2Acknowledgments Dr. David Dampier and the Center for Computer Security Research (CCSR)
3Basic ConceptsThe FAT file system is one of the most simple file systems and does not clear follow the five category model. It consists of two main data structures:File Allocation TableDirectory Entries
4Basic ConceptsEach file and directory is allocated a directory entry, that contains:File nameFile sizeStarting address of file contentOther metadataFile and directory content is stored in clustersIf a file or directory needs more than one cluster, those clusters are found in the FAT structureVersions of FAT: FAT12, FAT 16, and FAT32Difference is the size of entries in the FAT structure
5Versions of FAT FAT12 FAT16 FAT32 Designed as a file system for floppy diskettes12-bit cluster addressesFAT1616-bit cluster addressesFAT3232-bit cluster addresses (28 bits used) => 228 clustersDrive size up to 8TB with 32KB clustersCan become slow and inefficientVideo applications and large databases often exceed FAT32 limitations
6Layout of a FAT file system The layout of the FAT file system consists of 3 physical sections:Reserved area – for file system categoryFAT area – primary and backup FAT structuresData area – clusters used for storing file and directory contentReservedSector 0FAT areaData Area
7FAT File System DataIn order to analyze the FAT file system, it is necessary to locate the three physical layout areas.The reserved area starts at sector 0, and its size is given in the boot sector.In FAT12/16, the reserved area is typically only 1 sector, but FAT32 will typically reserve many sectorsThe FAT area begins in the sector after the reserved area.Its size is calculated by multiplying the number of FAT structures by the size of each FAT, both of which can be found in the boot sectorThe data area begin in the sector after the FAT area.Its size can be found by subtracting the starting address of the data area from the total number of sectors in the file system, which can be found in the boot sector.
8FAT System Layout FAT 32 FAT 12/16 ReservedAreaFAT AreaRootDirectoryDataAreaFAT 32ReservedAreaFAT AreaRootDirectoryDataAreaThe main difference between these layouts is that FAT 12/16’s root directory is at the beginning of the data sector, while in the FAT 32’s root directory can be anywhere in the data area. The first 36 bytes are the same in all.
9File System CategoryThe data in the File System Category describes the general file system and can be found in the boot sector data structure. The boot sector is located in the first sector of the volume and is part of the reserved area of the file system.
10Boot Sector The Boot Sector is contained in the first 512 bytes. The first 36 bytes of all FAT Boot Sectors contain:0-2 jump to boot code3-10 name in ASCIIbytes per sector13 sectors per cluster (powers of 2 < 32KB)size in sectors of reserved area16 number of FATs, 2 if backupmax # of root directory entriesbit value of number of sectors in file system21 media type: 0xf8 fixed disks, 0xf0 removablebit size in sectors of each FAT24-25 sectors per track26-27 number of heads28-31 number of sectors before start of partitionbit value of # of sectors in file system, > 0Bytes 510 and 511 have signature 0x55 and 0xAA
11Example Image FAT32 (See pp. 216 and 217) # fsstat –f fat fat-4.ddFILE SYSTEM INFORMATIONFile system type: FATOEM Name: MSDOS5.0Volume ID: 0x4c194603Volume Label (Boot Sector): NO NAMEVolume Label (Root Directory): FAT DISKFile System Type Label: FAT32Backup Boot Sector Location: 6FS Info Sector Location: 1Next Free Sector (FS Info): 1778Free Sector Count (FS Info):File System Layout (in sectors)Total Range: 0 –* Reserved:** Boot Sector: 0** FS Info Sector: 1* FAT 0:* FAT 1:* Data Area:*** Root Directory:CONTENT DATA INFORMATIONSector Size: 512Cluster Size:38 reserved sectors2 FAT structures
12AnalysisIn order to analyze a disk or find hidden data, it is necessary to know the layout of file systems and know which OS formatted the diskSeveral places not used by the file system could contain hidden dataIn the reserved area, at the end of the boot sector data and the final signatureBetween the end of the file system and the end of the volumeFAT32 systems have a backup boot sector in sector 6The primary and backup copies could be compared to find inconsistenciesIf values in the primary have been changed, the backup may contain original data
13Analysis ScenarioImagine that the first 32 sectors of a disk are damaged and cannot be read. What do you do?First, find the start of the file system.The signature for a fat file system is 0x55 and 0xAA in the final two bytes of the boot sector. The sigfind tool can be used to look for the signature.When the tool find the signature, additional test can be conducted on a range of values that are valid for a given data structure. For example, byte 13 of the boot sector identifies how many sectors in a cluster, and must have a value that is a power of 2. Any other value would indicate that the sector was not part of a FAT file system boot sector, even though it contained the signature.
14Content CategoryThe Content category comprises of the file and directory content.FAT file systems use the term cluster for its data units in the Data AreaA cluster is a group of consecutive sectors, the number of sectors must be a power of 2 (1, 2, 4, ..., 64) Each cluster has an address and the address of the first cluster is 2 (there are no clusters with address 0 or 1)ReservedSector 0FAT areaData Area
15Finding the First Cluster Finding cluster 2 is not easy, because it is not at the beginning of the file system. Depending on whether it is a FAT 12/16 or FAT 32 system, the procedure is different.FAT 12/16ReservedAreaFAT AreaRootDirectoryDataAreaSector 1224Sector 1256Cluster 2FAT 32ReservedAreaFAT AreaRootDirectoryDataAreaSector 1224Cluster 2
16Finding the First Cluster In a FAT 12/16 system, the number of root directory entries are given in the boot sector, and cluster 2 starts in the next sector.For example, consider a FAT16 file system with 32 sectors allocated for the root directory. If the data area starts in sector 1224, then the root directory spans from sector 1224 to If we have 2048 byte clusters, then cluster 2 would start at 1256 and cluster 3 would start at 1260.
17Cluster Allocation Status The status of a cluster (whether allocated or not) is found in the FAT structure.The basic concept of the FAT is that it has one entry for each cluster in the file system. If the table entry is 0, then the cluster corresponding to that table entry is not allocated to a file. All other values mean that the cluster is allocated.ReservedSector 0FAT areaData Area
18Allocation Algorithms To find an unallocated cluster the OS scans the FAT for an entry with a 0 in itMost operating systems do not clear cluster contents when unallocated61626364656667XXXXX – allocated0 - availableLast allocated
19Analysis TechniquesWhen analyzing the content category, there are several places where data could be hidden.Clusters can be marked as ‘bad’, and bad clusters should be examined, because the OS does not look at them.The size of the data are might not be a multiple of the cluster size, so there could be a few sectors at the end of the data area that are not part of a cluster.
20Analysis ScenarioImagine a FAT 16 file system in which you need to locate cluster 812. The only tool available is a hex editor.First, view the boot sector, which is located at sector 0 of the file system and process itProcessing this indicates that there are 6 reserved sectors, two FATS, each FAT is 249 sectors, each cluster is 32 sectors and there are 512 directory entries in the root directory.Sector6Sector255Sector504Sector536Sector568Sector26456ReservedFAT1FAT2RootDirectoryCluster2Cluster812
21Metadata CategoryThis category includes data that describe files and directories in directory entriesWhere content is stored, dates and times, and permissionsIn an FAT file system, this information is stored in a directory entry structure.Every file or directory is allocated a directory entry.Exists anywhere in the Data area.Each directory entry is 32 bytes: file attributes, size, starting cluster, dates and timesWhen a new file or directory is created, a directory entry in the parent directory (..) is allocated for itSearched by using full nameFAT structure is used to find remaining clusters
23Directory Entry Data Structure 0 first character of file name in ASCII1-10 characters 2 to 11 of file name in ASCII11 file attributes (read only, hidden, volume label etc. )13 creation time (tenths of seconds)14-15 creation time (hours, minutes, seconds)16-17 creation day18-19 last accessed day20-21 high 2 bytes of first cluster address22-23 written time (hours, minutes, seconds)24-25 written day26-27 low 2 bytes of first cluster address28-31 size of file (0 for directories), max file size 4GBSee Table 10.5 and 10.6
24Directory EntriesDirectory entries can exist anywhere in the data area. When a new file or directory is created, a directory entry in the parent directory is allocated for it.The 11th byte in the directory entry has an attribute field that can contain 7 different attributes.Directory attributeLong file name attributeVolume label – only one directory entry should have this labelRead-only attributeHidden attributeSystem attributeArchive attributeThe allocation status of a directory entry is determined by using the first byte. With an allocated entry, the first byte stores the first character in the file name, but it is replaced by 0xe5 when the entry becomes unallocated.
25Directory Entries ... ... Sector 520 Sector 1,376 Each 512 byte sector can store 16 directory entry structures......FAT AreaData AreaCarrier Figure 9.12
26Cluster ChainsIf a FAT entry is non-zero, it contains the address of the next cluster, an EOF, or a bad sector indicator.FATDirectory Entry39File1.datStart: 40Size: 6,01341404441EOF42We know from the file size howmany clusters are needed43EOF44
27Creation times in directory entries Cluster 110Cluster 256NameCreatedClusterNameCreatedClusterDir23/30/08 01:02:03128.4/01/08 05:14:00256Dir14/03/08 11:12:13256..4/04/08 05:14:00110File8.dat5/24/08 12:12:12512File1.dat4/03/08 12:12:12208The created time in the directory entry for thedirectory does not match the . and .. entriesCarrier Figure 9.10
28DirectoriesWhen a new directory is created a cluster is allocated and wiped with zerosThe size field is always zeroTo find the size of the directory, go to the starting cluster and follow the cluster chain until EOFThe first two directory entries in a directory entry are:Current directory (.)Parent directory (..)Time fields may be used to verify creation time of a directoryHowever we cannot confirm the last written date because . and .. entries are not updated for each directory modification
29Directory Entry Allocation UnallocatedDirectory Entry #2AllocatedDirectory Entry #3Directory Entry #4Last Allocated ... Entry 3 was unallocated after entry 4was allocatedDirectory Entry #5Directory Entry #6Carrier’s Observations:Windows 98 uses a first-available allocation strategy and starts from the beginningWindows XP uses next-available and starts from the last allocated directory entry
30Searching for deleted directories When unallocated, the first letter of a file name is changed to _ (0xe5)Thus, if two files had similar names: A-1.dat and B-1.dat, they would now both be _-1.datWhen a directory is deleted and its entry is reallocated, the cluster for that directory is orphanedTo find orphan files, every sector of the data area needs to be examined... See figure 9.11
31Analysis ScenarioImagine that there is a FAT file system has been recently formatted and we need to recover the directories from before the format.That means, we need to look at all the unallocated space and see if there is any directory information in there. Using TSK, we can extract the unallocated space using dls.
32Analysis Contd. - Search for Unallocated Space and then Search for Directories dls allows us to extract the unallocated space.#dls –f fat Fat-10.dd > fat-10.dlssigfind can be used to search for a signature.Example: the first 4 bytes of a directory is always “. “ (period followed by 3 spaces – current directory) which has the hex code of 0x2e202020#sigfind –b 512 2e fat-10.dlsBlock size: Offset: 0Block: 180 (-)Block 2004 (+1824)Block 3092 (+1088)Block 3188 (+96)Block (+15840)...says that this signature occurred in sector 180 and others
33Viewing the contents of Sector 180 #dd if=fat-10.dls skip=180 count=1 | xxd: 2e daf ].: 3c23 3c daf 3c23 4f <#<#..].<#0....: 2e2e daf ].: 3c23 3c daf 3c23 dc0d <#<#..].<#0....: e549 4c e ILE1.DAT: d u!u!.....u!V.....Three entries are shown here. The first two are for the . and .. entries.The . entry points to cluster 6,479 (0x194f)The .. entry points to cluster 3,548 (0x0ddc)The third entry is for a file that starts in cluster 6,486 (0x1956) with a size of 53, 248bytes (0xd000).File recovery could be performed on this file now that we know its startingaddress and size.
34File Name CategoryFAT does not differentiate between a file name address and metadata address, and this is the same as what was there in the metadata category.So far, what we saw were filenames with 8 characters plus a 3-character extension (SFN)SFN entry contains time, size, and starting cluster informationA file may also have a longer, more descriptive file name, LFNIf there are > 13 characters, more LFN entries are used...see figure 9.15
35Finding Hidden Data Unused sectors in the reserved area Between the end of the file system and the end of the volumeCompare the number of sectors in the file system (given in boot sector) with the number of sectors in the volume to find volume slackThe total number of sectors value can be easily changed in the boot sector
36Finding more hidden data... Between the last entry in the primary FAT and the start of the backup copy or between the last valid entry in the backup FAT and the start of the data areaCompare the size of each FAT with the size needed for the number of clusters in the file systemSomeone could create a directory with only a few files and use the rest of the directory space for hiding dataCompare the allocated size of the directory to the number of allocated files
37The Big Picture Boot Sector Data Area FAT Root Directory Cluster 90 This is the content of a file that I just createdFile1.txt200dir190201200EOF201Cluster 201This is the content from the rest of the file that didn’t fit in the cluster