File Systems IFAT File Systems

BACS 371Computer Forensics

File Systems(See http://www.ntfs.com)

A method for storing and organizing computer files and the data they contain to make it easy to find and access them

File System Types FAT (File Allocation Table)

FAT12 FAT16 FAT32 exFAT

NTFS (New Technology File System) Functions

Manage “free space” Allocate clusters to file Track time (MAC – Modify, Access, Create)

FAT12 & FAT 16

FAT 12 Cluster size = 512 bytes to 8 K bytes 212 addressable clusters 4096 clusters max for max volume size of 32

MB FAT 16

Cluster size 512 bytes to 64 K bytes 216 addressable clusters 65,563 clusters max for max volume size of 4

GB

A FAT file system is composed of four different sections.

The Boot Sector (aka Partition Boot Record, BIOS Parameter Block, Drive Parameter Block or Reserved Sector). This is always the first sector of the partition and includes some basic file system information (in particular, its type), pointers to the location of the other sections and the operating system's boot loader code.

The FAT Region. This contains two copies of the File Allocation Table for the sake of redundancy, although the extra copy is rarely used, even by disk repair utilities. These are maps of the partition, indicating how the clusters are allocated.

The Root Directory Region. This is a Directory Table that stores information about the files and directories in the root directory. With FAT32 it can be stored anywhere in the partition, however with earlier versions it is always located immediately after the FAT Region.

The Data Region. This is where the actual file and directory data is stored and takes up most of the partition. The size of files and subdirectories can be increased arbitrarily (as long as there are free clusters) by simply adding more links to the file's chain in the FAT. Note however, that each cluster can be taken only by one file, and so if a 1KB file resides in a 32KB cluster, 31KB are wasted.

FAT File System

Partition Boot Record

FAT 1 FAT 2 (Duplicate)

Root Directory

Other folders and all files

This is all contained within a partition. Note that the “other folders and files” component is most of the physical disk.

Partition Boot RecordAKA File System Boot Sector

Within each partition that has a file system, a partition boot record is found.

It defines the details of the file system located in the partition.

It is 1 sector long and is the first physical sector in a logical volume. C 0, H 1, S 1 for first partition. First sector (plus

partition offset) in subsequent partitions. Contains

Code File System Specification Information

BIOS Parameter Block

Executable Code• Machine Language Code• Processor Specific• Decodes BPB • Searches for OS

PBR “Signature”• 0x55AA

Partition Boot Record (PBR)

Partition Boot Record (FAT32 File

system)

010 - 210 Jump Instruction (3 bytes)

310 - 1010 OEM ID (8 Bytes)

1110 - 8310 BIOS Parameter Block (BPB)

(includes all below plus additional fields)

all offsets in this section are from start of the BPB counting from 0

offset 1110 Bytes Per Sector 2 Bytes

offset 1310 Sectors Per Cluster 1 Byte

offset 2110 Media Descriptor 1 Byte

offset 2410 Sectors Per Track 2 Bytes

offset 2610 Number of Heads 2 Bytes

offset 2810 Hidden Sectors 4 Bytes

offset 3210 Total Sectors 4 Bytes

6210 - 51110 Bootstrap Code (448 Bytes)

Ends with 55 AA

NOTE: Offsets are from start of Partition, not start of Drive!

File Allocation Table

A partition is divided up into identically sized clusters, small blocks of contiguous space. Cluster sizes vary depending on the type of FAT file system being used and the size of the partition, typically cluster sizes lie somewhere between 2KB and 32KB. Each file may occupy one or more of these clusters depending on its size; thus, a file is represented by a chain of these clusters (referred to as a singly linked list). However these chains are not necessarily stored adjacently on the disk's surface but are often instead fragmented throughout the Data Region.

The File Allocation Table (FAT) is a list of entries that map to each cluster on the partition. Each entry records one of five things: the address of the next cluster in a chain a special end of file (EOF) character that indicates the end of a

chain a special character to mark a bad cluster a special character to mark a reserved cluster a zero to note that that cluster is unused

File Allocation Table (FAT)

File Allocation Table (FAT)

The first sector in the file is found in cluster 2 in the data area of the disk.

The FAT entry in position 02 points to position 03; so the next cluster is found in 03 in the data area of disk.

This linked list continues until the ‘FF FF’ in 16 indicates the end of the file is found in that cluster.

Start at 02 Continue until 16

FAT Entry Values

FAT12 FAT16 FAT32 Description

0x000 0x0000 0x?0000000 Free Cluster

0x001 0x0001 0x?0000001 Reserved Cluster

0x002 – 0xFEF

0x0002 – 0xFFEF

0x?0000002 - 0x?FFFFFEF

Used Cluster, value points to next Cluster

0xFF0 – 0xFF6

0xFFF0 – 0xFFF6

0x?FFFFFF0 - 0x?FFFFFF6

Reserved values

0xFF7 0xFFF7 0x?FFFFFF7 Bad Cluster

0xFF8 - 0xFFF

0xFFF8 - 0xFFFF

0x?FFFFFF8 - 0x?FFFFFFF

Last Cluster in File

Directory Content

The Directory is a Database of: File names Directory names Date and time stamps (MAC)

Modify Access Create

Starting cluster number Attributes

Archive Hidden System Read Only

Located on outermost track of disk

Directory table

A directory table is a special type of file that represents a directory (nowadays commonly known as a folder). Each file or directory stored within it is represented by a 32 byte entry in the table. Each entry records the name, extension, attributes (archive, directory, hidden, read-only, system and volume), the date and time of creation, the address of the first cluster of the file/directory's data and finally the size of the file/directory.

Aside from the Root Directory Table in FAT12 and FAT16 file systems which occupies the special Root Directory Region location, all Directory Tables are stored in the Data Region.

Legal characters for DOS file names include the following: Upper case letters A-Z Numbers 0-9 Space (though trailing spaces are considered to be padding

and not a part of the file name)  ! # $ % & ( ) - @ ^ _ ` { } ~ ' Values 128-255

Directory to FAT interaction

Root Directory

FAT32

32-bit Cluster Numbers Only 28 bits actually used 228 Addressable Clusters (~ 268,435,438) Drive sizes ~ 1TB (228 clusters * 4096 Bytes

per cluster ~ 1.1TB) WinXP limited to 32GB using FAT32 Max file size in FAT32 is 232-1 bytes ~ 4GB

Long File Names “Trick”

FAT 12 and FAT 16 were limited to 8.3 file names (that is, 8 character name with 3 character suffix)

This was a significant limitation, so FAT 32 fixed it.

Phony entries are added to the Directory Tables

Entries are marked with a volume label attribute

Each phony entry can contain up to 13 UTF-16 characters (26 bytes)

Long File Names Entries

Red entries are short file name entries. Blue are for a long file name. Read the long filename entries from the bottom to the top. Note that first byte in each group of long filenames are 01, 02, 03, 04, 05, and 06 (or’ed with 40 to indicate the last segment). Filename entries have 0F in 12th byte. Directory entries have a 10 in this position (indicating a directory).

8.3 Entry

Long Name

Multiple Directory Entries for a file with a “long” filename. There are 4 entries to contain the long file name, and 1 entry to contain the complete set of file information including the “short” file name.

FAT32 Root Directory

Single Directory Entry for a file with a “short” filename.

Volume ID Directory Entry

Designates Attribute Bits• 0x08 = Volume Label• 0x20 = Archive• 0x0F = Long File Name

Advantages of FAT32 over FAT16

FAT32 offers smaller cluster sizes -> less wasted space

FAT32 systems can reallocate and change the size of the root directory

FAT32 drives can contain a copy of the boot record(s) –> less prone to failure

Allow for long file names

File System Comparisons

Criteria NTFS5 NTFS FAT32 FAT16

Operating SystemWindows 2000Windows XPVista, Win 7

Windows NTWindows 2000Windows XP

Windows 98Windows ME

Windows 2000Windows XPVista, Win 7

DOSAll versions of

Microsoft Windows

 

Limitations

Max Volume Size 2TB 2TB 2TB 2GB

Max Files on Volume Nearly Unlimited Nearly Unlimited Nearly Unlimited ~65000

Max File Size Limit Only by Volume Size

Limit Only by Volume Size

4GB 2GB

Max Clusters Number Nearly Unlimited Nearly Unlimited 268435456 65535

Max File Name Length Up to 255 Up to 255 Up to 255 Standard - 8.3Extended - up to 255

Criteria NTFS5 NTFS FAT32 FAT16Unicode File Names Unicode Character Set Unicode Character Set System Character Set System Character Set

System Records Mirror MFT Mirror File MFT Mirror File Second Copy of  FAT Second Copy of  FAT

Boot Sector Location First and Last Sectors First and Last Sectors First Sector First Sector

File Attributes Standard and Custom Standard and Custom Standard Set Standard Set

Alternate Streams Yes Yes No No

Compression Yes Yes No No

Encryption Yes No No No

Object Permissions Yes Yes No No

Disk Quotas Yes No No No

Sparse Files Yes No No No

Reparse Points Yes No No No

Volume Mount Points Yes No No No

File Names 256 Char 256 Char 256 Char 8.3 Names

File System Features

Overall Performance

Built-In Security Yes Yes No No

Recoverability Yes Yes No No

PerformanceLow on small

volumesHigh on Large

Low on small volumes 

High on Large

High on small volumes

Low on large

Highest on small volumes

Low on large

Disk Space Economy

Max Max AverageMinimal on large

volumes

Fault Tolerance Max Max Minimal Average

Criteria NTFS5 NTFS FAT32 FAT16