Presentation is loading. Please wait.

Presentation is loading. Please wait.

File Systems I FAT File Systems BACS 371 Computer Forensics.

Similar presentations

Presentation on theme: "File Systems I FAT File Systems BACS 371 Computer Forensics."— Presentation transcript:

1 File Systems I FAT File Systems BACS 371 Computer Forensics

2 File Systems (See A method for storing and organizing computer files and the data they contain to make it easy to find and access themcomputer files File System Types FAT (File Allocation Table) FAT12 FAT16 FAT32 exFAT NTFS (New Technology File System) Functions Manage free space Allocate clusters to file Track time (MAC – Modify, Access, Create)

3 FAT12 & FAT 16 FAT 12 Cluster size = 512 bytes to 8 K bytes 2 12 addressable clusters 4096 clusters max for max volume size of 32 MB FAT 16 Cluster size 512 bytes to 64 K bytes 2 16 addressable clusters 65,563 clusters max for max volume size of 4 GB

4 A FAT file system is composed of four different sections. The Boot Sector (aka Partition Boot Record, BIOS Parameter Block, Drive Parameter Block or Reserved Sector). This is always the first sector of the partition and includes some basic file system information (in particular, its type), pointers to the location of the other sections and the operating system's boot loader code.Boot Sector The FAT Region. This contains two copies of the File Allocation Table for the sake of redundancy, although the extra copy is rarely used, even by disk repair utilities. These are maps of the partition, indicating how the clusters are allocated. The Root Directory Region. This is a Directory Table that stores information about the files and directories in the root directory. With FAT32 it can be stored anywhere in the partition, however with earlier versions it is always located immediately after the FAT Region. The Data Region. This is where the actual file and directory data is stored and takes up most of the partition. The size of files and subdirectories can be increased arbitrarily (as long as there are free clusters) by simply adding more links to the file's chain in the FAT. Note however, that each cluster can be taken only by one file, and so if a 1KB file resides in a 32KB cluster, 31KB are wasted.

5 FAT File System Partition Boot Record FAT 1 FAT 2 (Duplicate) Root Directory Other folders and all files This is all contained within a partition. Note that the other folders and files component is most of the physical disk.

6 Partition Boot Record AKA File System Boot Sector Within each partition that has a file system, a partition boot record is found. It defines the details of the file system located in the partition. It is 1 sector long and is the first physical sector in a logical volume. C 0, H 1, S 1 for first partition. First sector (plus partition offset) in subsequent partitions. Contains Code File System Specification Information

7 BIOS Parameter Block Executable Code Machine Language Code Processor Specific Decodes BPB Searches for OS PBR Signature 0x55AA Partition Boot Record (PBR)

8 Partition Boot Record (FAT32 File system) Jump Instruction (3 bytes) OEM ID (8 Bytes) BIOS Parameter Block (BPB) (includes all below plus additional fields) all offsets in this section are from start of the BPB counting from 0 offset Bytes Per Sector2 Bytes offset Sectors Per Cluster1 Byte offset Media Descriptor1 Byte offset Sectors Per Track2 Bytes offset Number of Heads2 Bytes offset Hidden Sectors4 Bytes offset Total Sectors4 Bytes Bootstrap Code (448 Bytes) Ends with 55 AA NOTE: Offsets are from start of Partition, not start of Drive!

9 File Allocation Table A partition is divided up into identically sized clusters, small blocks of contiguous space. Cluster sizes vary depending on the type of FAT file system being used and the size of the partition, typically cluster sizes lie somewhere between 2KB and 32KB. Each file may occupy one or more of these clusters depending on its size; thus, a file is represented by a chain of these clusters (referred to as a singly linked list). However these chains are not necessarily stored adjacently on the disk's surface but are often instead fragmented throughout the Data Region.singly linked list The File Allocation Table (FAT) is a list of entries that map to each cluster on the partition. Each entry records one of five things: the address of the next cluster in a chain a special end of file (EOF) character that indicates the end of a chain a special character to mark a bad cluster a special character to mark a reserved cluster a zero to note that that cluster is unused

10 File Allocation Table (FAT)

11 The first sector in the file is found in cluster 2 in the data area of the disk. The FAT entry in position 02 points to position 03; so the next cluster is found in 03 in the data area of disk. This linked list continues until the FF FF in 16 indicates the end of the file is found in that cluster. Start at 02 Continue until 16

12 FAT Entry Values FAT12FAT16FAT32Description 0x0000x00000x? Free Cluster 0x0010x00010x? Reserved Cluster 0x002 – 0xFEF 0x0002 – 0xFFEF 0x? x?FFFFFEF Used Cluster, value points to next Cluster 0xFF0 – 0xFF6 0xFFF0 – 0xFFF6 0x?FFFFFF0 - 0x?FFFFFF6 Reserved values 0xFF70xFFF70x?FFFFFF7Bad Cluster 0xFF8 - 0xFFF 0xFFF8 - 0xFFFF 0x?FFFFFF8 - 0x?FFFFFFF Last Cluster in File

13 Directory Content The Directory is a Database of: File names Directory names Date and time stamps (MAC) Modify Access Create Starting cluster number Attributes Archive Hidden System Read Only Located on outermost track of disk

14 Directory table A directory table is a special type of file that represents a directory (nowadays commonly known as a folder). Each file or directory stored within it is represented by a 32 byte entry in the table. Each entry records the name, extension, attributes (archive, directory, hidden, read-only, system and volume), the date and time of creation, the address of the first cluster of the file/directory's data and finally the size of the file/directory. Aside from the Root Directory Table in FAT12 and FAT16 file systems which occupies the special Root Directory Region location, all Directory Tables are stored in the Data Region. Legal characters for DOS file names include the following: Upper case letters A-Z Numbers 0-9 Space (though trailing spaces are considered to be padding and not a part of the file name) ! # $ % & ( ) ^ _ ` { } ~ ' Values

15 Directory to FAT interaction

16 Root Directory

17 FAT32 32-bit Cluster Numbers Only 28 bits actually used 2 28 Addressable Clusters (~ 268,435,438) Drive sizes ~ 1TB (2 28 clusters * 4096 Bytes per cluster ~ 1.1TB) WinXP limited to 32GB using FAT32 Max file size in FAT32 is bytes ~ 4GB

18 Long File Names Trick FAT 12 and FAT 16 were limited to 8.3 file names (that is, 8 character name with 3 character suffix) This was a significant limitation, so FAT 32 fixed it. Phony entries are added to the Directory Tables Entries are marked with a volume label attribute Each phony entry can contain up to 13 UTF-16 characters (26 bytes)

19 Long File Names Entries Red entries are short file name entries. Blue are for a long file name. Read the long filename entries from the bottom to the top. Note that first byte in each group of long filenames are 01, 02, 03, 04, 05, and 06 (ored with 40 to indicate the last segment). Filename entries have 0F in 12 th byte. Directory entries have a 10 in this position (indicating a directory). 8.3 Entry

20 Multiple Directory Entries for a file with a long filename. There are 4 entries to contain the long file name, and 1 entry to contain the complete set of file information including the short file name. FAT32 Root Directory Single Directory Entry for a file with a short filename. Volume ID Directory Entry Designates Attribute Bits 0x08 = Volume Label 0x20 = Archive 0x0F = Long File Name

21 Advantages of FAT32 over FAT16 FAT32 offers smaller cluster sizes -> less wasted space FAT32 systems can reallocate and change the size of the root directory FAT32 drives can contain a copy of the boot record(s) –> less prone to failure Allow for long file names

22 File System Comparisons CriteriaNTFS5NTFSFAT32FAT16 Operating System Windows 2000 Windows XP Vista, Win 7 Windows NT Windows 2000 Windows XP Windows 98 Windows ME Windows 2000 Windows XP Vista, Win 7 DOS All versions of Microsoft Windows Limitations Max Volume Size2TB 2GB Max Files on VolumeNearly Unlimited ~65000 Max File Size Limit Only by Volume Size 4GB2GB Max Clusters NumberNearly Unlimited Max File Name LengthUp to 255 Standard Extended - up to 255

23 Criteria NTFS5 NTFS FAT32 FAT16 Unicode File NamesUnicode Character Set System Character Set System Records MirrorMFT Mirror File Second Copy of FAT Boot Sector LocationFirst and Last Sectors First Sector File AttributesStandard and Custom Standard Set Alternate StreamsYes No CompressionYes No EncryptionYesNo Object PermissionsYes No Disk QuotasYesNo Sparse FilesYesNo Reparse PointsYesNo Volume Mount PointsYesNo File Names256 Char 8.3 Names File System Features

24 Overall Performance Built-In SecurityYes No RecoverabilityYes No Performance Low on small volumes High on Large High on small volumes Low on large Highest on small volumes Low on large Disk Space Economy Max Average Minimal on large volumes Fault ToleranceMax MinimalAverage Criteria NTFS5 NTFS FAT32 FAT16

Download ppt "File Systems I FAT File Systems BACS 371 Computer Forensics."

Similar presentations

Ads by Google