解密微软扩展FAT文件系统(exFAT)：数字取证指南

5星 · 超过95%的资源需积分: 16 40 浏览量更新于2024-07-20 收藏 1.52MB PDF 举报

本文档深入探讨了Microsoft的Extended File System (exFAT)，这是一种专有的文件系统，随着技术的进步和移动存储设备容量的扩大，被设计用于满足更快的数据访问速度和更大的存储需求。exFAT首次出现在微软的最新操作系统中，并且将被支持在新一代的Secure Digital Extended Capacity (SDXC) 存储介质上。由于该文件系统的封闭性和微软对其知识产权的控制，关于其内部结构的公开资料相对较少。作者罗伯特·舒利奇（Robert Shullich）通过逆向工程分析了exFAT，揭示了这个系统的工作原理和组织结构，这对于数字取证调查至关重要。由于在进行完整和适当的电子取证时，需要了解文件系统的具体细节，这篇论文的目的是帮助法医专家和技术人员更好地理解和解析exFAT，以便在处理涉及此类存储设备的案件时提高效率。文中详细讨论了以下几个关键知识点： 1. 背景与需求：随着存储技术的发展，旧有的文件系统如FAT和FAT32无法满足大容量和高速存储设备的需求。因此，微软开发了exFAT作为应对这一挑战的新解决方案。 2. 特性与目标：exFAT的特点包括支持大文件、更长的文件名、更多的簇（分配单元）数量，以及更好的性能优化，特别是对于闪存等非连续读写媒体。 3. 专利性质与许可：由于是微软的专有技术，使用exFAT需要获得微软的授权，这意味着开发者和用户可能需要遵循特定的许可协议。 4. 内部结构揭秘：论文揭示了exFAT的文件目录结构、簇管理、簇链表、簇分配表等核心组件的工作方式，这对于理解数据存储和检索机制至关重要。 5. 应用领域：exFAT适用于广泛的应用场景，包括移动设备（如智能手机、平板电脑）、USB闪存驱动器、SD卡和其他外部存储设备。 6. 取证意义：对于数字取证专家而言，掌握exFAT的内部构造有助于恢复丢失的证据，定位潜在的隐藏数据，以及评估数据完整性。 7. 分类与主题描述：这篇论文被归类为操作系统中的存储管理和文件系统部分，具体涉及到了存储管理的次级存储以及操作系统对文件系统的处理。本研究为那些处理exFAT存储设备的法医分析、数据恢复和信息安全专业人士提供了一把解读exFAT系统内部运作的钥匙，使得他们在面对这类新型存储设备时能更加得心应手。

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

DRAFT

Figure 1 Disk Properties of exFAT file system using Windows XP without exFAT support

There is no information displayed and the operating system indicates that the file system

is RAW. Forensics examination is usually performed using either open source tools or

commercial tools. Two of the most widely used commercial forensics application tools

are EnCase by Guidance Software (http://www.guidancesoftware.com/) and the Forensics

Tool Kit (FTK) by Access Data. (http://www.accessdata.com/) (Carlton, Gregory H

(2008)). These tools are used on Microsoft Windows operating systems. Currently

Microsoft Windows 7 was just released in October 2009, but the two predecessor desktop

operating systems are Windows XP and Windows Vista.

However the Microsoft Vista operating system has always seen a resistance of users to

migrate from XP to Vista. (Carvey, Harlan (2005)) (Larkin, Eric (2007)) This leaves

many users in the field using these tools on Windows XP, and a large user base of these

applications are law enforcement or organizations with internal forensics response teams.

What does a forensics examiner on a Windows XP machine do when confronted with

storage media that the operating system won’t recognize? Or even when trying to

perform a simple directory command as shown in Figure 2 below (Don’t do this with

evidence without using write blockers).

Figure 2 Dir command on Windows XP system without the exFAT drivers

Using Windows Explorer instead, opening the exFAT formatted media on a system that

doesn’t have exFAT support may result in this message:

RobertShullich

1/5/2010 10:57:18 PM

T:\exFAT Project 2010-01-04 10-00 am\Reverse Engineering the Microsoft Extensible File System Recovered.doc

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

DRAFT

If there is digital evidence to be found, will someone take time to look for it? If storage

media is collected, and brought to a digital forensics lab, what will happen to it? If the

technician at the lab inserts the media in a system and tries to image it, will they bother to

continue if the operating system reports back that the media is RAW or corrupt? Will

they even be able to acquire an image? Or, will the storage media just get bagged and

tagged and added to the evidence pile and never processed?

Suppose the forensics examiner get past that, and manages to acquire the image and at

least do some analysis by carving out pieces and analyzing them. What position does this

leave the results of a forensics examination when digital evidence has been uncovered

and extracted, especially if that evidence is to be used in court?

When examining the expert witness, the tools and the technology will be put through the

Daubert guidelines (Daubert v. Merrell Dow Pharmaceuticals). For a file system

analysis, procedures that will be scrutinized are those that are used to break one large file

system image into the smaller components such as files. (Carrier, Brian (2003))

Taking the position of prosecution and law enforcement, consider the forensics examiner

on the witness stand as an expert witness. How would the expert answer questions posed

from the defense about what was uncovered if the expert could not understand and

describe with authority the file system? The defense may first come up with a question

such as “how could you read this media when it shows up on my expert’s machine as

unreadable? When the expert gets past that, then “how do you know this file was deleted

or if other files were not mixed in with this one?” This line of questioning is intended to

put doubt into the jury or the judge. This approach might not be as effective with media

formatted as FAT or FAT32, as these are well known, well documented, and well

understood file systems. Until exFAT has been out there a while, accepted, documented,

and widely used, the forensic expert will be challenged with addressing that gap.

The fact that file systems are relevant to digital forensics should not require an argument

or any discussion. Without any understanding of the file system or organization of the

image being acquired it would be difficult, if not impossible, to make any sense of it.

Today we live mostly in an ASCII world, but what if it was a disk from an IBM

mainframe that used EBCDIC? Tools that search for ASCII strings won’t work. What

about the difference between Little-Endian vs. Big-Endian where the byte order makes a

difference? All data is binary, ones and zeros, what makes data is the context of those

representations.

RobertShullich

The exFAT file system has been out for a few years already, why has anyone cared and

why will they care now? Many of the current file systems were constrained to 2TiB,

although some could handle larger volume sizes. Disks with storage capacities at 2TB

used to only be seen in servers and in data centers. Within the past couple of years,

buying storage devices with 1TB and 2TB capacities with a price point of less than $200

for use in home desktops was made possible. Storage capacities of the Secure Digital SD

cards were achieving 4GB, but a SDHC card was achieving up to 32GB. The SD type

cards are used in many portable consumer electronics such as Personal Digital Assistants,

1/5/2010 10:57:18 PM

T:\exFAT Project 2010-01-04 10-00 am\Reverse Engineering the Microsoft Extensible File System Recovered.doc

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

DRAFT

Smart Phones, Cameras, and even GPS devices. In 2009, with the announcement of the

SDXC media, with supported capacities up to 2TB, the current file systems are going to

have a problem keeping up with these expanded capacities and faster I/O speeds.

DVD media today comes in 4.7GB and 8.5GB capacities. Producing a single video file

that exceeds the 4GiB file limit of FAT32 is a problem. Use of NTFS can overcome this

limitation but NTFS is not designed for removable media. NTFS is also a lazy write

system, where NTFS will write data to storage media when it gets around to it. An abrupt

removal of the storage media or even in the event of a power failure of the device can

leave the file system in an inconsistent state.

NTFS has large overhead with the many components of its file structure. A faster, more

efficient file system was needed to exceed the capacities of FAT32 and not have the

overhead of NTFS. Microsoft’s answer was exFAT, and the file system was released with

Windows CE 6.0 in November 2006.

The SDXC standard was announced at the Consumer Electronics Show (CES) in Las

Vegas in January 2009. (Hissink , Dennis (2009)). It is expected to actually see devices

that these chips could be used in released by March 2010. Already there has been an

announcement that 3 computer manufacturers will have integrated card readers. Lenovo,

Hewlett Packard, and Dell have all been fingered as having Arrandale-based laptops in

the works for release in early 2010 which will feature integrated SDXC readers.

(Halfacree, Gareth (2009)). Microsoft is driving for wider acceptance of use of the

exFAT file system and has expanded its licensing program and already several media

card manufacturers have bought into the standard. (Fontana, John (2009))

On the software front, there was a December 3

, 2009 announcement by Diskinternals

updating their Uneraser program to support exFAT. (Yahoo News (December 3rd,

2009)). Now, we have a product on the market that will recover deleted files stored on an

exFAT file system. The industry now sees exFAT as a new market for their products to

address (Yahoo News (December 3rd, 2009)) because now exFAT will be more viable.

When the SDXC devices start being shipped, the need for forensics applications that

support the exFAT file system will accelerate. These products were probably needed

earlier, but expect that as we get closer to the SDXC ship dates that we will see more

forensics application support for the exFAT file system.

4.3 Research Methodology

There are many proprietary and not well documented file systems in existence today. The

challenge is to take a file system apart and see what makes it tick. The methodology used

in this paper to do this exFAT analysis depended on examination of various Microsoft

Patents, examination of previous file systems in the FAT family, Google searches,

examination of information provided in Microsoft knowledge bases and MSDN, and low

level examination of the file system format. Since source code is not available, this all

comes down to what is called “black box” analysis (BCS SIGIST (2001)).

RobertShullich

The Microsoft Patents relevant to this research paper are:

1/5/2010 10:57:18 PM

T:\exFAT Project 2010-01-04 10-00 am\Reverse Engineering the Microsoft Extensible File System Recovered.doc

剩余71页未读，继续阅读

hittezh

粉丝: 0
资源: 7

解密微软扩展FAT文件系统(exFAT)：数字取证指南

EXFAT格式资料

exfat文件系统详解.rar

ExFAT文件系统详解.zip

exfat 文件系统支持

微软exfat文件系统格式说明

Android 11 exFAT文件系统支持.rar

反向工程M$ exFAT文件系统 68页资料

exfat 逆向分析文档

exFAT文件系统规范详解

多平台兼容的exFat文件系统库函数示例

最新资源