September 20th, 2010 1 HTCIA International Conference September 20-22, 2010 Atlanta, GA Demystifying the Microsoft Extended Demystifying the Microsoft Extended File System (exFAT) File System (exFAT) Robert Shullich CPP, CISSP, CISM, CISA, CGEIT, CRISC, GSEC, GCFA
73
Embed
Demystifying the Microsoft Extended FAT File System (exFAT)
This was a presentation on the exFAT file system given back in September 2010 at the HTCIA conference in Atlanta Ga. This presentation is effectively superseded by a new presentation deck that was uploaded to slideshare on June 6, 2014.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
September 20th, 2010 1
HTCIA International ConferenceSeptember 20-22, 2010
Atlanta, GA
Demystifying the Microsoft Extended File Demystifying the Microsoft Extended File System (exFAT)System (exFAT)
Robert Shullich CPP, CISSP, CISM, CISA, CGEIT, CRISC, GSEC, GCFA
September 20th, 2010 2
Agenda
About Me Why a new file system Forensics Relevance Features Advantages Timelines Support Limits Internals
About Me
I have been in the IT field for 35+ Years, and in InfoSec for over 15 Years
I carry many IT and InfoSec certifications This research was part of a term project for a
forensics class for my masters in Forensic Computing I then expanded the term paper into a practical paper
for my SANS GCFA certification A link to the SANS paper and my blog is at the end of
(UHS-1: 104 MB/2 - UHS-2: 300MB/s) Removable Media Flexibility Extensibility NTFS Features without the overhead
September 20th, 2010 5
Relevance to Forensics Study
Digital Evidence Extraction Finding the evidence Including the hiding places Validation
Daubert Expert Testimony Need to know and understand file org
New Media (SD Cards) will drive exFAT adoption, and the potential for CP investigations.
September 20th, 2010 6
What happens when you have exFAT formatted media and no exFAT support?
September 20th, 2010 7
Forensics Challenges
Linux OS Support Tuxera drivers may help
Mac OS Support Open Source Tools Commercial Tools
Encase FTK
Documentation
September 20th, 2010 8
Disclaimer
The released specification and implementation is Release 1.00 of exFAT
The specification mentions additional features that were not implemented yet, but may at a future time/ Some of these are Windows CE holdovers
Both may be presented today Some directory entries will be skipped
Exponents
102 = 10 times 10 = 100 103 = 10 times 10 times 10 = 1000 (1K) 22 = 2 times 2 = 4 29 = 2*2*2*2*2*2*2*2*2 = 512 210 = 2*2*2*2*2*2*2*2*2*2 = 1024 (1K) 212 = 2*2*2*2*2*2*2*2*2*2*2*2 = 4096
September 20th, 2010 9
September 20th, 2010 10
International System of Units (SI) Table
File System in powers of 2
Device characteristics in power of 10
Shorthand Longhand Nth Bytes
KiB Kibibyte 210 1024
MiB Mebibyte 220 1024 KiB
GiB Gibibyte 230 1024 MiB
TiB Tebibyte 240 1024 GiB
PiB Pebibyte 250 1024 TiB
EiB Exbibyte 260 1024 PiB
ZiB Zebibyte 270 1024 EiB
YiB Yobibyte 280 1024 ZiB
September 20th, 2010 11
Features of exFAT 1.00
Sector sizes from 512 to 4096 bytes Clusters sizes to 32MiB Root Directory Unlimited Subdirectories to 256MiB Built for speed, less overhead than NTFS but
has some of the NTFS features UTC Timestamp Support
Vista/Server 2008 SP2+, XP with KB
Features of exFAT 1.00 (cont’d)
OEM Parameters Sector for device dependent parameters
12 sector VBR, support of larger boot program
Potential capacity to 64ZiB Current support ≈ 128 PiB
Up to 2,796,202 files per subdirectory File Names max to 255 Characters Unicode File Names and Volume Labels
September 20th, 2010 12
September 20th, 2010 13
Future Features of exFAT
TexFAT (To be released later) Exists in Windows CE Transaction Safe exFAT
ACL (To be released later) Exists in Windows CE
Encryption Support? Not announced, but mentioned how easy to
add
September 20th, 2010 14
MBR Partition Limitations
Microsoft File Systems are limited when stored in a MBR partition
A partition is defined by a Master Boot Record
A MBR uses a 4 byte value for number of sectors
To get the maximum volume size, exFAT cannot be created within a partition
September 20th, 2010 15
Advantages of exFAT
Handle growing capacities in media, increasing capacity to >32 GB.
> 1000 files in a single directory. Speeds up storage allocation processes. Breaks file size 4 GB barrier. Supports interoperability with future desktop
OSs. Provides an extensible format. Large cluster sizes
Disadvantages of exFAT
Not all Windows CE features implemented No direct conversion to or from other FS Cannot use CONVERT command to NTFS No Floppy Support Mostly a Microsoft Desktop and Server World
No Support for Older MS systems No Support for Non-MS systems No XBOX, PS3 or other special devices
September 20th, 2010 16
September 20th, 2010 17
Key Dates for exFAT September 2006 – Windows CE 6.0 March 2008 – Windows Vista Service Pack 1 January 2009 – Announcement at CES of SDXC specification January 2009 – Windows XP Drivers Available May 2009 – Windows Vista Service Pack 2 August 2009 – Tuxera Signs File System IP Agreement with
Microsoft March 2009 – Pretec Releases first SDXC Cards December 2009 – Microsoft (re)announces exFAT license
program for third-parties December 2009 – SDXC laptops due soon December 2009 – Diskinternals releases exFAT recovery utility December 2009 – Encase support
September 20th, 2010 18
More Key Dates for exFAT
December 2009 Sony, Canon & Sanyo License
January 2010 Funai License (LCD TV) February 2010 Panasonic License February 2010 Panasonic 64/48GB SDXC February 2010 Sony Memory Stick XC February 2010 Sandisk Ultra XC 64GB Card
3.0 Spec $350
More Key Dates
June 1st 2010 Tuxera Releases Linux & Android exFAT drivers
June 3rd 2010 Kingston Releases Class 10 SDXC 64GB Card 60 MB/s read, 35 MB/s write.
September 20th, 2010 19
September 20th, 2010 20
SD Card Association
New Memory Card Consumer Appliances Follows SDHC Specification for 2TB
Capacity
September 20th, 2010 21
September 20th, 2010 22
SDXC Storage Capabilities
From 32GB to 2TB on a card Exclusively exFAT File System 300 MB/s I/O Transfer Storage
4,000 RAW images 100 HD movies or 60 hours of HD recording 17,000 fine-grade photos in a single directory
September 20th, 2010 23
Support for exFAT
Windows XP & Server 2003 KB955704 (requires SP2 or SP3)
Vista & Server 2008 SP1 Vista & Server 2008 SP2
(Adds UTC timestamp support) Windows 7
September 20th, 2010 24
Reference Standards
Bits are numbered right to left 76543210
Decimal Offsets (zero based) Little-Endian numbers Unsigned numbers Sectors vs. Clusters Strings are 16 bit Unicode Strings not Terminated
Endian
Numbering order may vary based on processor type, is determined by the order the data bytes are read from the register.
A 32 bit number is read as 4 8 bit bytes If I have the number 0x01 02 03 04 Big-Endian will store it as:
0x 01 02 03 04 Little-Endian will store it as:
0x 04 03 02 01
September 20th, 2010 25
September 20th, 2010 26
File System Integrity
Version Verified 3 Checksums
VBR UP-Case Table File Set
Critical Directory Entries Other Checks and Balances File System should NOT mount if failures
September 20th, 2010 27
exFAT Limits
Volume size 128PiB MS said 64ZiB MS now says 256TiB
File Size 16 EiB (64 bit number) Bigger than volume size
Subdirectory 256MiB Sector 512-4096 bytes (29-212) Cluster 32MiB (225) No floppy support No FAT32 minimum cluster (65,525) restriction No 8.3 file name support
September 20th, 2010 28
Data Hide Alert!
FAT32 max cluster 32KiB exFAT max cluster 32MiB
This is an increase of 1024 fold Potential for massive slack space
September 20th, 2010 29
Volume Space Layout
The Main Boot Region Contains main VBR
The Backup Boot Region Contains backup VBR
The FAT Region Contains FAT Table(s)
The Data Region (Cluster Heap) This is where data resides
OEM Label “EXFAT ” Volume Length (64-bit) [sector] FAT Location & Size [sector] Heap Location & Size [sector, cluster] Volume Serial Number Location of Root Directory [cluster] Volume Flags Sector and Cluster Sizes [2-shift] Percent in use File System Revision (0x0010=1.00)
September 20th, 2010 33
Sectors & Clusters
A 2-Shift is a power of 2 Another name for exponent
Sector size and sectors per cluster Each stored in 1 byte Theoretical maximum is 2255
Sector Size Maximum 212
Sectors per cluster is derived Cluster Size Maximum is 225
September 20th, 2010 34
Executable Boot Code
First 3 bytes of Main Boot Sector Jump Code 0xEB7690
Offset 120 size 390 Remainder of boot code
Offset 510 End signature marker 0xAA55 = “55AA”
Offset 512 Unused if defined
September 20th, 2010 35
More Bootable Code
Up to 8 Main Extended Boot Sectors FAT32 had 3 sector VBR with 1 MEBS Entire sector can be used for boot code Last 8 bytes of sector is marker 0xAA550000 = “000055AA”
Larger capacity for boot virus!
September 20th, 2010 36
VBR Checksum Sector
The 12th sector of the VBR Repeating 4 byte checksum Checksum of previous 11 sectors Flags and Percent excluded
These are volatile and change often Boot Sector Virus & Checksum
When it is used, same as legacy FAT Not used when file contiguous Never used for cluster allocation FAT 32 has 32 bit cells, uses 28 bits exFAT has 32 bit cells, uses 32 bits
There is no 64 bit FAT Maximum clusters is 232-11 With TexFAT – 2 FAT Tables (2 Bitmaps) Addressed by pointer in VBR Size stored in VBR
September 20th, 2010 39
Cell Values in FAT Table
0x00000000 – No significant meaning 0x00000001 – Not a valid cell value 0xFFFFFFF6 – Largest Value 0xFFFFFFF7 – Bad Block 0xFFFFFFF8 – Media Descriptor
Fixed Disk 0xFFFFFFF9-0xFFFFFFFE – Not Defined 0xFFFFFFFF – End of File (EOF)
Used to define a file May have 3 to 19 entries, or more 1 Primary, many Secondary Is considered an array
Must be in order Must be contiguous (no gaps)
Entire Set has Checksum
September 20th, 2010 56
File Directory Entry
0x85 or 0x05 Entry Primary Entry Set Checksum (16 bits)
Not modified on file delete Secondary Count
# Secondary entries that follow File Attributes Timestamps
September 20th, 2010 57
Timestamps & Time Zones
3 Timestamps (MAC) 32 bit DOS Date/Time
Local Machine Time 10ms Offset (MC) TZ Offset (MAC)
15 minute increments 7 bit signed number ±16 hours Present with UTC support
September 20th, 2010 58
Timestamp Accuracy
FAT32 – Last Access – Date only exFAT – Last Access – Date/Time All DOS DATE/TIME Double Seconds 10ms adds 0-1990 ms to time 10ms only for Create/Modify
September 20th, 2010 59
Timestamp Reliability
Timestamps appear to be updated when the file is created or modified.
Last Accessed Timestamp appear to be updated when file is created or modified.
Last Accessed Timestamp appear NOT modified on file read.
Root Entry Type Read is: 85 Directory Entry RecordChecksum: 92D4Calculated Checksum is: 92D4 Size Directory Set (bytes): 160Secondary Count 004File Attributes: 0020 Archive Create Timestamp: 3B866244 12/06/2009 12:18:08Last Modified Timestamp: 3ABA62F1 05/26/2009 12:23:34Last Accessed Timestamp: 3B866244 12/06/2009 12:18:08 10 ms Offset Create A8 168 10 ms Offset Modified 00 0 Time Zone Create EC 236 Value of tz is: GMT -05:00 Time Zone Modified EC 236 Value of tz is: GMT -05:00 Time Zone Last Accessed EC 236 Value of tz is: GMT -05:00
September 20th, 2010 63
Stream Extension Directory Entry
0xC0 or 0x40 Entry Secondary Entry Length of Name Length of File (2 of them) Cluster address of first data block Name Search Hash value Secondary Flag
Bytes Per Sector: 2 to the 09 power is: 512Sectors Per Cluster: 2 to the 08 power is: 256Bytes per Cluster: 131072 (128K)
September 20th, 2010 66
Formatted Stream Extension
Root Entry Type Read is: C0 Directory Entry Record, Stream ExtensionSecondary Flags: 03 Flag Bit 0: Allocation Possible Flag Bit 1: FAT Chain InvalidLength of UniCode Filename is: 40Name Hash Value is: AD3CStream Extension First Cluster 5Cluster 5 is AllocatedStream Extension Data Length 18695711 Bytes Slack: 83487 Clusters Used: 143Stream Extension Valid Data Length 18695711 Bytes Slack: 83487 Clusters Used: 143
September 20th, 2010 67
File Name Extension Directory Entry
0xC1 or 0x41 Entry Secondary Entry Secondary Flags
Allocation not possible FAT Invalid
15 Characters (30 bytes) of Name Name in 16 Bit Unicode In order (FAT32 LFN was reversed) Up to 17 max, total 255 character