SUSA-PR-042: Aster USB recovery training image
Self created fixture, not an acquired device or a real incident. No malware or personal data.
One 16 MiB FAT16 partition labelled ASTER-USB; image file is 17 MiB.
Sector size: 512 bytes; cluster size: 2048 bytes; fixture FAT times use UTC.
Three deleted entries have free FAT chains and preserved contiguous contents: one JPG and two identical PDFs.
A different current PDF remains allocated as a Whole versus Free comparison control.
Use QPhotoRec on a checked copy. Select the FAT16 partition, FAT/NTFS/HFS+/ReiserFS/... and Free.
In File Formats, enable only JPG and PDF. Keep recovery output separate from the image.
Keep the generated names. Compare content hashes with known-files.csv; actual counts/names may vary.
The catalog is a training baseline supplied by the fixture author, not metadata recovered by carving.
Do not mount, format or repair the training image to perform this lab.
