# File System

We know that data is stored in a digital form of series a of ‘1’s and ‘0’s.

But, in order for humans to be able to understand data and how it is organized, we need some an organizing system.

Analyzing file systems is one of the most important tasks a digital forensics investigator must be capable of doing

In order for an investigator to be able to analyze file systems, s/he needs to first understand how file systems work, and know how to interpret those blocks of 0s and 1s, into file system metadata.

Such metadata could help lead to the actual data found in files required for the investigation

So, we need a way to find data within the acquired image, and hey, why not search for deleted data within it too?

when you delete a file, all that is done, is the pointer that is pointing or tracking that file is removed and no longer there.

But, what about the data? It will stay there as long as that location where it is stored has not been used again by another file

#### FAT File System Analysis

* FAT is a very simple ,  is one of the oldest file systems used by Microsoft with their MS-DOS operating system.
* FAT uses a simple index table to track files on disks, and that is why it was named File Allocation Table or simply just FAT
* The reason that the FAT file system is studied even today, is not just because you will encounter this type of file system on devices with evidence that you need to acquire and analyze, but it is one of the easiest file systems to study and understand file systems in general.

The FAT file system has different types:

1. FAT12
2. FAT16
3. FAT32
4. Extended File Allocation Table (exFAT)

I assume you are now asking, what about those numbers we saw in the different types (12, 16, and 32)? These refer to the number of bits used for clusters addressing. Which means a 12 bit FAT can have a cluster size of 212

But what is a cluster?

A cluster, is the smallest logical unit a file system can allocate to a file. The cluster size is defined at the time you initialize the partition or volume, which means it is defined when you format the partition.

A cluster can be anything from 512 bytes, up to the limit of the file system used

**why does a cluster have the minimal size of 512 bytes?** The reason is that the minimum size of a sector is 512 bytes

* A cluster is the smallest logical unit used by file systems for file allocation, and the sector is the smallest physical unit used with disk drives.
* clusters are logical, while sectors are physical.

There are two types of formatting:

1. High Level (Logical)  initializing the disk
2. Low Level  is usually done at the manufacturer

Whenever a file is created, the file system must allocate a number of clusters to it. This is where the number of sectors per cluster is important because the cluster’s size has an impact on both the performance and utilization of the disk.&#x20;

Using a big cluster might lead to waste in disk capacity and using a small cluster could lead to an overhead!

when we say a cluster could represent a number of sectors, this means they are contiguous. In other words, these sectors follow each other, they are one after the other.&#x20;

For example, if we have 4 sectors for a cluster, then whenever you create a file, it will be allocated four contiguously allocated sectors. This helps file systems access data easily!

Let’s assume file1 has 512 bytes and file2 has 1024 bytes. The illustration below, will show how this is reflected on the disk. (Note: each green square represents a sector).

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FGnaHgjO1BkW63m6Poni4%2Fimage.png?alt=media&#x26;token=8b4ebdf4-33a8-49f7-993f-6235fe85563f" alt=""><figcaption><p> assumed there were no files previously created on the disk and that we created file1 and file2 after each other.</p></figcaption></figure>

**How many clusters could each type of FAT file system represent?**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FsPjLQYPyk7GeFqwWsysP%2Fimage.png?alt=media&#x26;token=da889a85-9883-4bfa-b8f8-e3d8190c45e9" alt=""><figcaption></figcaption></figure>

Notes:

1. RC means Reserved Clusters
2. FAT32 uses only 28 bits not 32, as four of them are reserved

#### &#x20;FAT Structures:

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F75drEUyetDvNIuXN34ZB%2Fimage.png?alt=media&#x26;token=c87e386f-25fc-4a59-b5b8-851a3f63ae9d" alt=""><figcaption></figcaption></figure>

**Reserved Area:**

The size in sectors of the Reserved Area depends on the type of FAT file system used

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F647OPHpzkTK0fP58Pqe9%2Fimage.png?alt=media&#x26;token=ac3bc99b-6217-49ec-ad2f-5f01d14e43c5" alt=""><figcaption></figcaption></figure>

&#x20;just note that the FAT Area in a FAT32 file system has two parts and not one as in FAT12 and FAT16

area depends on the type of FAT used. So, let’s check how this area is structured when we have a FAT12/16 file system

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FacpdtL4yncw7KA1FAlns%2Fimage.png?alt=media&#x26;token=892f142d-57d6-4042-a050-b66a38dfcad4" alt=""><figcaption></figcaption></figure>

As for the structure of a FAT32 file system, it is like this:

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2Fcz2GrcKaYN1OOWMKblnk%2Fimage.png?alt=media&#x26;token=9f52cf08-7e61-46ee-9eb7-8571d595c560" alt=""><figcaption></figcaption></figure>

Here is a view of the Boot Sector of a FAT32 volume using a Disk Editor.

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FBomWFUZ0APjRCssc1N0H%2Fimage.png?alt=media&#x26;token=72a6e8eb-4e7a-404f-b32e-d8b20b3bf77f" alt=""><figcaption></figcaption></figure>

If we check the 32 sectors allocated, we find:

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FdHN4Ak5vRWCK8YZ8YN7j%2Fimage.png?alt=media&#x26;token=12c2a7a7-8583-44b4-8fc0-4e8d9e4d1e53" alt=""><figcaption></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FPR8yrpMZTO9g2DdGcP7T%2Fimage.png?alt=media&#x26;token=7fcb620c-012a-4fe4-8936-503239eec0b0" alt=""><figcaption></figcaption></figure>

* &#x20;Sectors 0 and 6 are used for the Volume Boot Sector
* Sectors 1 and 7 are used for the File System Information (FSINFO) structure
* Sectors 2 and 8 are used for the Bootstrap Code
* Boot strap sectors will be empty if the volume is non-bootable, but it will still end with a signature (0x55AA).

**Boot Sector**

It will be different for FAT12/16 and the FAT32. Let’s start with the FAT12/16, which can be seen below

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FMKrsNjO7mnBgVstUcsDn%2Fimage.png?alt=media&#x26;token=54b8e2b7-72c7-414a-b3a5-b89ad923b2a2" alt=""><figcaption></figcaption></figure>

* The sizes for BIOS Parameter Block (BPB), Extended BIOS Parameter Block (EBPB), and the Bootstrap code varies based on the operating system and versions.

Below is the boot sector for the FAT32 file system.

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FJPq9r2mpaKgMW3Ta42nB%2Fimage.png?alt=media&#x26;token=46827be3-3a05-42eb-817c-d03b7f9549e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FZdl1iG9HiTI6U8Rtya9E%2Fimage.png?alt=media&#x26;token=46012510-d97b-42b0-b792-df403295523f" alt=""><figcaption></figcaption></figure>

**we will focus more on the FAT32 type only**

move another step into the BIOS Parameter Block and see how the data structures for it is used

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FOMHAz4EjGfHlJT6slkRq%2Fimage.png?alt=media&#x26;token=a6948f18-6a43-4e8c-8e6e-2f0bd619d318" alt=""><figcaption><p>Byte level dissection of the Boot sector of a FAT32 file system.</p></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F0Q3XHiO6F8aOKOT8EAOz%2Fimage.png?alt=media&#x26;token=281d9179-bc71-40a0-8cfa-1c468b4e0b6c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FHQ1rKVCvk7034ZCjj90v%2Fimage.png?alt=media&#x26;token=592f5f6f-2f64-463f-8fce-ab881c83d729" alt=""><figcaption></figcaption></figure>

* **Jump Boot Code** >> holds the command used to jump to the boot code
* In the example we used, it shows: **EB 58 90**
* **EB 58** is the byte code for the assembly instruction **jmp 005A**
* **90** is the byte code for the assembly instruction **NOP**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FJ71eUu2jwwY5vrspikHG%2Fimage.png?alt=media&#x26;token=6e68b2d0-d525-4eb1-89ed-89e61b5e4147" alt=""><figcaption></figcaption></figure>

* **OEM Name/Version** >> could hold the type of system the disk was formatted for, or the utility used, or even a serial no! In our example it holds: **MSDOS5.0**

**BIOS Parameter Block (BPB)**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FcNDFP8CQNdAT8rG6mi4L%2Fimage.png?alt=media&#x26;token=3256c027-0283-4a51-8884-50e94ac85232" alt=""><figcaption></figcaption></figure>

* **Bytes per Sector** As the name implies. We have the value 0002 that equals to 512 bytes / sector
* **Sectors per Cluster**  As the name implies. We have two sectors per cluster, based on the value found
* **Reserved No. of Sectors** Holds the number of reserved sectors. It is variable in a FAT32 file system. Also, we see here that the value FE19 equals to 6654 sectors

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FvsUn61DnnC1SObz1WoK2%2Fimage.png?alt=media&#x26;token=8d3c34e2-c661-45d7-ae79-e40fc16a69a0" alt=""><figcaption></figcaption></figure>

* **No of FATs**  Holds the number of FAT Tables.
* In our example, it holds the value 02. This means we have 2 FAT Tables

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FxPjtAU4wMdJFYzviSSaX%2Fimage.png?alt=media&#x26;token=e93da0f6-45ed-4c6c-b93a-651f6549b11c" alt=""><figcaption></figcaption></figure>

* **Number of root directory Entries** >> Holds the number of directory entries, it will be zero for FAT32.
* In the example we used, it shows: 0000

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FjcbsVgUGgk8nfqAzYYlV%2Fimage.png?alt=media&#x26;token=c40272ea-620b-4f25-80de-e9121e8956b9" alt=""><figcaption></figcaption></figure>

* **Total number of sectors in the filesystem** >>  Holds the total number of sectors in the file system. It will be zero for FAT32. In the example we used, it shows: 0000

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FJDW0kjdgCQwOV2dQXMlD%2Fimage.png?alt=media&#x26;token=abbda305-e21b-41b1-bd28-8d75b1fc01e8" alt=""><figcaption></figcaption></figure>

* **Media Type** >  Holds the media descriptor, which would be f0 for floppy and f8 for hard disk
* In our example, we found: F8.
* **No of sectors per FAT** >> Holds the number of sectors assigned for each FAT. This would be zero for FAT32. In our example we truly did find 0000.

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F8Q3jbWp9wW2Enejz0q3Z%2Fimage.png?alt=media&#x26;token=89f3e13e-79c8-49e5-a872-9b7147a30986" alt=""><figcaption></figcaption></figure>

* **Number of sectors per track** >> These 2 bytes speak for them self. We found **3F00**, which means **63 sectors/track**.
* **Number of heads** >>These 2 bytes holds the no. of heads in the drive. We found **4000**, which means we have **64 heads**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FI9xmeRrrZMNrFNMzCzQP%2Fimage.png?alt=media&#x26;token=a4fe4a62-6ebe-4a6d-98ce-89e81d1f897d" alt=""><figcaption></figcaption></figure>

* **Number of hidden sectors** >> 4 bytes holding the no. of sectors preceding the partition. Here we found: **800000**, which means we have **128** sectors
* **Total number of sectors in the filesystem** >> 4 bytes holding the total no. of sectors in the file system. The no. found was **00200300** which means we have **204800** sectors. And, we can say this partition is **104857600** bytes or **102400** Megabytes **(\~100MB).**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FhwQYBueIsbcWMUJ8voDX%2Fimage.png?alt=media&#x26;token=f5f18bb3-d2ce-4748-8e5d-43f718d6694b" alt=""><figcaption></figcaption></figure>

* **Sectors per FAT** >> 4 bytes holding the no. of sectors in each FAT. We found **01030000** which means we have **769** sectors per FAT; remember these bytes\
  \\

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F1KiwajTg9R8uWn2YFKui%2Fimage.png?alt=media&#x26;token=4036456b-31aa-4235-b517-f580b205df49" alt=""><figcaption></figcaption></figure>

* **Extended flags** >> \
  2 bytes holding the no. of active FAT. In our example we have **zero**, which means: • Bits 0 – 3  no. of active FAT (if bit 7 is 1)\
  • Bits 4 – 6 reserved \
  • Bit 7  one means we have a single active FAT, zero means all FATs are updated at runtime \
  • Bits 8 – 15  reserved

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FQJ3bA3RxEHNITbTXKUK2%2Fimage.png?alt=media&#x26;token=2a7fc3d6-c2d8-4d47-8223-4d768e00ef18" alt=""><figcaption></figcaption></figure>

* **Filesystem Version** >> 2 bytes holding FAT file system version. We found 0000
* **First cluster of root directory** >> 4 bytes holding the cluster number of the first cluster in the root directory. This is usually **two**, and in our example, we found **02000000 which is two**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FU0jd3cBWm8OVIQYY8SXv%2Fimage.png?alt=media&#x26;token=b1b6135c-b74a-46cc-921a-7e9a925d2f52" alt=""><figcaption></figcaption></figure>

* **File** **System Info. Sector >>** 2 bytes holding the filesystem information sector number in FAT32 reserved area, which is usually 1. In our example it was **0x0100, meaning it’s one**

* **Backup boot sector location** >> 2 bytes holding the backup boot sector location. The value found would be either **0 or 0xffff** if no backup used, but it is usually **6. We found 0x0600**, meaning the backup is found at sector no. **six**\
  \\

  <figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FPwzyU2Y56W27o1vnJIDB%2Fimage.png?alt=media&#x26;token=041ed600-c073-4bc3-b7fe-528b1ae5d2a1" alt=""><figcaption></figcaption></figure>

* **Reserved** >> 12 bytes that are simply just reserved. They will be all zeros, and we truly found **0x000000000000000000000000** that in our example.\
  \\

**Extended BIOS Parameter Block**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FzI9MNGOgsCyWoBZ10qsp%2Fimage.png?alt=media&#x26;token=e8e0e2ef-e479-46b2-99ee-6d03f6c72aa1" alt=""><figcaption></figcaption></figure>

* **Phys Disk No** >> 1 byte holding the physical drive no. used by the INT 13. We found **0x80, meaning 128**
* **Not used** >> 1 byte reserved and not used. We found **0x00**
* **Signature** >> 1 byte indicating there are three other sections to follow (check the next slide). **We found 0x29, which means 41**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FMXYIAwTa8anpd3WeGZ2d%2Fimage.png?alt=media&#x26;token=448bc5ab-1c0e-4506-bc48-d2e883e01ef8" alt=""><figcaption></figcaption></figure>

* **Volume Serial Number (ID)** >> 4 bytes holding the serial no. of the partition/volume. We found **0x9B2CF1EC.**
* **Volume Label** >> 11 bytes holding the volume label. We found **0x4E4F204E414D4520202020**. which means we found the label “**NO NAME**”.

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FyJoS6BnmsW3M60y8srhD%2Fimage.png?alt=media&#x26;token=00ee5a99-c4c4-4a40-818d-d050ac3a9e90" alt=""><figcaption></figcaption></figure>

* **File System ID** >> These final 8 bytes hold the file system type. Here we found **FAT32**\
  \\

**FSINFO Sector**\
\\

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2F1UODVjQjGQXczRWLp0gA%2Fimage.png?alt=media&#x26;token=a5b4e316-2916-42af-8173-e9c48816d247" alt=""><figcaption></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FygCjxqQxCsAvppdYgM6a%2Fimage.png?alt=media&#x26;token=c0928998-d8fa-4af6-b928-08cb1e10499b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FoatX8DH3nEcgmPa3RMxf%2Fimage.png?alt=media&#x26;token=d0b5bd42-0317-4bba-9eea-e7df4d7595e4" alt=""><figcaption></figcaption></figure>

Details found with explanations: \
• FSInfo signature 0x52526141 >> **RRaA** \
• Second signature 0x72724161 >> **rrAa** \
• No. of free clusters 0x155C0100 >> **89109**\
&#x20;• Next free cluster 0xED230000 >> **9197**

Let me explain the No. of free clusters in the next slide a little bit further for you.

the no. of free clusters found was 0x155C0100. This is a little endian value, so we must translate it first in order to calculate the final value properly. With that done, we get 0x00015C15. Now if you translate this hexadecimal value to decimal, you will find that this leads to 89109 of free clusters.

But hey, we’re not finished yet! How many free bytes do we have here? Multiplying this value with 512 bytes is wrong! You must first check how many sectors per cluster

Now, if we go back to the Boot Sector of this partition, we will find at offset **13** the value 02. Which means we have two sectors per cluster.\\

So what we need to do is first multiply the number 89109 with 2, and this gives us 178218, which refers to the number of free sectors.

And, just to make sure that our calculations are accurate, let’s multiply this with 512 (size of sector in bytes), which was found at offset 11 (2 bytes). We get the number 91247616 bytes.

\
we were accurate with our calculations

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FXJmvPHvI7Y1OSn8b6GZv%2Fimage.png?alt=media&#x26;token=97e5ebbc-58fb-4e37-aa08-bafd77a03a1e" alt=""><figcaption></figcaption></figure>

**Boot Strap Sector & Reserved Sectors**

<figure><img src="https://112995299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCoWdw146aE54Q0fpM5VM%2Fuploads%2FR4jUAmHBI9tfba4OsjtL%2Fimage.png?alt=media&#x26;token=dced7e52-d041-42bc-85b3-666f196920b6" alt=""><figcaption></figcaption></figure>

There isn’t much to be said about the Boot strap sector, as it has nothing useful. But, the sector does end with the end of sector signature **0x55AA**

After that comes the reserved sectors, which are usually all **zero**
