ExFAT vs FAT32 (dee...
 
Notifications
Clear all

ExFAT vs FAT32 (deeper mechanics)

21 Posts
6 Users
0 Likes
2,500 Views
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

Hi,

I'm looking into ExFAT and as a first introduction I read through this pdf
reverse-engineering-microsoft-exfat-file-system_33274 (actually half way through)
It's getting a bit confusing and because it's been some time since I implemented FAT I'm not sure how different ExFAT is from FAT32. I feel I need to write some code first to see how things work rather than just reading text and not seeing the light.

A decision I need to make now is whether to extend my existing FAT implementation or start fresh for ExFAT (if too different). Right now I'm enclined to start again for ExFAT because the differences seem too great and it would clutter my FAT32 code too much.

To help me see the light I was wondering if anybody knows of a document / text that explains the *differences* between FAT32 and ExFAT on file-system level ? Or a document that explains what to add to an existing FAT32 implementation to support ExFAT (if that is at all possible).

As I said, from what I read, it seems quite different, but I haven't compared directory table structures yet etc. and maybe they're closer related than I feel right now.

Anyway, some input appreciated. I'm signing off. Reading that technical document while being tired is probably also not a good idea 😉

 
Posted : 23/01/2013 12:57 am
(@twjolson)
Posts: 417
Honorable Member
 

I did a detailed study of exFAT last year for Lock and Code's Reference Guide. The paper you describe is the best source I found for exFAT. The other one is a snippet from Jeff Hamm titled "exfat-excerpt-1-4" (I forgot where I found it).

If you are writing a program for exFAT, you are going to have to make quite a few alterations. Honestly, I don't recall anything that remained exactly the same. The difference isn't as stark as FAT vs. NTFS, but still, you probably have to write new code (maybe use the FAT code as a starting point).

Sorry I don't have better information, but to go into every little thing that's different would take up a whole document, and you already have it.

 
Posted : 23/01/2013 1:54 am
(@mscotgrove)
Posts: 938
Prominent Member
 

I would start from scratch. Most of exFAT does not rely on a FAT as most files are not fragmented. (I presume you are talking about Read only)

 
Posted : 23/01/2013 3:30 am
(@patrick4n6)
Posts: 650
Honorable Member
 

You can download a version of Jeff Hamm's ExFAT info at http//computer-forensics.sans.org/summit-archives/2010/10-exfat-ham.pdf

 
Posted : 23/01/2013 6:29 am
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

I presume you are talking about Read only

That is correct.
Thanks for your input

You can download a version of Jeff Hamm's ExFAT …

I will check it out, thanks.
Thanks for your input

you are going to have to make quite a few alterations

Thanks all, I think I know enough, a fresh start it will be.

 
Posted : 23/01/2013 1:16 pm
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

www.cnwrecovery.com

Michael,

Please check your website, and check if it hasn't been compromised !!
My virus scanner, BitDefender, did not allow me to go to your website, due to malware !!

I assume this provides for your bread on the table, the roof over your head, I hope you can fix this soon !!

Cheers,
Peter, a collegue

PS. I quickly did a scan with virus total as well
https://www.virustotal.com/url/8cac1a7c4b2663278e98d4ea7651d0a5ae80356bf19a1fb16503efcd2a4ec197/analysis/1358929538/
No issues found … so maybe this is a false positive by BitDefender ?
In any case, worth chasing still.

 
Posted : 23/01/2013 1:26 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

Peter,

Thank you for your concern over my website. It looks OK with Norton. I was not aware of any problems - but will keep checking.

Michael

 
Posted : 23/01/2013 5:28 pm
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

I wasn't able to put the time in today, but tomorrow I intend to start coding.

Question. I scanned the documents and (at least one) question is bothering me. Maybe I read over it ?

The root cluster is recorded in the VBR.
I read that the FAT is only consulted when a flag is set in the directory entry for a file.
I take it this is also true for folders ?

Which leads me to the root folder. Since there is no record describing it, I don't know if this folder can be fragmented, needing the FAT to determine its extents ?

Should I assume it's unfragmented, or should I consult the FAT for the root, flag or not ?

 
Posted : 24/01/2013 12:07 am
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

Implemented.

FYI, and for other people landing here, in search for the same feedback, I ended up simply adding code to my existing FAT code. Ok, there are differences, but there are also lots of things that simply could be re-used.

My FAT code already had if(type == 12) {} else if (type == 16) {} if (type == 32){} conditionals in critical code, so I only needed to add ExFAT to that (which I gave type=64 eventhough the FAT is still 32 bits). And because of the latter I could actually simply change if (type == 32) to if (type >= 32) in FAT handling code.

The only bigger difference (with lots of resemblances however) is the scanning of the directory entries. A unique subroutine for that fixed that too.

The status and open issues

- Still need to test on larger data sets. Now implemented on a formatted USB stick, and gradually added data to test.

- My previous question about the root directory (possibly fragmented or not) is still open

- The SANS Institute document is not correct or incomplete (unless I missed that) when it comes to time zone offsets. I ran into a file time/date bug that I could not figure out until I read this (very useful) article http//computer-forensics.sans.org/blog/2010/07/19/exfat-file-system-time-zone-concerns on the use of the time zone byte. Bottom line, the offset is a 7-bit value, and not an 8-bit value as I first thought.

And now some more testing … but that's for Monday. It's (nearly) weekend … whoohoo …

 
Posted : 25/01/2013 8:51 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Canot say if specifically it can help you, but maybe something in the source here
https://code.google.com/p/exfat/
is of use.
Since it recently went "Version 1.0" it should have overcome the issues you mentioned.

jaclaz

 
Posted : 26/01/2013 12:25 am
Page 1 / 3
Share: