1
Q
FAT
A
- File Allocation Table
- Used for MS-DOS
- Simple index table to track files on disks
- Still the default file system for USB thumb drives and memory cards used with cameras
- used on the EFI booting partitions
2
Q
What are the different types of FAT
A
- FAT12
- FAT16
- FAT32
- Extended File Allocation Table (exFAT)
3
Q
What does the number in FAT stand for?
A
- refers to the number of bits used for clusters addressing
- 12 bit FAT can have a cluster size of 2^12
4
Q
Cluster
A
- smallest logical unit a file system can allocate to a file
- defined when you format the partition
- starts at 512 bytes, up to the limit of the file system
- clusters are logical
5
Q
What are the two types of formating?
A
- High Level (logical) -> initializing the disk
- Low Level -> usually done at the manufacturer
- “formatting” in this course is High Level
6
Q
What are the 3 “areas” of a FAT file system Structure?
A
- Reserved Area
- FAT Area
- Data Area
7
Q
How many Reserved Sectors are there for each type of FAT in the Reserved Area?
A
- FAT12 = 1 Reserved Sector
- FAT16 = 1 Reserved Sector
- FAT32 = 32 Reserved Sectors
8
Q
What is in the Reserved Area of both FAT12 and FAT16?
A
- the entire singe Sector is the Boot Sector
9
Q
What is in the Reserved Area of FAT32?
A
- Boot Sector
- FSINFO
- Boot Strap
- Reserved Sectors
- remember, 32 total sectors in the Reserved Area
10
Q
How do you find FAT#1?
A
- Go to the boot sector
- Check the value in the “Reserved No. of Sectors” section
- Go to that sector value found in (2) leads to FAT#1
11
Q
How do you find FAT#2?
A
- Go to the boot sector
- Check the value in the “Reserved No. of Sectors” section
- Check the value in the “Sectors per FAT” section
- Adding value found in (2) with the value found in (3), leads to the location of FAT#2
12
Q
Where is the Root Directory located?
A
- the Root Directory of the file system is located in Cluster #2
13
Q
What happens when a file is deleted?
A
- the system changes the first character in the file name to 0xE5
- the cluster entries for the file in FAT are all zeroed out
- the starting cluster in the directory entry is left as it is
- the contents of the file ( in clusters ) still exist on the disk (until their clusters are used again).
14
Q
What is Journaling in NTFS
A
- the file system uses a log file ($LogFile) to store all metadata changes
- helps with recovery
15
Q
What is a key difference with NTFS vs. FAT
A
- based on files and not on dividing the volume into separate spaces
16
Q
File carving
A
- forensic technique that recovers files based merely on file structure and content from raw data
- EX: recover deleted file from unallocated disk space
17
Q
TSK
A
- The SleuthKit
- collection of CLI tools to help analyze disk images and recover files
