1. FAT File System

2. Overview History and Usage Structure Forensic Notes about FAT volumes
In Class Problem

3. History and Usage FAT - File Allocation Table
FAT8, FAT12 FAT16, FAT32, exFAT, vFAT (Extension to regular FAT*)
Developed in 1977 by Microsoft Corporation
Originally intended to be a file system for the Microsoft Disk BASIC interpreter, it was incorporated into MSDOS after Microsoft purchased the rights to QDOS (Quick and Dirty Operating System).
Commonly used by removable media (Originally for floppy disks).
Used for hard disks up until Windows XP (DOS, 95, 98, ME).
Supported by many Operating Systems

4. Structure
Boot Sector - Execution is passed from the MBR to the Boot Record contained here. Executable code as well as the OEM identifier, number of FATs, media descriptor (type of storage device), information about the OS to be booted.
FAT #1 and #2 - Keeps track of the allocation status of clusters (allocated, unallocated, end of file, bad sector). Usually FAT#2 is a mirror of FAT#1 to provide redundancy but this can be turned off.
Root Directory - Contains an entry for each file and directory stored in the file system. Includes information like the file name, starting cluster number, and file size. The root directory has a fixed size of 512 bytes (For a hard disk). Usually right after the FATs but with FAT32 it can be anywhere on the partition.
Data Region - Where the files are actually stored.

5. File Systems - FAT Structure
Boot section
More reserved sectors (optional)
FAT #1
FAT #2
Root directory (FAT 12/16 only)
Data region (remainder of disk)

6. Structure Root Directory Entry
Name (8.3) xxxxxxxx.yyy. (88 bits) (Unicode String)
Attribute byte (8 bits of information, Type of entry (sub_dir, volume, etc.), is it an archive,system, hidden, read-only)
One reserved byte.
Create time (24 bits).
Create date (16 bits).
Last access date (16 bits).
Two reserved bytes.
Last modified time (16 bits).
Last modified date (16 bits).
Starting cluster number in the file allocation table (16 bits).
File size (32 bits).

7. FAT Entry
Each type of FAT file system has a different size for each entry.
Each entry contains one of five things
the cluster number of the next cluster in a chain
a special end of cluster-chain (EOC) entry that indicates the end of a chain
a special entry to mark a bad cluster
a zero to note that the cluster is unused

8. FAT Entry vFAT or Long Name FAT
Multiple Entries in the directory structure
Conventional small file name for backward compatibility with extra attributes to point to the other parts of a file name
13 bytes per directory structure entry

9. File Systems - Fat Structure
Fragmentation Issues and File Slack Space
File1.txt
0002
File2.txt
0005
File3.TXT
0007
Address 1 2 3 4 5 6 7 8
Value
0003
0004
FFFF
0006
0008

10. FAT Entry Recovering from slack space
blkls –s imagefile.dd > imagefile.slack #grab all slack from image and output it. By default outputs all unallocated data
icat -r -s disk.img <inode> #recover file including data in slack space. -s parameter

11. Forensics Notes About FAT
Time (Sleuthkit)
Each file in FAT can store up to three times (last accessed, written, and created). The last written time is the only 'required' time and is accurate to a second. The create time is optional and is accurate to the tenth of a second (Note that I have seen several system directories in Windows that have a create time of 0). The last access time is also optional and is only accurate to the day (so the times are 00:00:00 in The Sleuth Kit).

12. Example
Parsing FAT32 root directory structure

13. Questions?

14. Relevant Links
file-system