FAT Examination

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *

Already have an account? Sign In »

4 hours
Video Transcription
welcome to everyday did your forensics. I'm your host just then you said. And today we're gonna examine the fact that system
before we proceed, how many different flavors of fat file system exist?
We have three flavors. 12 16 32 If you're come from video 2.3,
we went over the different flavors. This is 12 16 32 which very bike cluster size.
If a fat loss system becomes corrupt, is there a back up?
And if so, where
there is a backup? And it's the fact to which just a duplicate of the original fat system. And in today's objective, we're gonna examine snippets of a fat ball system, including the boot sector fat one, in fact, to
root directory and a long founding
these or similar images to the end of 2.3.
I recommend having a physical or a digital copy of the following slights. In case you'd like to examine a little further
in this slide, we're going to review the boot sector. The primary boot sector contains information that a file system uses to access the volumes there. Some systems where the master boot record uses the primary boot record on the system partition to do with the operating system. Kernel falls. So this is just telling into the computer How does how it turns on
information on where to Rita files, Where does things and where can he find the memory spaces?
Right now, you may just see a bunch of numbers and zeroes
on this side is the offset. So this is the memory space, these air, how many bites and memories? So for each, there's about 16.
The information you see here is part of the primary boot sector. This isn't the whole boot sector because we don't see the final
end of a sector mark. So how do you read this like, what do these numbers mean? So they're broken up by bites. The 1st 3 bites are drunk instructions. The following eight bytes include the name and tex you may not be able to see and askyb, but once this is converted, it gives you the name of
it, gives you the name off the O am.
Falling 25 bites
is the bio parameter that you have the extended bios parameter and the bootstrap is no end sector mark.
But if there was you would see a 5555 A Next is thief at one in front to you have the defining of the last close down and file. What you see here are addresses
these air address civil files. So 99 0 a
tells us that a file is in this location. You do the same thing for the next 104000000 you know, and at a memory space, 04 is where this values file. And if you see nothing but zeros, that means that the location is available since this is three offset off fat one
into fat, too.
You see that the file system is not for you, so it hasn't reached the end of us.
Now that's examine the root directory In the root directory. You have your 1st 8 bytes, which is the founding padded with spaces. So if you see 20
that is a value for a space. Part of it is the file extension. So this tells you what the follow is. This is an attribute. Your next one bit is a reserve value. Your next one bit is milliseconds of a timestamp. You have time fire was created. Date fire was created. Date fire was us access.
Hi. Word of files. First cluster
time of last, right date of last, right? No word of files. First cluster and the file sizes cluster.
So this is an example of a loan filing. This fire was purposely given a long name to give this example as you consume. So this image shows the contents of a root directory with two which are the red short found name entries reading from the bottom to the top. In the long entries,
which is true,
you can see that the founding this entry is a very long found name. Do you see how it's put together? This is actually a directory. The attributes of a long founding is the value of 46 when the attribute of 10 is three attributes first short entries after the first blue block, where you're kind of defining that it is a long five attributes.
You go and you can see this one bit that's been highlighted
is the entry order number in the sequence of a long directory entry. If you look at the block blow, you have 432 and one thes air, the first bites of a long entry me so breaking down each of these sections. Your first bit is the order in the sequence of a long directory. Your next hand is a long directory. Name
is restricted to the 1st 1 to 5 characters.
It's in Unicode, and the small next value is thief. Fire attribute. Then you have the type of the type of zero. This is a sub component of a long name. Then you have the check some of the short frowning. You have a 12 bit long directory name characters from 6 to 11 once again in Unicode and small Medium your next. It's just
two bites that must be zero to be compatible with. The first cluster entry of his small directories
and then your Last four Bites is a long directory entry name,
typically the characters from 12 to 13. Once again, they are in Unicode and small median. So in summary, today's lecture we examined simp. It's of the fat follow system, including boot sector, your fat one, you fat to the Root Directory and the long founding. I hope you enjoyed today's video and I'll catch on the next one
Up Next