1
Malware Forensics
hard
Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?
Exhibit
Refer to the exhibit. C:\> fls -f ntfs -o 2048 image.dd r/r 4-128-3: $AttrDef r/r 8-128-2: $BadClus r/r 6-128-2: $Bitmap r/r 7-128-1: $Boot r/r 11-128-3: $Extend r/r 2-128-1: $LogFile r/r 0-128-1: $MFT r/r 1-128-1: $MFTMirr r/r 9-128-8: $Secure r/r 10-128-1: $UpCase r/r 3-128-3: $Volume r/r 108-128-2: Users r/r 109-128-3: ProgramData r/r 110-128-2: Windows r/r 111-128-1: Program Files r/r 112-128-1: Program Files (x86) V/V 113-128-1: $OrphanFiles r/r 114-128-3: autoexec.bat r/r 115-128-1: config.sys