±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 7
Overall: 27350
Visitors: 51

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

ExFAT vs FAT32 (deeper mechanics)

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

ExFAT vs FAT32 (deeper mechanics)

Post Posted: Tue Jan 22, 2013 2:57 pm

Hi,

I'm looking into ExFAT and as a first introduction I read through this pdf:
reverse-engineering-microsoft-exfat-file-system_33274 (actually half way through)
It's getting a bit confusing and because it's been some time since I implemented FAT I'm not sure how different ExFAT is from FAT32. I feel I need to write some code first to see how things work rather than just reading text and not seeing the light.

A decision I need to make now is whether to extend my existing FAT implementation or start fresh for ExFAT (if too different). Right now I'm enclined to start again for ExFAT because the differences seem too great and it would clutter my FAT32 code too much.

To help me see the light I was wondering if anybody knows of a document / text that explains the *differences* between FAT32 and ExFAT on file-system level ? Or a document that explains what to add to an existing FAT32 implementation to support ExFAT (if that is at all possible).

As I said, from what I read, it seems quite different, but I haven't compared directory table structures yet etc. and maybe they're closer related than I feel right now.

Anyway, some input appreciated. I'm signing off. Reading that technical document while being tired is probably also not a good idea Wink  

CyberGonzo
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Tue Jan 22, 2013 3:54 pm

I did a detailed study of exFAT last year for Lock and Code's Reference Guide. The paper you describe is the best source I found for exFAT. The other one is a snippet from Jeff Hamm titled "exfat-excerpt-1-4" (I forgot where I found it).

If you are writing a program for exFAT, you are going to have to make quite a few alterations. Honestly, I don't recall anything that remained exactly the same. The difference isn't as stark as FAT vs. NTFS, but still, you probably have to write new code (maybe use the FAT code as a starting point).

Sorry I don't have better information, but to go into every little thing that's different would take up a whole document, and you already have it.  

twjolson
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Tue Jan 22, 2013 5:30 pm

I would start from scratch. Most of exFAT does not rely on a FAT as most files are not fragmented. (I presume you are talking about Read only)
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Tue Jan 22, 2013 8:29 pm

You can download a version of Jeff Hamm's ExFAT info at computer-forensics.san...at-ham.pdf
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6 

Patrick4n6
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Wed Jan 23, 2013 3:16 am

- mscotgrove
I presume you are talking about Read only


That is correct.
Thanks for your input

- Patrick4n6
You can download a version of Jeff Hamm's ExFAT ...


I will check it out, thanks.
Thanks for your input

- twjolson
you are going to have to make quite a few alterations


Thanks all, I think I know enough, a fresh start it will be.  

CyberGonzo
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Wed Jan 23, 2013 3:26 am

- mscotgrove
www.cnwrecovery.com


Michael,

Please check your website, and check if it hasn't been compromised !!
My virus scanner, BitDefender, did not allow me to go to your website, due to malware !!

I assume this provides for your bread on the table, the roof over your head, I hope you can fix this soon !!

Cheers,
Peter, a collegue

PS. I quickly did a scan with virus total as well:
www.virustotal.com/url...358929538/
No issues found ... so maybe this is a false positive by BitDefender ?
In any case, worth chasing still.  

CyberGonzo
Senior Member
 
 
  

Re: ExFAT vs FAT32 (deeper mechanics)

Post Posted: Wed Jan 23, 2013 7:28 am

Peter,

Thank you for your concern over my website. It looks OK with Norton. I was not aware of any problems - but will keep checking.

Michael
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next