Добавил:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз: Предмет: Файл:
4-1 Основи цифрової криміналістики / лк / lecture 2. Windows File System. FAT.pptx
Скачиваний:
122
Добавлен:
02.02.2021
Размер:
1.67 Mб
Скачать

Logical organisation FAT 32

Reserved area

FAT area

Data area

 

 

 

 

 

 

 

 

Sektor 0

Sektor n

Boot area

FAT 1

FAT 2

Data incl. Root

32++ sectors

 

 

 

- These structures are written while formatting the volume.

02/02/2021

34

FSINFO Sector

With FAT 32 the FSINFO sector is established

it´s written directly after the VBR (also after the copy)

it includes a signature (RRaA), the address of the next free cluster and the number of free clusters.

Be carefull:

These information is maybe not correct.

02/02/2021

35

FSINFO Sector

02/02/2021

36

Meta data of the file system

The meta data of the file system contain all information about the files and directories.

Particularly the number of the startcluster (content of the file) and also the timestamps and the attributes.

In FAT systems all these data are stored in directory structure an the FAT.

02/02/2021

37

Metadata of the file system

A directory entry is a structure which is created for every file and directory

The structure of directory can be stored somewhere in the data area because they are stored in cluster which are belongs to a directory.

A directory entry contains also the filename.

02/02/2021

38

Root Directory

Normally begins just after the 2nd FAT

Holds the subdirectory and file entries of the root

For FAT12/16 the root directory is a fixed size

For FAT 32 the root directory is a part of the data area and is chained via the FAT like a file

32 bytes are reserved in the root directory for each entry

22

 

 

Directory (Root) Entry

example of 6 entries

 

 

 

 

 

 

Starting

 

File name

 

 

Extension Attribute cluster

 

 

 

 

 

 

 

 

 

Filesize

 

 

 

 

 

 

 

 

 

Time Date

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1 entry – 32 bytes

Subdirectories

Contains directory- and file entries

For each entry 32 bytes are reserved

The first two entries are pointer to directories

a). = pointer to itself and

b).. = pointer to the parent cluster

23

start cluster

24

File Allocation Table (FAT)

Central organizational structure of the file system

For each cluster on the disc there is an entry in the FAT

Each entry covers a number of sectors fixed by the operating system, called a cluster

Contains information detailing where files are stored on the disc

25