exFAT History - SANS Computer Forensics

More documents

Recommendations

Info

• The FAT file system is named for the use of a File Allocation Table (FAT) • A FAT32 file system by default has a FAT0 and a FAT1 (or FAT 1 and FAT 2) • Directory Entries track file name, metadata, and starting extent of a file • The FAT tracks the fragmentation of a file • The FAT tracks allocation status of a cluster 42 42 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
• An entry in a FAT12/16/32 File Allocation Table can be: – A pointer to the next cluster – An end of file marker – A designation for a bad cluster – A zero for an unallocated cluster 43 43 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Page 1 and 2: Revealed and Dissected 1 © 2009-20
Page 3 and 4: • Identify when and why exFAT was
Page 5 and 6: • Removable Media • Large Multi
Page 7 and 8: • Windows Vista SP 1 • Windows
Page 9 and 10: • Universal Time Code (UTC) • T
Page 11 and 12: • Registry Keys XP: - SOFTWARE\Mi
Page 13 and 14: • Identify when and why exFAT was
Page 15 and 16: • Identify an exFAT Volume • Ma
Page 17 and 18: Offset Hex Offset Dec x00 0 3 Jump
Page 19 and 20: Offset 3 : 8 Byte Value OEM Identif
Page 21 and 22: Offset 80 : 4 Byte Value Starting L
Page 23 and 24: Offset 88 : 4 Byte Value Starting l
Page 25 and 26: Offset 96 : 4 Byte Value Location o
Page 27 and 28: To find the starting location of th
Page 29 and 30: To find the starting location of th
Page 31 and 32: Offset 104 : 2 Byte Value File Syst
Page 33 and 34: Offset 109 : 1 Byte Value The Numbe
Page 35 and 36: Offset 111: 1 Byte Value Used by IN
Page 37 and 38: The last 2 bytes of each sector wil
Page 39 and 40: • Sector 12-23 will contain a com
Page 41: • Review of a FAT from a FAT32 Fi
Page 45 and 46: Pointer to Next Fragment End of Fil
Page 47 and 48: Each entry is 4 bytes in length. It
Page 49 and 50: 0x000000FC (253) points to 0x000000
Page 51 and 52: And finally, 0xFFFFFFFF is the end
Page 53 and 54: • Locate the bitmap on an exFAT v
Page 55 and 56: • Each cluster is tracked in the
Page 57 and 58: • For example, if only the first
Page 59 and 60: • Directory entries are a series
Page 61 and 62: Directory Entry Record Tracks attri
Page 63 and 64: Offset Hex Offset Dec Length Field
Page 65 and 66: Offset Hex Offset Dec Length Field
Page 67 and 68: Hex Binary Description 0x0001 0000
Page 69 and 70: 69 69 © 2009-2010 J. Hamm © 2009-
Page 71 and 72: Hex Binary Description 0x0001 0000
Page 73 and 74: Unallocated records are tracked by
Page 75 and 76: Unused Entry 0000 0000 0x00 Allocat
Page 77 and 78: • Recognize exFAT Directory Entri
Page 79 and 80: Jeff Hamm, CFCE US Department of St

exFAT History - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?