exFAT History - SANS Computer Forensics

More documents

Recommendations

Info

• Recognize <strong>exFAT</strong> Directory Entries • Understand the Three Record Types in a Directory Entry – Directory Entry Record – Stream Extension – File Name Extension • Locate the Starting Cluster and Size of a File • Identify Deleted Files 58 58 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
• Directory entries are a series of 32 byte records. • Each record has a type flag located in the first byte of the record. • A file will have at least 3 records. 59 59 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Page 1 and 2:
Revealed and Dissected 1 © 2009-20
Page 3 and 4:
• Identify when and why exFAT was
Page 5 and 6:
• Removable Media • Large Multi
Page 7 and 8: • Windows Vista SP 1 • Windows
Page 9 and 10: • Universal Time Code (UTC) • T
Page 11 and 12: • Registry Keys XP: - SOFTWARE\Mi
Page 13 and 14: • Identify when and why exFAT was
Page 15 and 16: • Identify an exFAT Volume • Ma
Page 17 and 18: Offset Hex Offset Dec x00 0 3 Jump
Page 19 and 20: Offset 3 : 8 Byte Value OEM Identif
Page 21 and 22: Offset 80 : 4 Byte Value Starting L
Page 23 and 24: Offset 88 : 4 Byte Value Starting l
Page 25 and 26: Offset 96 : 4 Byte Value Location o
Page 27 and 28: To find the starting location of th
Page 29 and 30: To find the starting location of th
Page 31 and 32: Offset 104 : 2 Byte Value File Syst
Page 33 and 34: Offset 109 : 1 Byte Value The Numbe
Page 35 and 36: Offset 111: 1 Byte Value Used by IN
Page 37 and 38: The last 2 bytes of each sector wil
Page 39 and 40: • Sector 12-23 will contain a com
Page 41 and 42: • Review of a FAT from a FAT32 Fi
Page 43 and 44: • An entry in a FAT12/16/32 File
Page 45 and 46: Pointer to Next Fragment End of Fil
Page 47 and 48: Each entry is 4 bytes in length. It
Page 49 and 50: 0x000000FC (253) points to 0x000000
Page 51 and 52: And finally, 0xFFFFFFFF is the end
Page 53 and 54: • Locate the bitmap on an exFAT v
Page 55 and 56: • Each cluster is tracked in the
Page 57: • For example, if only the first
Page 61 and 62: Directory Entry Record Tracks attri
Page 63 and 64: Offset Hex Offset Dec Length Field
Page 65 and 66: Offset Hex Offset Dec Length Field
Page 67 and 68: Hex Binary Description 0x0001 0000
Page 69 and 70: 69 69 © 2009-2010 J. Hamm © 2009-
Page 71 and 72: Hex Binary Description 0x0001 0000
Page 73 and 74: Unallocated records are tracked by
Page 75 and 76: Unused Entry 0000 0000 0x00 Allocat
Page 77 and 78: • Recognize exFAT Directory Entri
Page 79 and 80: Jeff Hamm, CFCE US Department of St
show all

exFAT History - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?