FAT File System

Overview History and Usage Structure Forensic Notes about FAT volumes In Class Problem

History and Usage FAT - File Allocation Table FAT8, FAT12 FAT16, FAT32, exFAT, vFAT (Extension to regular FAT*) Developed in 1977 by Microsoft Corporation Originally intended to be a file system for the Microsoft Disk BASIC interpreter, it was incorporated into MSDOS after Microsoft purchased the rights to QDOS (Quick and Dirty Operating System). Commonly used by removable media (Originally for floppy disks). Used for hard disks up until Windows XP (DOS, 95, 98, ME). Supported by many Operating Systems

Structure Boot Sector - Execution is passed from the MBR to the Boot Record contained here. Executable code as well as the OEM identifier, number of FATs, media descriptor (type of storage device), information about the OS to be booted. FAT #1 and #2 - Keeps track of the allocation status of clusters (allocated, unallocated, end of file, bad sector). Usually FAT#2 is a mirror of FAT#1 to provide redundancy but this can be turned off. Root Directory - Contains an entry for each file and directory stored in the file system. Includes information like the file name, starting cluster number, and file size. The root directory has a fixed size of 512 bytes (For a hard disk). Usually right after the FATs but with FAT32 it can be anywhere on the partition. Data Region - Where the files are actually stored.

File Systems - FAT Structure Boot section More reserved sectors (optional) FAT #1 FAT #2 Root directory (FAT 12/16 only) Data region (remainder of disk)

Structure Root Directory Entry Name (8.3) xxxxxxxx.yyy. (88 bits) (Unicode String) Attribute byte (8 bits of information, Type of entry (sub_dir, volume, etc.), is it an archive,system, hidden, read-only) One reserved byte. Create time (24 bits). Create date (16 bits). Last access date (16 bits). Two reserved bytes. Last modified time (16 bits). Last modified date (16 bits). Starting cluster number in the file allocation table (16 bits). File size (32 bits).

FAT Entry Each type of FAT file system has a different size for each entry. Each entry contains one of five things the cluster number of the next cluster in a chain a special end of cluster-chain (EOC) entry that indicates the end of a chain a special entry to mark a bad cluster a zero to note that the cluster is unused

FAT Entry vFAT or Long Name FAT Multiple Entries in the directory structure Conventional small file name for backward compatibility with extra attributes to point to the other parts of a file name 13 bytes per directory structure entry

File Systems - Fat Structure Fragmentation Issues and File Slack Space File1.txt 0002 File2.txt 0005 File3.TXT 0007 Address 1 2 3 4 5 6 7 8 Value 0003 0004 FFFF 0006 0008

FAT Entry Recovering from slack space blkls –s imagefile.dd > imagefile.slack #grab all slack from image and output it. By default outputs all unallocated data icat -r -s disk.img <inode> #recover file including data in slack space. -s parameter

Forensics Notes About FAT Time (Sleuthkit) Each file in FAT can store up to three times (last accessed, written, and created). The last written time is the only 'required' time and is accurate to a second. The create time is optional and is accurate to the tenth of a second (Note that I have seen several system directories in Windows that have a create time of 0). The last access time is also optional and is only accurate to the day (so the times are 00:00:00 in The Sleuth Kit). https://wiki.sleuthkit.org/index.php?title=FAT_Implementation_Notes http://www.forensicswiki.org/wiki/FAT

Example Parsing FAT32 root directory structure

Questions?

Relevant Links https://support.microsoft.com/en-us/help/154997/description-of-the-fat32- file-system https://technet.microsoft.com/en-us/library/cc938438.aspx http://www.forensicswiki.org/wiki/FAT