#!/usr/bin/env bash
# make-test-fs.sh
# Creates a small FAT32 disk image with a planted text file and a "deleted" file.
# Used for Lab (a): Image and hash a test USB with dd.
# Run this on the host BEFORE the lab to prepare evidence/test.img
#
# Requirements: mkdosfs (dosfstools), mcopy/mtools  OR  loop-mount (Linux only)
# On macOS: brew install mtools dosfstools

set -euo pipefail

IMG="evidence/test.img"
SIZE_MB=16

mkdir -p evidence

echo "[+] Creating ${SIZE_MB} MB FAT32 image at ${IMG}"
dd if=/dev/zero of="${IMG}" bs=1M count=${SIZE_MB} status=none

mkdosfs -F 32 -n "LABEVIDENCE" "${IMG}" 2>/dev/null || \
  { echo "mkdosfs not found -- install dosfstools (apt/brew) and re-run."; exit 1; }

echo "[+] Copying seed files into the image"
# mtools does not need root or loop mount
export MTOOLS_SKIP_CHECK=1

echo "This file was NOT deleted. It contains a clue: KEYWORD_ALPHA." \
    | mcopy - "mtools:${IMG}::/visible_file.txt" 2>/dev/null || \
    mcopy -i "${IMG}" <(echo "Visible clue: KEYWORD_ALPHA") ::/visible_file.txt

echo "SECRET_PASSWORD_1234" \
    | mcopy -i "${IMG}" - ::/deleted_secret.txt 2>/dev/null || true

# Delete the secret file so it shows as a "deleted" entry
mdel -i "${IMG}" ::/deleted_secret.txt 2>/dev/null || true

echo "[+] Computing reference SHA-256"
sha256sum "${IMG}" | tee "${IMG}.sha256"

echo ""
echo "Done. Use evidence/test.img as the source for Lab (a)."
echo "  Treat it as your USB device substitute -- use dd/dc3dd to image it,"
echo "  then mount and carve to recover deleted_secret.txt."
