What is a File System
A set of structures that is used to control how information is stored on a disk
Without a file system, no idea when one information ends and the next begins
Common File System types
Hard Disk, Optical Disk, Tape Drive / Magnetic Tapes, Network FS: file systems accessed over the network, files distributed throughout the network (mapped network drive), ensure user does not realize it is a form of network
User FS: file systems which exist temporarily in user space, dynamically on the fly and maintained in RAM
What are some HDD file system types
- FAT: early Microsoft file system, nearly every operating system supports it
- NTFS: new technology file system, introduced in Windows NT, standard FS on windows machines
- ReFS: resilient file system, new file system for Windows,
- EXT: standard on linux machines
- HFS/APFS: hierarchical file system, apple file system
- Optical: ISO 9660, universal disk format (UDF)
- Flash: Overlay FS, LogFS, F2FS
- Tape: Linear tape file system
-Network: NFS (network file system), SMB
Describe a FAT file system
FAT - File Allocation Table
FAT12: 1980
FAT16: 1984
FAT32: 1995 - 2^28 of max space
What are the components of a FAT file system
Boot Sector - beginning of partition / contains information on disk geometry (# sectors/cluster)
Root Directory - for every file/folder the RD contains metadata for the file and pointer to beginning of files content
FAT1 &2 - copies of the FAT, which shows which shows the clusters a file occupies
What is the structure of a FAT file system
- Boot Sector: Sector 0
- FAT 1: Begins at the Number of Reserved Sectors
- FAT 2: Reserved Sectors + Num sectors / FAT
- Root Dir: FAT 2 start + Num sectors / FAT
- Data Area: Root Dir start + (32 bytes * Number of files in root directory)
How can you examine the Boot sector to understand the FAT structure
Number of reserved sectors: 0x0E -> 0x0400 -> (LE) -> 0x04 = 4 sectors, FAT 1 starts at sector 4
Number of sectors in FAT structure: 0x16 (2 bytes) -> 0x2000 -> (LE) 0x20 = 32 sectors in FAT
Max number of entries in root directory = 0x11 (2 bytes) = 0x0002 -> 0x0200 -> 512 entries in root directory
Each entry is 32 bytes in length in root directory - true for all FAT boot sector
512 entries * 32 bytes / entry = 32 sectors
Data Area starts at sector 100 (68 (end of FAT2) + 32 (size of root directory))
How to create a file in FAT
- Locate root directory / FAT from Boot Sector
- Locate dir1’s starting cluster in the root directory
- Add entry to dir1 for file1.txt (add metadata)
- Find an area of unallocated space in FAT
- Set the starting cluster in the directory entry
- Add the correct chain to the FAT table
Explain how to delete a file in FAT
- Locate Root Directory / FAT in Boot Sector
- Locate dir1 in Root Directory, get starting cluster
- Find file 1 entry in dir1 cluster
- Set FAT entries for file 1 to 0
- Change first character of filename to 0xE5
- Metadata is there, just clusters are flagged as unallocated
Explain how to rebuild a File / Directory in FAT
- Locate root directory and FAT using Boot Sector
- List all files in Root Directory
○ Check each file’s attributes
○ If directory, extract contents of directory using starting cluster and FAT - Interpret directory like its root directory
What are the benefits of exFAT
Larger volumes, files, number of files
What is the file structure of exFAT
Main region Boot (volume boot record and boot code)
Backup Boot region (backup of VBR)
FAT Region (FAT 1 and FAT 2)
Data Region (Data area)
Where is the Boot Sector located in exFAT
Sector 0, Backup copy stored in sector 12
All data stored in LE unless otherwise stated
Parse the following exFAT Boot Sector
eb76 9045 5846 4154 2020 2000 0000 0000
Value in hex is 2 to the power of number in hex (i.e. 0x05 = 2^5)
- Bytes in each sector:0x09 = 2^9 = 512 bytes per sector
- Sectors in each cluster: 0x03 = 2^3 = 8 sectors
- # of FATs: 0x01=1 = 1 number of FAT
- FAT 1 begins: 0x50 = 0x80000000 (LE) = 0x80 = 128 sector
- FAT Length: 0x54 = 0x80000000 (LE) = 0x80 = 128 sectors in each FAT
- Data region starts at end of FAT, only 1 FAT with length 128 that starts at sector 128
- Data Region: 128 +128 = 256
- Cluster of Root Directory: 0x60 = 0x05000000 (LE) = 05 = starts at cluster 5
How can you rebuild a directory structure in exFAT
Access the Root Directory
Extract all file / file name entries
Check file’s attributes
- if its a file, list the name
- if its a folder, extract contents and process each extracted directory / file name repeating above steps
Explain the HFS+ file system structure
Reserved Area ( 2 sector area letting operating system know its a GPT partition)
Volume Header (boot information)
Allocation Block/Data Area (Allocation File, Catalog File, Extents Overflow File, Attributes File)
Copy of Volume Header (for redundancy checks)
Reserved Area
What is the Allocation area in HFS
area between volume headers
What is the Allocation File in HFS
provides block allocation bitmap of files on file system (bitmap in NTFS)
What is the Extent Overflow File in HFS
if file has more than 8 extents of data, this will be used to store remaining contents of file
What is the Catalog File in HFS
Similar to MFT in NTFS, record for every file and folder on FS, each file/folder is identified by CNID, stores metadata, and first 8 extents of file
Explain the features of APFS storage
Containers - stores logical volumes
Space Sharing - allows volumes to reside in same container and share free space
Snapshot - Copy of file system at a specific point
Encryption options - none, volume disk encryption, or multiple key encryption
What are some features of HFS File / Folder Names
Can hold up to 255 characters
Names are case sensitive
Data is stored in extents (similar to run lists, can be fragmented)
Files/Folders identified by CNID (Catalog Node ID)
