Make sure you show your work on #1. Answer #4 in the table format provided. Submit your assignment through Blackboard – Assignments.
Manually perform the following numbering system conversions. Convert each number using the approach shown in the Carrier textbook, Figures 2.2-2.3. This will require a TWO-STEP conversion in some cases. Do NOT use the binary, decimal, hex conversion table in Table 2.1. Show your work (equation and/or table as shown in Figures 2.2 and 2.3). You can certainly check your work using a calculator, but to receive credit, you must show your manual calculation work. NOTE: Endian ordering is not relevant here. Presume the multi-byte data structure in 1d has already been ‘flipped’ as needed.
Convert 10011011 to a hexadecimal number.
Convert 01010101 to a hexadecimal number.
Convert x4B to a decimal number.
Convert xCDEF to a decimal number.
Convert x0E to a binary number.
Convert xFF to a binary number.
Briefly explain why the maximum number you can represent with a given number of binary bits differs from the “maximum count.” Use an example to support your explanation.
Answer 3a-3f based on the following hex dump, which is the start of a master boot record (MBR) (known as the $Boot file in an NTFS volume). You will need to use Table 13.18 in your textbook.
a. What is the OEM name for this volume?
b. How many bytes per sector, as established during low-level formatting, in this system? Give your answer in DECIMAL AND HEXADECIMAL. This is a little-endian, WORD length data structure.
c. How many sectors per cluster, as established during high-level formatting, in this system? Give your answer in DECIMAL AND HEXADECIMAL.
d. Does endian ordering matter in item 3c above? Why, or why not?
e. What is the “Total sectors in file system” number? Give your answer in DECIMAL AND HEXADECIMAL. This is a little-endian, QWORD length data structure beginning at offset 40.
For item 4 below, do the following:
Download, unzip and run the DCode utility that converts hex strings to logical date/time stamps considering the appropriate epoch, endian ordering, etc. You should be able to download it here: http://www.digital-detective.co.uk/freetools/decode.asp
All you have to do to use it is enter the data string in hex in the ‘value to decode’ box, indicate the appropriate ‘decode format,’ and click decode.
Selecting a ‘little endian’ decode format will cause the DCode utility to automatically ‘flip’ the bytes in the time stamp data structure for you upon converting the time stamp.
Endian Ordering & Date/Time Stamps: The figure below contains part of an NTFS MFT entry for a file. Four 64-bit (QWORD) Windows date/time stamps are located at absolute offsets 344134736-344134767. The first 64bit time stamp is the file creation date/time. The second 64-bit time stamp is the file last written date/time. The third 64-bit time stamp is the last modified time stamp for that file’s MFT entry (has nothing to do with the file’s content). The fourth 64-bit time stamp is the file last accessed time stamp. Given this, given what you now know about endian ordering and numbering systems, and with the assistance of the DCode utility, reproduce and complete the table following the figure.
Created Date/Time
Last Written Date/Time
Last Accessed Date/Time
Decimal offset location (starting offset address)
Hex string as stored on-disk (what you see in the hex editor)
Hex number (Number of 100 nanoseconds increments since Windows Epoch)
Decimal number (Number of 100 nanoseconds increments since Windows Epoch)
Date/Time with DCode format being “Windows: 64 bit Hex Value–Little Endian”
Date/Time with DCode format being “Windows: 64 bit Hex Value – Big Endian,”
1
The post HW 01 Computer Foundations Purpose: The purpose of this assignment is to appeared first on PapersSpot.
