1© 2009-2010 J. Hamm

Revealed and Dissected

2© 2009-2010 J. Hamm

• Describe exFAT, what systems it’s enabled on, and explain why it was implemented.

• Identify an exFAT volume and explain the information contained in the Volume Boot Record.

• Explain how exFAT tracks fragmentation and allocation.

• Define the information contained in the directory records on an exFAT volume.

2© 2009-2010 J. Hamm

2© 2009-2010 J. Hamm

R. Shullich

3© 2009-2010 J. Hamm

• Identify when and why exFAT was introduced• Recognize what Microsoft operating systems

read and write to exFAT• Understand the scalability and limitations of

exFAT• Determining if a system was capable of using

the exFAT File System

3© 2009-2010 J. Hamm

3© 2009-2010 J. Hamm

R. Shullich

4© 2009-2010 J. Hamm

• Extended FAT (exFAT)

4© 2009-2010 J. Hamm

4© 2009-2010 J. Hamm

R. Shullich

5© 2009-2010 J. Hamm

• Removable Media• Large Multimedia Files• Limited Overhead• Transactional FAT Compatible

5© 2009-2010 J. Hamm

5© 2009-2010 J. Hamm

R. Shullich

6© 2009-2010 J. Hamm

• Introduced with Windows CE 6.0 in November 2006• Spring 2008 – Vista Service Pack 1 Released with exFAT

capabilities• January 2009 – SDXC (eXtended Capacity) memory card

specification announced. exFAT designated as the exclusive File System for use by host devices as the standard.

• January 2009 – Windows XP drivers available directly from Microsoft

• March 2009 – SDXC cards released by Pretec.• Spring 2010 – host devices set to be released.

6© 2009-2010 J. Hamm

6© 2009-2010 J. Hamm

R. Shullich

7© 2009-2010 J. Hamm

• Windows Vista SP 1• Windows XP SP 2 (with updates)• Windows XP SP 3 (with updates)• Windows Server 2003• Windows Server 2008• Windows 7• Windows CE 6.0

7© 2009-2010 J. Hamm

7© 2009-2010 J. Hamm

R. Shullich

8© 2009-2010 J. Hamm

• File Size: 16 EiB Based on a 64 bit limitation for “File Size”*

• Maximum Files per Sub-Directory: 2,796,202*• File Name Length: 255 Characters• Volume Size: 64 ZiB (Microsoft recommends 512 TiB)

Shorthand Longhand nth Bytes

Ki Kilobyte 210 1024

Mi Megabyte 220 1024 KiB

Gi Gigabyte 230 1024 MiB

Ti Terabyte 240 1024 GiB

Pi Petabyte 250 1024 TiB

Ei Exabyte 260 1024 PiB

Zi Zetabyte 270 1024 EiB 8© 2009-2010 J. Hamm

8© 2009-2010 J. Hamm

R. Shullich

9© 2009-2010 J. Hamm

• Universal Time Code (UTC)• Transactional exFAT (TexFAT) Compatibility• Access Control List (ACL) Support

9© 2009-2010 J. Hamm

9© 2009-2010 J. Hamm

R. Shullich

10© 2009-2010 J. Hamm

• System Files– exfat.sys – located in %SystemRoot%\System32\Drivers\– format.com – will include “exFAT” as an option– uexfat.dll – located in %SystemRoot%\System32\

• Other files modified include:– fmifs.dll– fs_rec.sys– ifsutil.dll– Shell32.dll– ulib.dll– xpsp3res.dll

10© 2009-2010 J. Hamm

10© 2009-2010 J. Hamm

R. Shullich

11© 2009-2010 J. Hamm

• Registry Keys XP:– SOFTWARE\Microsoft\Updates\Windows

XP\SP4\KB955704• Presence indicates exFAT files installed and lists them

separately in each entry.

– SYSTEM\%Current Control Set%\Enum\Root\LEGACY_EXFAT

– SYSTEM\%Current Control Set%\Services\exFat– Other entries will show “exFAT”

11© 2009-2010 J. Hamm

11© 2009-2010 J. Hamm

R. Shullich

12© 2009-2010 J. Hamm

• Registry Keys Vista:– SYSTEM\%Current Control

Set%\Enum\Root\LEGACY_EXFAT– SYSTEM\%Current Control

Set%\Services\Eventlog\System\exFat– SYSTEM\%Current Control Set%\Services\exFat– Other entries will show “exFAT”

12© 2009-2010 J. Hamm

12© 2009-2010 J. Hamm

R. Shullich

13© 2009-2010 J. Hamm

• Identify when and why exFAT was introduced• Recognize what Microsoft operating systems

read and write to exFAT• Understand the scalability and limitations of

exFAT• Determining if a system was capable of using

the exFAT File System

13© 2009-2010 J. Hamm

13© 2009-2010 J. Hamm

R. Shullich

14© 2009-2010 J. Hamm

June 6th, 2010 14

• Bits are numbered right to left– 76543210

• Decimal Offsets (zero based)• Little-Endian numbers• Unsigned numbers• Sectors vs. Clusters• Strings are 16 bit Unicode• Strings not Terminated

15© 2009-2010 J. Hamm

• Identify an exFAT Volume• Manually Parse the Information in the Volume

Boot Record (VBR)• Interpret logical cluster mapping• Locate the first cluster of the Root directory• Recognize the 0x55 AA signature at the end of

the first 9 sectors of the volume and the VBR backup

• Recognize the 12th sector of the volume• Identify and locate the backup VBR

15© 2009-2010 J. Hamm

15© 2009-2010 J. Hamm

R. Shullich

16© 2009-2010 J. Hamm

Boot Record Backup Boot Record

FAT(Linked List)

Cluster Heap

(Data Area)

Starting Extent of the Root Directory

12 Sectors 12 Sectors

Variable Length:

Defined in the Boot

Variable Length:

Defined in the Boot

1st Cluster: Defined in the Boot

System Area

Note: The Root directory can and will fragment.

System Area

16© 2009-2010 J. Hamm

16© 2009-2010 J. Hamm

R. Shullich

17© 2009-2010 J. Hamm

OffsetHex

OffsetDec Length Field Definition

x00 0 3 Jump Code

x03 3 8 OEM File System Identifier

x0B 11 35 Must be Zero

x40 64 4 Partition Sector Offset – Will be Zero for Removable Media

x48 72 8 Total Sectors on the Volume

x50 80 4 FAT Location in Sectors

x54 84 4 Physical Size of the FAT in Sectors

x58 88 4 Physical Sector Location of the Cluster Heap (Cluster 2)

x5C 92 4 Allocation Units on the Volume (Bit Count)

x60 96 4 1st Cluster of the Root Directory

x64 100 4 Volume Serial Number

x68 104 2 File System Revision Number – 1.0

X6A 106 1 Volume Flags

X6B 107 1 Active FAT

x6C 108 1 Bytes per Sector

x6D 109 1 Sectors Per Cluster (in Powers of 2)

x6E 110 1 The Number of FATs on the Volume

x70 112 1 Percentage In Use 17© 2009-2010 J. Hamm

17© 2009-2010 J. Hamm

R. Shullich

18© 2009-2010 J. Hamm

Offset 0 : 3 Byte Value

Jump Code

Required for Microsoft file systems even when the device is not bootable.

18© 2009-2010 J. Hamm

18© 2009-2010 J. Hamm

R. Shullich

19© 2009-2010 J. Hamm

Offset 3 : 8 Byte Value

OEM Identifier

x45 58 46 41 54 20 20 20

exFAT

19© 2009-2010 J. Hamm

19© 2009-2010 J. Hamm

R. Shullich

20© 2009-2010 J. Hamm

Offset 72 : 8 Byte Value

Total Number of Sectors on the Volume

x00 81 0F 00 00 00 00 00

1,016,064 Sectors

20© 2009-2010 J. Hamm

20© 2009-2010 J. Hamm

R. Shullich

21© 2009-2010 J. Hamm

Offset 80 : 4 Byte Value

Starting Location of the FAT (Linked List)

x80 00 00 00

Physical Sector 128

21© 2009-2010 J. Hamm

21© 2009-2010 J. Hamm

R. Shullich

22© 2009-2010 J. Hamm

Offset 84 : 4 Byte Value

Size of the FAT (Linked List)

x03 1F 00 00

7939 Sectors

22© 2009-2010 J. Hamm

22© 2009-2010 J. Hamm

R. Shullich

23© 2009-2010 J. Hamm

Offset 88 : 4 Byte Value

Starting location of the Cluster Heap (Data Area)

x00 20 00 00Physical Sector 8192

23© 2009-2010 J. Hamm

23© 2009-2010 J. Hamm

R. Shullich

24© 2009-2010 J. Hamm

Offset 92 : 4 Byte Value

Allocation Units on the Volume (Clusters)

x00 61 0F 00

1,007,872 Units (Each Represented by a Bit)

2424© 2009-2010 J. Hamm

R. Shullich

25© 2009-2010 J. Hamm

Offset 96 : 4 Byte Value

Location of the 1st cluster of the Root Directory

x05 01 00 00

Logical Cluster 261

2525© 2009-2010 J. Hamm

R. Shullich

26© 2009-2010 J. Hamm

The data area (cluster heap) of an exFAT disk begins addressing starting with cluster two.

Hint: This can make manually navigating the file system difficult. To keep locations relative, translate cluster zero of the file system by subtracting two clusters from the starting sector of the Bitmap.

0x0F8100 = 8192 (Sector location of Cluster 2) – 2 Clusters = Sector 819026

© 2009-2010 J. Hamm26

© 2009-2010 J. HammR. Shullich

27© 2009-2010 J. Hamm

To find the starting location of the first sector of the root directory, find the cluster offset relative to the defined location for cluster 2. In this example one sector equals one cluster and cluster 2 starts in sector 8192.

0x0105 = Cluster 261 (defined above) + Sector 8192 (defined in VBR as the start of the cluster heap) – 2 Clusters (addressing begins at cluster 2) = Sector 8451

The starting cluster for the root directory is at cluster 261 and it’s location is sector 8451.27

© 2009-2010 J. Hamm27

© 2009-2010 J. HammR. Shullich

28© 2009-2010 J. Hamm

If the cluster size is set to 1024 bytes (2 Sectors per cluster) the addressing works in the same fashion. The value 4224 is the starting location for the cluster heap and is addressed as cluster 2.

Hint: To find logical cluster addressing, subtract 4 sectors (2 clusters) from 4224 and the result is the the equivalent to cluster zero. Sector 4220 will be the starting point for cluster addressing.

28© 2009-2010 J. Hamm

28© 2009-2010 J. Hamm

R. Shullich

29© 2009-2010 J. Hamm

To find the starting location of the first sector of the root directory, start cluster mapping from the previous location (sector 4220). (two sectors equal one cluster in this example)

0x46 = 70 Clusters (as defined in the VBR) = 140 Sectors + 4224 Sectors (defined as the starting location for the data area) – 2 Clusters (4 Sectors) = sector 4360

The starting cluster for the root directory is at cluster 70 and its location is sector 4360.29

© 2009-2010 J. Hamm29

© 2009-2010 J. HammR. Shullich

30© 2009-2010 J. Hamm

Offset 100 : 4 Byte Value

Volume Serial Number

xFD D9 FC C8

C8FC-D9FD

30© 2009-2010 J. Hamm

30© 2009-2010 J. Hamm

R. Shullich

31© 2009-2010 J. Hamm

Offset 104 : 2 Byte Value

File System Version

x00 01

exFAT 1.00

31© 2009-2010 J. Hamm

31© 2009-2010 J. Hamm

R. Shullich

32© 2009-2010 J. Hamm

Offset 108 : 1 Byte Value

Sector Size

x09

2^9 (512 bytes)

32© 2009-2010 J. Hamm

32© 2009-2010 J. Hamm

R. Shullich

33© 2009-2010 J. Hamm

Offset 109 : 1 Byte Value

The Number of Sectors Per Clusterx00

20 = 1 Sector Per Cluster

33© 2009-2010 J. Hamm

33© 2009-2010 J. Hamm

R. Shullich

34© 2009-2010 J. Hamm

Offset 110: 1 Byte Value

Number of FATs in Use

x01

1

34© 2009-2010 J. Hamm

34© 2009-2010 J. Hamm

R. Shullich

35© 2009-2010 J. Hamm

Offset 111: 1 Byte Value

Used by INT13

x80

x80

35© 2009-2010 J. Hamm

35© 2009-2010 J. Hamm

R. Shullich

36© 2009-2010 J. Hamm

Offset 112 : 1 Byte Value

Percentage of cluster heap in use

0x01

1% in use

36© 2009-2010 J. Hamm

36© 2009-2010 J. Hamm

R. Shullich

37© 2009-2010 J. Hamm

The last 2 bytes of each sector will be x55 AA. This value will be present in the first 9 sectors of the boot record and the first 9 sectors of the back up boot.

*Assuming 512 byte sectors

37© 2009-2010 J. Hamm

37© 2009-2010 J. Hamm

R. Shullich

38© 2009-2010 J. Hamm

The 12th sector of the boot and back up boot will contain a repetitive 4 byte value. The value is a checksum of the other sectors of the boot region. This value is calculated without including the Volume Flags and Percent in Use fields.

38© 2009-2010 J. Hamm

38© 2009-2010 J. Hamm

R. Shullich

39© 2009-2010 J. Hamm

• Sector 12-23 will contain a complete backup of the first 12 sectors of the volume

39© 2009-2010 J. Hamm

39© 2009-2010 J. Hamm

R. Shullich

40© 2009-2010 J. Hamm

• Identify an exFAT Volume• Manually Parse the Information in the Volume

Boot Record (VBR)• Interpret logical cluster mapping• Locate the first cluster of the Root directory• Recognize the 0x55 AA signature at the end of

the first 9 sectors of the volume and the VBR backup

• Recognize the 12th sector of the volume• Identify and locate the backup VBR

40© 2009-2010 J. Hamm

40© 2009-2010 J. Hamm

R. Shullich

41© 2009-2010 J. Hamm

• Review of a FAT from a FAT32 File System• Define the Possible States of Entries in the

Linked List• Track Fragmentation in the FAT in exFAT

41© 2009-2010 J. Hamm

41© 2009-2010 J. Hamm

R. Shullich

42© 2009-2010 J. Hamm

• The FAT file system is named for the use of a File Allocation Table (FAT)

• A FAT32 file system by default has a FAT0 and a FAT1 (or FAT 1 and FAT 2)

• Directory Entries track file name, metadata, and starting extent of a file

• The FAT tracks the fragmentation of a file• The FAT tracks allocation status of a cluster

42© 2009-2010 J. Hamm

42© 2009-2010 J. Hamm

R. Shullich

43© 2009-2010 J. Hamm

• An entry in a FAT12/16/32 File Allocation Table can be:– A pointer to the next cluster– An end of file marker– A designation for a bad cluster– A zero for an unallocated cluster

43© 2009-2010 J. Hamm

43© 2009-2010 J. Hamm

R. Shullich

44© 2009-2010 J. Hamm

• exFAT uses a Linked List to track data file fragmentation

• A flag in the directory record indicates if the FAT is being used for the file

• The exFAT FAT does not track allocation status• The only Media Type is 0xF8

44© 2009-2010 J. Hamm

44© 2009-2010 J. Hamm

R. Shullich

45© 2009-2010 J. Hamm

Pointer to Next Fragment

End of File (0xFF FF FF FF) (null value)

No Fragmentation Being Tracked (0x00 00 00 00)

45© 2009-2010 J. Hamm

45© 2009-2010 J. Hamm

R. Shullich

46© 2009-2010 J. Hamm

Pointer to the next Pointer

Pointer to the next Pointer

End of File0xFFFFFFFF

46© 2009-2010 J. Hamm

46© 2009-2010 J. Hamm

R. Shullich

47© 2009-2010 J. Hamm

Each entry is 4 bytes in length. It can point to another location, it can be terminated by hex value 0xFFFFFFFF, or it can be left zeros indicating no fragmentation for the addressed portion of the FAT.

47© 2009-2010 J. Hamm

47© 2009-2010 J. Hamm

R. Shullich

48© 2009-2010 J. Hamm

This example is the location for tracking the 0x000000FC (252nd) allocation unit. It’s value points the next fragment: 0x000000FD (253).

48© 2009-2010 J. Hamm

48© 2009-2010 J. Hamm

R. Shullich

49© 2009-2010 J. Hamm

0x000000FC (253) points to 0x000000FE (254) and so on.

49© 2009-2010 J. Hamm

49© 2009-2010 J. Hamm

R. Shullich

50© 2009-2010 J. Hamm

So, 252 points to 253 points to 254, points to 255, points to 256 points to 257, points to 258, points to 259, points to 260.

50© 2009-2010 J. Hamm

50© 2009-2010 J. Hamm

R. Shullich

51© 2009-2010 J. Hamm

And finally, 0xFFFFFFFF is the end of file marker.

51© 2009-2010 J. Hamm

51© 2009-2010 J. Hamm

R. Shullich

52© 2009-2010 J. Hamm

• Review of a FAT from a FAT32 File System• Define the Possible States of Entries in the

Linked List• Track Fragmentation in the FAT in exFAT

52© 2009-2010 J. Hamm

52© 2009-2010 J. Hamm

R. Shullich

53© 2009-2010 J. Hamm

• Locate the bitmap on an exFAT volume• Explain how the bitmap tracks allocated

clusters

53© 2009-2010 J. Hamm

53© 2009-2010 J. Hamm

R. Shullich

54© 2009-2010 J. Hamm

• A bitmap is used in exFAT for quickly determining if a cluster is available to write to or not

• This is much more efficient than parsing the link list for availability of cluster

• This can provide a quick way to determine a place to write a file to avoid fragmentation

54© 2009-2010 J. Hamm

54© 2009-2010 J. Hamm

R. Shullich

55© 2009-2010 J. Hamm

• Each cluster is tracked in the bitmap• A single bit is used for each cluster on the

volume• The value can be either

– 0 – unallocated cluster– 1 – allocated cluster

55© 2009-2010 J. Hamm

55© 2009-2010 J. Hamm

R. Shullich

56© 2009-2010 J. Hamm

• The bitmap tracks each cluster by utilizing the least significant bit in a byte to represent the allocation status of first cluster in the respective range.

56© 2009-2010 J. Hamm

56© 2009-2010 J. Hamm

R. Shullich

57© 2009-2010 J. Hamm

• For example, if only the first cluster were allocated, the bitmap would have a value of 0x01 – or 0000 0001

• If the first and eighth cluster were allocated the value would be 0x81 – or 1000 0001

57© 2009-2010 J. Hamm

57© 2009-2010 J. Hamm

R. Shullich

58© 2009-2010 J. Hamm

• Recognize exFAT Directory Entries• Understand the Three Record Types in a

Directory Entry– Directory Entry Record– Stream Extension– File Name Extension

• Locate the Starting Cluster and Size of a File• Identify Deleted Files

58© 2009-2010 J. Hamm

58© 2009-2010 J. Hamm

R. Shullich

59© 2009-2010 J. Hamm

• Directory entries are a series of 32 byte records.

• Each record has a type flag located in the first byte of the record.

• A file will have at least 3 records.

59© 2009-2010 J. Hamm

59© 2009-2010 J. Hamm

R. Shullich

60© 2009-2010 J. Hamm

60© 2009-2010 J. Hamm

60© 2009-2010 J. Hamm

R. Shullich

61© 2009-2010 J. Hamm

Directory Entry RecordTracks attributes and created, accessed and modified times.

Stream ExtensionTracks size and starting extent of the file. Also tracks the size of the filename.

File Name ExtensionThis actually contains the filename in Unicode characters.

Note: Additional records may be created and used for longer file names.

61© 2009-2010 J. Hamm

61© 2009-2010 J. Hamm

R. Shullich

62© 2009-2010 J. Hamm

OffsetHex Field Definition

x85 Directory Entry Record

x83 Volume Name Record

x82 Up-Case Table Logical Location and Size

x81 Bitmap Logical Location and Size

xC0 Stream Extension

xC1 File Name Extension

62© 2009-2010 J. Hamm

62© 2009-2010 J. Hamm

R. Shullich

63© 2009-2010 J. Hamm

OffsetHex

OffsetDec Length Field Definition

x00 0 1 Record Type x85 – Directory Entry Record

x01 1 1 Secondary Count (Number of Additional 32 Byte Records in the Entry)

x02 2 2 Record Entry Checksum

x04 4 2 DOS File Flags (Archive, Hidden, etc)

x06 6 2 Unknown (Values only on Volume Label)

x08 8 4 Created Date and Time

x0C 12 4 Last Modified Date and Time

x10 16 4 Last Accessed Date and Time

x14 20 2 10 ms Increments Added to Created and Modified Times Respectively

x18 22 3 Time Zone Offset Applied to the File Time63

© 2009-2010 J. Hamm63

© 2009-2010 J. HammR. Shullich

64© 2009-2010 J. Hamm

OffsetHex

OffsetDec Length Field Definition

x00 0 1 Record Type xC0

x01 1 1 Secondary Flags (Including NO FAT)

X03 3 1 Number of Unicode Characters in the File Name

x04 4 2 File Name Hash

x06 6 2 Reserved

x08 8 8 Initialized Size of the File in Bytes

x10 16 4 Reserved

x14 20 4 Starting Cluster of the File

x18 24 8 Logical Size of the File in Bytes

64© 2009-2010 J. Hamm

64© 2009-2010 J. Hamm

R. Shullich

65© 2009-2010 J. Hamm

OffsetHex

OffsetDec Length Field Definition

x00 0 1 Record Type xC1

x02 2 Variable File Name

Length is in Unicode Characters as Defined in the xC0 Record.

If more than one entry is necessary, the file name will continue in the next entry again starting at offset 0x02

65© 2009-2010 J. Hamm

65© 2009-2010 J. Hamm

R. Shullich

66© 2009-2010 J. Hamm

66© 2009-2010 J. Hamm

66© 2009-2010 J. Hamm

R. Shullich

67© 2009-2010 J. Hamm

Hex Binary Description

0x0001 0000 0001 Read Only

0x0002 0000 0010 Hidden File

0x0004 0000 0100 System File

0x0020 0010 0000 Archive

67© 2009-2010 J. Hamm

67© 2009-2010 J. Hamm

R. Shullich

68© 2009-2010 J. Hamm

68© 2009-2010 J. Hamm

68© 2009-2010 J. Hamm

R. Shullich

69© 2009-2010 J. Hamm

69© 2009-2010 J. Hamm

69© 2009-2010 J. Hamm

R. Shullich

70© 2009-2010 J. Hamm

70© 2009-2010 J. Hamm

70© 2009-2010 J. Hamm

R. Shullich

71© 2009-2010 J. Hamm

71© 2009-2010 J. Hamm

71© 2009-2010 J. Hamm

R. Shullich

Hex Binary Description

0x0001 0000 0001 Allocation Possible

0x0002 0000 0010 No FAT Chain in Use

72© 2009-2010 J. Hamm

72© 2009-2010 J. Hamm

72© 2009-2010 J. Hamm

R. Shullich

73© 2009-2010 J. Hamm

Unallocated records are tracked by switching one bit in the entry.Unallocated may be marked if a file name is changed – this is not exclusive to deletion.

If the first bit is “1”, then the record is in use.

If the first bit is “0”, then the record is not in use.

73© 2009-2010 J. Hamm

73© 2009-2010 J. Hamm

R. Shullich

74© 2009-2010 J. Hamm

Unu

sed

Entr

y

000000000x00

Allo

cate

d Di

rect

ory

Entr

y Re

cord

100001010x85

Una

lloca

ted

Dire

ctor

y En

try

Reco

rd

000001010x05

74© 2009-2010 J. Hamm

74© 2009-2010 J. Hamm

R. Shullich

75© 2009-2010 J. Hamm

Unu

sed

Entr

y

000000000x00

Allo

cate

d St

ream

Ext

ensio

n

110000000xC0 U

nallo

cate

d St

ream

Ext

ensio

n

010000000x40

75© 2009-2010 J. Hamm

75© 2009-2010 J. Hamm

R. Shullich

76© 2009-2010 J. Hamm

Unu

sed

Entr

y

000000000x00

Allo

cate

d Fi

le N

ame

Reco

rd

110000010xC1 U

nallo

cate

d Fi

le N

ame

Reco

rd

010000010x41

76© 2009-2010 J. Hamm

76© 2009-2010 J. Hamm

R. Shullich

77© 2009-2010 J. Hamm

• Recognize exFAT Directory Entries• Understand the Three Record Types in a

Directory Entry– Directory Entry Record– Stream Extension– File Name Extension

• Locate the Starting Cluster and Size of a File• Identify Deleted Files

77© 2009-2010 J. Hamm

77© 2009-2010 J. Hamm

R. Shullich

78© 2009-2010 J. Hamm

• Describe exFAT, what systems it’s enabled on, and explain why it was implemented.

• Identify an exFAT volume and explain the information contained in the Volume Boot Record.

• Explain how exFAT tracks fragmentation and allocation.

• Define the information contained in the directory records on an exFAT volume.

78© 2009-2010 J. Hamm

78© 2009-2010 J. Hamm

R. Shullich

79© 2009-2010 J. Hamm

Jeff Hamm, CFCEUS Department of State – Computer Investigations and ForensicsParadigm Solutions Contractorhammjd@yahoo.com248 431 8735

Robert Shullich, CPP, CISSP, CISA, GSEC, GCIH, GCFA, CEHInformation Security Officerrshullic@earthlink.netBlog: rshullic.wordpress.com

79© 2009-2010 J. Hamm

R. Shullich

80© 2009-2010 J. Hamm

June 6th, 2010 80

Sans Reading Room:http://www.sans.org/reading_room/whitepapers/foren

sics/rss/reverse_engineering_the_microsoft_exfat_file_system_33274

Microsoft Patent:Microsoft Patent 0164440 (June 25, 2009). Quick

Filename Lookup Using Name Hash.Pub No. US 2009/0164440 A1 Retrieved December 10,

2009 fromhttp://www.pat2pdf.org/patents/pat20090164440.pdf