FAT32 Analysis

Walkthrough summary

FAT32 Analysis TryHackMe walkthrough with 21 answered prompts and lab methodology notes.

Sample prompts covered

• What is the name of the attack that targeted the Iranian nuclear program?
  Open the walkthrough page to inspect the full answer and command flow.
• What category of tactic is MITRE ATT&CK TA0005?
  Open the walkthrough page to inspect the full answer and command flow.
• We have a hypothetical file B and its cluster chain starts at cluster F and ends at cluster 10 . What would be the value of the FAT entry at cluster F? Provide the value as you would read it in the HxD editor. (Without spaces). Note: File B is not a file on the image.
  Open the walkthrough page to inspect the full answer and command flow.
• Using the FAT32_structure.001 image, answer the following question: At which offset does the FAT2 table start ( give in the offset value without spaces)? Remember, FAT1 starts right after the Reserved Sectors and FAT2 starts right after FAT1.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the filename of the file that starts at cluster 9?
  Open the walkthrough page to inspect the full answer and command flow.