exFAT History - SANS Computer Forensics

More documents

Recommendations

Info

Offset 72 : 8 Byte Value Total Number of Sectors on the Volume x00 81 0F 00 00 00 00 00 1,016,064 Sectors 20 20 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Offset 80 : 4 Byte Value Starting Location of the FAT (Linked List) x80 00 00 00 Physical Sector 128 21 21 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Page 1 and 2: Revealed and Dissected 1 © 2009-20
Page 3 and 4: • Identify when and why exFAT was
Page 5 and 6: • Removable Media • Large Multi
Page 7 and 8: • Windows Vista SP 1 • Windows
Page 9 and 10: • Universal Time Code (UTC) • T
Page 11 and 12: • Registry Keys XP: - SOFTWARE\Mi
Page 13 and 14: • Identify when and why exFAT was
Page 15 and 16: • Identify an exFAT Volume • Ma
Page 17 and 18: Offset Hex Offset Dec x00 0 3 Jump
Page 19: Offset 3 : 8 Byte Value OEM Identif
Page 23 and 24: Offset 88 : 4 Byte Value Starting l
Page 25 and 26: Offset 96 : 4 Byte Value Location o
Page 27 and 28: To find the starting location of th
Page 29 and 30: To find the starting location of th
Page 31 and 32: Offset 104 : 2 Byte Value File Syst
Page 33 and 34: Offset 109 : 1 Byte Value The Numbe
Page 35 and 36: Offset 111: 1 Byte Value Used by IN
Page 37 and 38: The last 2 bytes of each sector wil
Page 39 and 40: • Sector 12-23 will contain a com
Page 41 and 42: • Review of a FAT from a FAT32 Fi
Page 43 and 44: • An entry in a FAT12/16/32 File
Page 45 and 46: Pointer to Next Fragment End of Fil
Page 47 and 48: Each entry is 4 bytes in length. It
Page 49 and 50: 0x000000FC (253) points to 0x000000
Page 51 and 52: And finally, 0xFFFFFFFF is the end
Page 53 and 54: • Locate the bitmap on an exFAT v
Page 55 and 56: • Each cluster is tracked in the
Page 57 and 58: • For example, if only the first
Page 59 and 60: • Directory entries are a series
Page 61 and 62: Directory Entry Record Tracks attri
Page 63 and 64: Offset Hex Offset Dec Length Field
Page 65 and 66: Offset Hex Offset Dec Length Field
Page 67 and 68: Hex Binary Description 0x0001 0000
Page 69 and 70: 69 69 © 2009-2010 J. Hamm © 2009-
Page 71 and 72:
Hex Binary Description 0x0001 0000
Page 73 and 74:
Unallocated records are tracked by
Page 75 and 76:
Unused Entry 0000 0000 0x00 Allocat
Page 77 and 78:
• Recognize exFAT Directory Entri
Page 79 and 80:
Jeff Hamm, CFCE US Department of St
show all

exFAT History - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?