exFAT History - SANS Computer Forensics

More documents

Recommendations

Info

Unused Entry 0000 0000 0x00 Allocated Directory Entry Record 1000 0101 0x85 Unallocated Directory Entry Record 0000 0101 0x05 74 74 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Unused Entry 0000 0000 0x00 Allocated Stream Extension 1100 0000 0xC0 Unallocated Stream Extension 0100 0000 0x40 75 75 © 2009-2010 J. Hamm © 2009-2010 J. Hamm R. Shullich
Page 1 and 2:
Revealed and Dissected 1 © 2009-20
Page 3 and 4:
• Identify when and why exFAT was
Page 5 and 6:
• Removable Media • Large Multi
Page 7 and 8:
• Windows Vista SP 1 • Windows
Page 9 and 10:
• Universal Time Code (UTC) • T
Page 11 and 12:
• Registry Keys XP: - SOFTWARE\Mi
Page 13 and 14:
• Identify when and why exFAT was
Page 15 and 16:
• Identify an exFAT Volume • Ma
Page 17 and 18:
Offset Hex Offset Dec x00 0 3 Jump
Page 19 and 20:
Offset 3 : 8 Byte Value OEM Identif
Page 21 and 22:
Offset 80 : 4 Byte Value Starting L
Page 23 and 24: Offset 88 : 4 Byte Value Starting l
Page 25 and 26: Offset 96 : 4 Byte Value Location o
Page 27 and 28: To find the starting location of th
Page 29 and 30: To find the starting location of th
Page 31 and 32: Offset 104 : 2 Byte Value File Syst
Page 33 and 34: Offset 109 : 1 Byte Value The Numbe
Page 35 and 36: Offset 111: 1 Byte Value Used by IN
Page 37 and 38: The last 2 bytes of each sector wil
Page 39 and 40: • Sector 12-23 will contain a com
Page 41 and 42: • Review of a FAT from a FAT32 Fi
Page 43 and 44: • An entry in a FAT12/16/32 File
Page 45 and 46: Pointer to Next Fragment End of Fil
Page 47 and 48: Each entry is 4 bytes in length. It
Page 49 and 50: 0x000000FC (253) points to 0x000000
Page 51 and 52: And finally, 0xFFFFFFFF is the end
Page 53 and 54: • Locate the bitmap on an exFAT v
Page 55 and 56: • Each cluster is tracked in the
Page 57 and 58: • For example, if only the first
Page 59 and 60: • Directory entries are a series
Page 61 and 62: Directory Entry Record Tracks attri
Page 63 and 64: Offset Hex Offset Dec Length Field
Page 65 and 66: Offset Hex Offset Dec Length Field
Page 67 and 68: Hex Binary Description 0x0001 0000
Page 69 and 70: 69 69 © 2009-2010 J. Hamm © 2009-
Page 71 and 72: Hex Binary Description 0x0001 0000
Page 73: Unallocated records are tracked by
Page 77 and 78: • Recognize exFAT Directory Entri
Page 79 and 80: Jeff Hamm, CFCE US Department of St
show all

exFAT History - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?