FAT Structure

File Allocation Table (FAT) File Systems

Used with all flavors of Windows Supported by all Windows and UNIX varieties Used in flash cards and USB thumb drives

The FAT Family

FAT12, FAT16, FAT32
12, 16, and 32 are the number of bits used in the FAT for cluster addresses

Sectors
The sector is minimum data storage unit
A sector is usually 512 bytes A sector is the minimum size read from, or written to, a disk A sector is the minimum I/O unit This is a HW thing

Clusters
Files are allocated space in clusters
A cluster is a fixed number of sectors
Must be a power of 2 (1,2,,64,)

A cluster is the minimum file allocation unit This is a SW/OS thing

Cluster sizes for FAT

Slack
Slack is the space allocated to a file, but unused
Space at the end of a sector that remains unused by the file Sectors allocated to the file that the file hasnt yet used

Slack space often contains useful evidence

Unused bytes in an allocated sector are less useful Unused sectors in an allocated cluster retain their original contents and are very useful

Unallocated Clusters
When a file is deleted its allocated clusters become unallocated Many clusters on a modern hard drive are unallocated Unallocated clusters may have been allocated earlier though
These clusters retain their data until they are reallocated to a new file Deleted files are still recoverable!

Cluster Allocation Algorithms

First available Best fit Next available

Partitions Review
The drive is partitioned Each extended partition has its own partition table Each non-extended partition is referred to as a volume Each volume has a volume boot record or a boot sector Recovery tools can often find data even if the disk was repartioned
Sectors ending in 0x55AA

DOS Disk

Partition 1

Partition 2

Master Boot Record Including Partition Table & Signature

Creating a File System

High-level formatting creates file system data structures
Boot sector Cluster allocation File Allocation Table (FAT) $Bitmap in the Master File Table (MFT) for NTFS Exact details depend on operating system Root Directory

FAT Partition
Starting LBA from partition table Reserved Area FAT Area Directories and Files

VBR

Measured in Sectors First Cluster of FAT File System

Measured in Clusters

FAT12/16 Reserved area is one sector, the Boot Sector or Volume Boot Record FAT32 Reserved area contains many sectors, VBR, FSINFO sector and a backup VBR

VBR Layout
02 3 10 11 12 13 13 14 15 16 16 17 18 19 20 21 21 22 23 24 27 28 31 32 35 Assembly instruction to jump to boot code OEM in ASCII Bytes/sector (512, 1024, 2048, 4096) Sectors/cluster n where n <= 32K and is a power of 2 Size in sectors of reserved area Number of FATs Maximum number of files in root dir. FAT16 typically 512, 0 for FAT32 Number of sectors in file system. If not big enough set to 0, a 4 byter is coming soon Media type: MS states 0xf8 for fixed disks and 0xf0 for removable 16-bit size in sectors for each FAT in FAT12/16 0 for FAT32 Number of sectors/track and heads Number of sectors before start of partition Number of sectors in the file system Essential if a boot partition No Yes Yes Yes Yes Yes Yes No Yes No No Yes

VBR Layout (cont)

FAT12 and FAT16
36 36 37 37 38 38 BIOS INT13h drive number Not used Extended boot signature to identify if the next three values are valid. Signature is 0x29 39 42 Volume serial number 43 53 Volume label in ASCII 54 61 File system label in ASCII, FAT, etc. 62 509 Not used 510 511 Signature value, 0xAA55 Yes No No No No No No

VBR Layout (cont)

FAT32
36 39 40 41 42 43 44 47 48 49 50 51 32-bit size in sectors of one FAT. Defines how multiple FAT structures are written to. Major and minor version number. Cluster where roor directory can be found. Sector where FSINFO structure can be found. Sector where backup boot sector can be found (usually 6) 52 63 Reserved 64 64 BIOS INT13h drive number 65 65 Not used 66 66 Extended boot signature to identify if the next three values are valid. Signature is 0x29 67 70 Volume serial number 71 81 Volume label is ASCII 82 89 File system label in ASCII, FAT, etc. 90 509 Not used 510 511 Signature value, 0xAA55 Yes Yes Yes Yes No No

No Yes No No No No No
No

Reference
http://www.dewassoc.com/kbase/hard_drives/boot_sector.htm

FAT32 FSINFO
03 4 483 484 487 488 491 492 495 496 507 508 511 Signature 0x41615252. Not Used Signature 0x61417272 Number of free clusters Next free cluster Not used Signature 0xAA550000 No No No No No No No

Start of Data
Cluster address of start of data is 2
Microsoft mandated no Cluster 0 or 1 addresses

LBA Address of the first cluster of the data area

Start of Partition + Reserved Area + # FATS * FAT Size

LBA of root directory

File Allocation Table

FAT
Cluster Entry 000 001 002 003 004 072 000 004 072 FFF
end of file
MS says nothing in the first 2 clusters.

not allocated next cluster next cluster

Data Area
Root Directory Reserved Area FAT Area Directories and Files

Data Area

FAT Directories
00 1 10 11 11 12 12 13 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 31 First character of file name in ASCII. 0x5e or 0x00 if unallocated Characters 2 11 of file name in ASCII. File attributes Reserved Create time (tenths of second) Create time ( hours, minutes, seconds) Create day Access day High 2 bytes of first cluster address (0 for FAT12/16) Write time (( hours, minutes, seconds) Write day Low 2 bytes of first cluster address from start of data area Size of file (0 for directories) in bytes Yes Yes Yes No No No No No Yes No No Yes Yes

The period is not included in the short name (fixed format.)

File Attributes

Flag Value 0000 0001 = 0x01 0000 0010 = 0x02 0000 0100 = 0x04 0000 1000 = 0x08 0000 1111 = 0x0f 0001 0000 = 0x10 0010 0000 = 0x20

Description Read only Hidden file System file Volume label Long file name Directory Archive

Essential No No No Yes Yes Yes No

FAT Directories
00 1 10 11 11 12 12 13 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 31 First character of file name in ASCII. 0x5e or 0x00 if unallocated Characters 2 11 of file name in ASCII. File attributes Reserved Create time (tenths of second) Create time ( hours, minutes, seconds) Create day Access day High 2 bytes of first cluster address (0 for FAT12/16) Write time (( hours, minutes, seconds) Write day Low 2 bytes of first cluster address from start of data area Size of file (0 for directories) in bytes Yes Yes Yes No No No No No Yes No No Yes Yes

The period is not included in the short name (fixed format.)

Create Time (bytes 14 & 15)

Byte 15 Bit Byte 14

15 14 13 12 11 10
0x53 0 1 0 1 0 0

4
0xf6

Data hex
Data binary

Hour

Minute

Second

Hour Minute Seconds Seconds

= = = =

010102 = 0x0a = 10 0111112 = 0x1f = 31 101102 = 0x16 = 22 (2 second intervals) 44

FAT Directories
00 1 10 11 11 12 12 13 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 31 First character of file name in ASCII. 0x5e or 0x00 if unallocated Characters 2 11 of file name in ASCII. File attributes Reserved Create time (tenths of second) Create time ( hours, minutes, seconds) Create day Access day High 2 bytes of first cluster address (0 for FAT12/16) Write time (( hours, minutes, seconds) Write day Low 2 bytes of first cluster address from start of data area Size of file (0 for directories) in bytes Yes Yes Yes No No No No No Yes No No Yes Yes

The period is not included in the short name (fixed format.)

Create Date (bytes 17 & 16)

Byte 17 Bit Byte 16

15 14 13 12 11 10
0x32 0 0 1 1 0 0

4
0x81

Data hex
Data binary

0 Day

Year (From 1980)

Month

Year = 00110012 = 0x19 = 25 (+ 1980) = 2005 Month = 01002 = 0x04 = April Day = 000012 = 0x01 = 1

Long File Names

00 Sequence number of the LFN structures Last structure is ORed with 0x40 Deleted is 0xe5 First 5 (Unicode) file name characters. File attributes (0x0f) Reserved Checksum Characters 6 11 (Unicode) Reserved Characters 12 13 (Unicode) Yes

1 10 11 11 12 12 13 13 14 25 26 27 28 31

Yes Yes No Yes Yes No Yes

The period is included in the long file name.

Long File Names

http://www.ntfs.com/fat-filenames.htm

((0x3E + 0x20 + 0x2*0xEDF) + 0x2*8)*0x200 Root Directory

Deleting a FAT File

Deleting root\file1.txt

1. Read Fat Boot Sector (sector 0 of the volume) to understand structure and location of Reserved, FAT, and Data areas 2. Locate file1.txt in the Root Directory to determine its starting cluster 3. Set FAT entries for file1.txt to 0 4. Change filename to ile1.txt in root directory
Set first character to 0xE5 or 0x00

Directory and FAT

Existing File
Directory
First cluster used by file
000 001 002 file1.txt file2 file3 file4 O2C 02C

FAT

0 0 F 2 2 F D E F

02D
02E

Directory and FAT

Deleted file
FAT

Directory
First cluster used by file

000 001 002

ile1.txt file2 file3 file4

O2C 02C

0 0 0 0 0 0 0 0 0

02D
02E

Deleted File Recovery

All Cluster Pointers in the FAT are gone!

Get the first cluster from the directory entry Get size from directory entry Calculate the number of clusters allocated to the file, n.
Option 1 Grab the next n-1 consecutive clusters. Call it the file. May have allocated or unallocated clusters from other files. WinHex uses this option. Option 2 Grab the next n-1 unallocated clusters using the FAT. Call it the file. May have unallocated clusters from other deleted files. EnCase uses this option.