Understanding the file systems.
A hard drive can have multiple partitions on it, and in each partition there will be a file system.
There might be hundreds of thousands of to millions of files contained within a partitions.
So the file system tracks where every file is and how much space is available within the partition boundaries.
We discuss sectors earlier in the hard drive and solid state drive section of this course, and they
are the smallest units that are available to store data.
The file system stores data based on clusters.
Clusters are one or more sectors, so a cluster is the smallest allocation unit that file system can
write to.
So now there are many file systems available and some are restricted to specific operating systems.
Unless the user enables drivers that will allow the operating system to read the file system.
So we will look now at some of the common file system you may encounter.
So the fat file system file allocation table.
So the file allocation table file system has been run since the early days of home computing.
And it's one of the five file system that nearly all operating system can read.
So it's a de facto standard file system for removable devices.
At the time has gone by.
The fat file system has gone through numerous changes.
So the first fat file system is the fat 12.
So this is the created in 77 and used 12 bits, hence the Fat 30 designation to address available clusters.
So it is 12 bits to address available clusters.
So but this is limited.
It used only storage devices that could contain 4069 clusters.
So it's rarely seen nowadays, but you might find it on a floppy disk.
So then we have fat 16.
This is created in 84 and the fat 16 used 16 bit to address available clusters.
So it had the same uses as the fat 12 as it could not be scaled to be used with larger capacity device.
So it's incompatible with fat 60 and fat 12, it's not compatible with large capacity devices.
And then we have vfat.
So this is the this is introduced with the Windows 95 and add the virtual file allocation table.
So it added the long file name LFN and additional timestamps here.
So then lastly, we have fat 32, so the fat 32 uses the 28 bits to address available clusters, theoretically
allowing for maximum volume size a 2.2TB.
So Microsoft implemented restrictions that limited the file system size to 32GB with a maximum file
size of four gigabyte.
So.
It's it is still in use today and can be found on most removable devices.
We will discuss Fat32 file system for remainder of this lecture and the fat file system.
So the fat file system here.
Um, actually, let's make it a little right here.
So the fat file system.
Uh, is a laid out in two areas.
As you can see here.
System area and data area.
So the system area actually, let me write that down.
Actually don't feel it.
So.
Sister Maria.
So Sister Maria is stores.
Uh, the volume.
Volume.
Boot data.
Boot record, actually.
Boot record.
And fat tables.
Actually.
So.
But the data array here.
Uh, this data area stores the root directory.
Directory and files.
So.
As you can see here, we have boot record, Fat one and Fat two is engaged with system, area and root
DA.
The root directory and files is engaged with data area.
So these are the volume records and these are the root directory and files.
So now let's get into the next topic in this lecture.
So this is the boot record.
So in the system area we have the volume boot record VR, so we can find it in a logical sector.
LZ zero, which is the first sector within the partition binaries.
So the boot process here creates the vbr.
When the partition is formatted and contains information about the volume and boot code to contain the
boot process for the operating system.
It is a primary partition.
The CBR will consist of a several sectors, typically sector zero, sector one and sector two with the
backup in backup in sector six and seven and eight.
The vbr and backups are stored in a reverse area, so which is typically 32 factors before the first
file allocation table begins.
So this is the sector here.
Now we will find these direct in these hex codes here.
We can see a volume boot record which helps to decipher the information like.
So actually, let me write that down here in the left side of this.
Screenshot here.
Here.
Okay.
So.
We have X00.
This is the Higgs part here.
So in this X here.
We will find the jump instructions.
Uh, jump instructions.
Um, for the system.
Two contributing.
And X03.
Here we will the, um, id, uh, this is the ID which operating system was used to format the device.
So this is the bytes per sector.
Here, actually, let me open it.
Bytes.
The sector.
We also have A0E here.
This is the reserved sectors.
So this is actually not the entire reserve sector.
This is just a shows the number of reserve sectors in our.
So in our here and we have here zero.
It's actually x ten, right?
Yes.
This is the extent.
This is the number of of fats.
Uh, actually, in this case, it's usually.
To.
So we have x 11.
So this is the unused route entries.
So there is a trick for that.
So if if you're using Fat32, this should be zero because the root directory is in the data area as
we as we discussed earlier.
So as you can see here, root directory in the data area, which in this if you are using Fat32, in
your case it will be zero for you.
So we have 13.
So this is number of sectors.
We have 15.
This is the media descriptor.
We have 16 here and then we will have 18.
16.
This is the number.
Number of sectors per fat.
If and now if you are using Fat32, this will be this should be zero in your case here.
And this is the number of sectors per track.
Sectors per track.
Um.
So this is the total sectors for the volume.
You have X.
20 here.
This is the logic.
Logical sectors.
Perfect.
And then we will have extended flags.
So actually, these are the pretty advanced topics in digital forensics here.
Um.
We will contain these advanced topics in next lectures of our course.
So.
Next, we will look at the file allocation table in next lecture.
Here, actually, end of this.
Section of our course, there will be a practice test, which I'm sure you can do it.
So I'm waiting you in the next lecture.