Experiment x Description: FAT32-1.IMG is a disk image containing the FAT32 file system, please use Winhex to read out the specified file in this filesystem and answer its MD5 hash value.
Requirements:
1, using Winhex manual way to read.
2, do not use Winhex template function.
3. Do not use Winhex file system parsing function.
4, fill in the MD5 hash value is all uppercase, does not include 0x head or H-tail, the middle must not have any spacing symbols (including spaces, tabs, '-' and other symbols), the Winhex software to calculate the hash value is the subject.
Experimental Purpose:
1, realize the manual way to track a FAT32 file system, and read out a specified file.
2, understand the combination of multi-directory block mode.
3. Understand how multiple file fragments are handled.
4, understand the DBR, Fat table and other file system components.
5, skilled use of winhex
Item Bank
1, Experiment X, the MD5 hash value of \frombyte51\28.txt file is ___________?
2, Experiment X, the MD5 hash value of \frombyte55\8.txt file is ___________?
... ...
#!/bin/bashqemu-img create -f raw fat32-1.img 500mlosetup /dev/loop0 Fat32-1.imgparted -s /dev/loop0 mklabel msdosparted -s /dev/loop0 mkpart -s primary fat32 128s 100%mkfs.fat -f 32 -s 8 /dev/ Loop0p1mount /dev/loop0p1 /mntfor ((i=1;i<=100;i++));d o mkdir /mnt/"FROMBYTE" $i for ((ii=1;ii<10;ii++));d o r2=$ (($RANDOM % 32 + 512)) #create file r3=$ (($RANDOM % 32) for ((iii=1;iii< $r 2;iii++));d o if [ $r 3 -eq $III ] ;then # random write " Copy right " echo -n " *****copy right: " >>/mnt/"Frombyte" $i/$ii. txt r3=$ (($RANDOM % 32 + $r 3)) else echo -n "Www.frombyte.com" >>/mnt/"Frombyte" $i/$ii. Txt fi done donedonefor ((i=1;i<=100;i++));d o for ((ii=1;ii<10;ii++));d o r2=$ (($RANDOM % 512 + 512)) #add padding r3=$ (($RANDOM % 32)) for ((iii=1;iii< $r 2;iii++));d o if [ $r 3 -eq $III ] ;then # random write "Copy right" echo -n "*****copy right:" >>/mnt/"Frombyte" $i/$ii .txt r3=$ (($RANDom % 32 + $r 3)) else echo -n "www.frombyte.com" >>/mnt/"Frombyte" $i/$ii .txt fi done donedonefor ((i=50;i<=100;i++));d o md5sum /mnt/"Frombyte" $i/* |tr a-z a-z >>~/fat32-1/ Fat32-1.md5donecdumount /dev/loop0p1losetup -d /dev/loop0
Total process:
1. Generate MD5 collection FAT32-1.MD5,FAT32-1.IMG image as above script
2, through FAT32-1.MD5, generate a question bank. Methods are:
A, using Excel edit replace the way to generate
B, Linux under the use of awk, sed and shell-generated way
C. Using Python to generate
example, using awk, sed to generate a question bank (for easy viewing, line breaking, one row at a time)
Sed-e ' s/\/mnt//'-e ' s/txt/txt/' Fat32-1.md5|awk ' {print ' test2: ", $,", this file MD5 HASH is:0x___. "," \\\\ "$" \\\\easy\ \\\.."}‘ >test.txt
The results are as follows (interception section):
Test2:/frombyte95/8.txt, this file MD5 HASH is:0x___. \\46D40D302D0CEBCF541086589E9FCCFB\\easy\\.
Test2:/frombyte95/9.txt, this file MD5 HASH is:0x___. \\D15F6065CDA928F5A581225AD2FA0AD0\\easy\\.
Test2:/frombyte96/1.txt, this file MD5 HASH is:0x___. \\646E1F87F8458D0423FE9E64EBBD1908\\easy\\.
Test2:/frombyte96/2.txt, this file MD5 HASH is:0x___. \\0E7C3DCBF868495E43BD6A34CE6D8418\\easy\\.
Test2:/frombyte96/3.txt, this file MD5 HASH is:0x___. \\681757B565DB23A467CDB527D2D107C8\\easy\\.
Test2:/frombyte96/4.txt, this file MD5 HASH is:0x___. \\C2FCEEBEE9FD30D107C0D5D57E5785A2\\easy\\.
Test2:/frombyte96/5.txt, this file MD5 HASH is:0x___. \\09F17DBAACA7AC8277457B5A97B14D66\\easy\\.
Test2:/frombyte96/6.txt, this file MD5 HASH is:0x___. \\3C63DB19A48086A33A31620346EB5F9B\\easy\\.
Test2:/frombyte96/7.txt, this file MD5 HASH is:0x___. \\B8FFC3B07E67D85E60B5B71367D75D90\\easy\\.
Test2:/frombyte96/8.txt, this file MD5 HASH is:0x___. \\12FC052979EAD0BC0C398E275CB6F56D\\easy\\.
Test2:/frombyte96/9.txt, this file MD5 HASH is:0x___. \\6C2055640D7FA21C6E9F8A31AB3A4C50\\easy\\.
Test2:/frombyte97/1.txt, this file MD5 HASH is:0x___. \\94791A0E619868560DF475AB96B5AE4D\\easy\\.
Test2:/frombyte97/2.txt, this file MD5 HASH is:0x___. \\F31D153B05329D5D22B74B06EEAB86A6\\easy\\.
Test2:/frombyte97/3.txt, this file MD5 HASH is:0x___. \\6B8375017CB05325CA565D586C596BE8\\easy\\.
Test2:/frombyte97/4.txt, this file MD5 HASH is:0x___. \\58E0129F24A5915D4BA957D90C05892A\\easy\\.
Test2:/frombyte97/5.txt, this file MD5 HASH is:0x___. \\66E2B4CD85DABA2ECEB810476B982538\\easy\\.
Test2:/frombyte97/6.txt, this file MD5 HASH is:0x___. \\502514DE713A04FBAFE3A44C8598028C\\easy\\.
Test2:/frombyte97/7.txt, this file MD5 HASH is:0x___. \\B66025D4FDD12837438ED36903F738A7\\easy\\.
Test2:/frombyte97/8.txt, this file MD5 HASH is:0x___. \\0F3B53E05AA6955A8377E55403E468F5\\easy\\.
Test2:/frombyte97/9.txt, this file MD5 HASH is:0x___. \\0A6EFA940D546735505D6847AFD4F9E0\\easy\\.
Test2:/frombyte98/1.txt, this file MD5 HASH is:0x___. \\E2567294C0EB341E43B1D26FF7372898\\easy\\.
Test2:/frombyte98/2.txt, this file MD5 HASH is:0x___. \\5624DA049E95F06475A2AF58BED6F050\\easy\\.
Test2:/frombyte98/3.txt, this file MD5 HASH is:0x___. \\8AB67DCDA00069208F1162C3FEF2BBD5\\easy\\.
This article is from the "Zhang Yu (Data Recovery)" blog, please be sure to keep this source http://zhangyu.blog.51cto.com/197148/1941416
Example of FAT32 file system architecture for generating evaluation in Linux