exFAT History - SANS Computer Forensics

More documents

Recommendations

Info

This example is the location for tracking the 0x000000FC (252 nd ) allocation unit. It’s value points the next fragment: 0x000000FD (253). 48 48 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
0x000000FC (253) points to 0x000000FE (254) and so on. 49 49 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Page 1 and 2: Revealed and Dissected 1 © 2009-20
Page 3 and 4: • Identify when and why exFAT was
Page 5 and 6: • Removable Media • Large Multi
Page 7 and 8: • Windows Vista SP 1 • Windows
Page 9 and 10: • Universal Time Code (UTC) • T
Page 11 and 12: • Registry Keys XP: - SOFTWARE\Mi
Page 13 and 14: • Identify when and why exFAT was
Page 15 and 16: • Identify an exFAT Volume • Ma
Page 17 and 18: Offset Hex Offset Dec x00 0 3 Jump
Page 19 and 20: Offset 3 : 8 Byte Value OEM Identif
Page 21 and 22: Offset 80 : 4 Byte Value Starting L
Page 23 and 24: Offset 88 : 4 Byte Value Starting l
Page 25 and 26: Offset 96 : 4 Byte Value Location o
Page 27 and 28: To find the starting location of th
Page 29 and 30: To find the starting location of th
Page 31 and 32: Offset 104 : 2 Byte Value File Syst
Page 33 and 34: Offset 109 : 1 Byte Value The Numbe
Page 35 and 36: Offset 111: 1 Byte Value Used by IN
Page 37 and 38: The last 2 bytes of each sector wil
Page 39 and 40: • Sector 12-23 will contain a com
Page 41 and 42: • Review of a FAT from a FAT32 Fi
Page 43 and 44: • An entry in a FAT12/16/32 File
Page 45 and 46: Pointer to Next Fragment End of Fil
Page 47: Each entry is 4 bytes in length. It
Page 51 and 52: And finally, 0xFFFFFFFF is the end
Page 53 and 54: • Locate the bitmap on an exFAT v
Page 55 and 56: • Each cluster is tracked in the
Page 57 and 58: • For example, if only the first
Page 59 and 60: • Directory entries are a series
Page 61 and 62: Directory Entry Record Tracks attri
Page 63 and 64: Offset Hex Offset Dec Length Field
Page 65 and 66: Offset Hex Offset Dec Length Field
Page 67 and 68: Hex Binary Description 0x0001 0000
Page 69 and 70: 69 69 © 2009-2010 J. Hamm © 2009-
Page 71 and 72: Hex Binary Description 0x0001 0000
Page 73 and 74: Unallocated records are tracked by
Page 75 and 76: Unused Entry 0000 0000 0x00 Allocat
Page 77 and 78: • Recognize exFAT Directory Entri
Page 79 and 80: Jeff Hamm, CFCE US Department of St

exFAT History - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?