exfat文档reverse-engineering-microsoft-exfat-file-system.pdf

exfat文档

5星 · 超过95%的资源需积分: 10 130 浏览量更新于2023-07-07 收藏 1.63MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

Interested in learning

more about security?

SANS Institute

InfoSec Reading Room

This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission.

Reverse Engineering the Microsoft exFAT File

System

The Extended FAT File System (exFAT) is a new and not yet widely used file system. It has been out for a few

years and it will gain acceptance and momentum with the release of storage devices that will support the new

SDXC standard. Forensics investigators and the maker of forensics tools need to be ready and prepared for an

influx of acquired evidence that requires analysis of this new file structure.

Author Retains Full Rights

Key!fingerprint!=!AF19!FA27!2F94!998D!FDB5!DE3D!F8B5!06E4!A169!4E46!

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

Ǥ

1 Introduction

In the US DOJ Special Report released in April 2004, Forensic Examination of

Digital Evidence: A Guide for Law Enforcement (US Department Of Justice (2004)) one

of the steps for evidence examination under Application and File Analysis is:

“Examining the users’ default storage location(s) for applications and the file

structure of the drive to determine if files have been stored in their default or an

alternate location(s)”

How does the forensics examiner accomplish such a feat when the file system is

unknown or not documented? This task becomes a real challenge when having to do an

analysis on proprietary systems such as embedded systems. But now, with the drive

towards storage media with larger capacities, the limits on many of the existing file

systems will be reached during the newest wave of storage technology.

To accommodate these advances, a new file system has been developed by Microsoft

a few years ago, and it is called the Extended FAT File System, abbreviated as exFAT,

and what some are nicknaming as FAT64. Microsoft is licensing this technology, so in

order to implement an exFAT file system a license will be required from Microsoft. In

January 2009 a new Secure Digital Extended Capacity (SDXC) specification was

announced (Hissink, 2009), with capacities that could reach up to 2 TB, and will use this

new exFAT file system. This new file system may actually fly and gain momentum in

2010 when device support reaches the market.

But today, there is no real Linux support, very few tools support this new file system,

and even the commercial forensics tools are behind in support. There are very few, if any,

open source tools that understand the file organization, and just recently the

specifications of the exFAT file system got released with one of Microsoft’s patent

applications (Microsoft Patent 0164440 (June 25, 2009)).

How does the forensic examiner “examine the file structure of the drive” when the

tools don’t know, and there is no how-to book to help him? This paper is intended to

provide basic insight to the file system structure to allow the forensics examiner to make

sense of the structure beyond just a blob of bytes.

Key!fingerprint!=!AF19!FA27!2F94!998D!FDB5!DE3D!F8B5!06E4!A169!4E46!

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

Ǥ

2 Definitions

Steps in Processing Digital Evidence – Assessment, Acquisition, Examination,

Analysis, Documenting and Reporting. (US Department Of Justice, 2004)

Digital Evidence – Any data stored or transmitted using a computer that support or

refute a theory of how an offense occurred or that address critical elements of the offense

such as intent or alibi. (Casey, 2004)

Digital Forensics – Digital forensics involves the identification, collection,

preservation, examination, and analysis of digital evidence. It is a technical, computer-

related field involved in the collection and examination of evidence from computers,

including audio, video, and graphical images. (http://www.ncfs.org/digital_evd.html)

Forensic Examiner – Conducts the examination process to extract and analyze digital

evidence. Extraction refers to the recovery of data from its media. (US Department Of

Justice, 2004)

File Fragmentation – for the purposes of this paper, a file is considered fragmented if

the clusters that the file is stored in either are not in order or there are gaps in the physical

cluster layout, or both. A file is considered not fragmented when the file is physically

stored in order within contiguous clusters.

Removable Media – is storage media that can be removed from its reader and stored

or transported to another location, possibly to be used on a different machine. Examples

of removable storage media are floppy disks, magnetic and paper tape, flash drives, flash

cards, CD/DVD, and ZIP/JAZ. This paper will address removable media that is random

access, which eliminates purely sequential devices such as magnetic and paper tape.

Superfloppy – a configuration where the entire storage media is a single file system

and there is no partitioning. There is no MBR record and when the media is booted the

VBR is loaded by the BIOS. Not all BIOS firmware will support a superfloppy. The

concept of the superfloppy was introduced when media such as 3M’s LS-120 and

Iomega’s Zip disks surpassed the conventional 1.44MB capacities.

Key!fingerprint!=!AF19!FA27!2F94!998D!FDB5!DE3D!F8B5!06E4!A169!4E46!

Reverse Engineering the Microsoft Extended FAT File System (exFAT)

Ǥ

3 Prior Work

There does not appear to be much research released at this time. The exFAT file

system has been in the market since 2006 with its introduction in Windows CE 6.0, but

exFAT didn’t hit the desktop/server market until the release of Vista SP 1 in March 2008.

The support has effectively existed on the desktop for almost 2 years.

At the Techno Forensics Conference that was held at NIST in Oct 2009

(http://www.thetrainingco.com/html/TechnoForensics2009.html) Jeff Hamm from

Paradigm Solutions gave a presentation on the internals of the exFAT file system. He

provided a presentation and paper on the topic, which provided a good foundation for the

work being presented here. His work is based on a forensic class he teaches that includes

exFAT internals.

4 Setting a Foundation

4.1 Purpose, Disclaimer and Scope

4.1.1 Purpose

The purpose of this paper is to describe the format and layout of the Microsoft

exFAT file system as currently released in the Microsoft desktop and server platforms.

The intent is to aid in the forensic examination of storage media that is formatted with the

exFAT file system. This document can be used as a guide for the forensics examiner in

order to provide a starting point in the search for electronic digital evidence that may be

stored or hidden within this file system.

4.1.2 Disclaimer

The exFAT file system is proprietary property of Microsoft, and an

implementation of the exFAT file system requires a Microsoft license to the

specifications. Licensing may be found at the Microsoft Intellectual Property Licensing

for exFAT page. The research in this paper provides an analysis of the exFAT file system

including its structure and organization. It is not meant to implement the exFAT file

system or any part of it. A static examination is performed of the contents of storage

media, and does not attempt to perform any dynamic analysis by direct non-standard

剩余85页未读，继续阅读

ylhryzy

粉丝: 2
资源: 95

会员权益专享

exfat文档 reverse-engineering-microsoft-exfat-file-system.pdf

会员权益专享

最新资源

exfat文档 reverse-engineering-microsoft-exfat-file-system.pdf

EXFAT格式资料

exfat文件系统详解.rar

arm下exfat源码包.zip

exfat-utils fuse-exfat 怎么下载

linux exfat-utils 下载

exfat-utils

RHEL 9 如何支持exFAT格式

linux rhel 8 不支持exfat格式u盘怎么解决

Centos7安装exfat文件格式

linux如何支持exFAT文件系统

Ubuntu exfat实现

centos 安装 exfat驱动

linux挂载exfat U盘

redhat8安装exfat

exfat linux

linux挂载exfat u盘

fuse-exfat离线包

testdisk-7.2-wip.win

centos8离线安装exfat

sd specifications - part 2 - file system specification

会员权益专享

最新资源