Forensic Analysis of the exFAT artefacts

by   Yves Vandermeer, et al.

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is mainly based on reverse engineering research, and only few of them cover the forensic interpretation. In this paper, we propose a new methodology using of exFAT file systems features to improve the interpretation of inactive entries by using bitmap file analysis and recover the file system metadata information for carved files. Experimental results show how our approach improves the forensic interpretation accuracy.


page 1

page 2

page 3

page 4


Hadoop Perfect File: A fast access container for small files with direct in disc metadata access

Storing and processing massive small files is one of the major challenge...

EngMeta – Metadata for Computational Engineering

Computational engineering generates knowledge through the analysis and i...

Forensic Analysis of Residual Information in Adobe PDF Files

In recent years, as electronic files include personal records and busine...

SAIC: Identifying Configuration Files for System Configuration Management

Systems can become misconfigured for a variety of reasons such as operat...

A GPU Register File using Static Data Compression

GPUs rely on large register files to unlock thread-level parallelism for...

Fight Virus Like a Virus: A New Defense Method Against File-Encrypting Ransomware

Nowadays ransomware has become a new profitable form of attack. This typ...

Accelerating LSM-Tree with the Dentry Management of File System

The log-structured merge tree (LSM-tree) gains wide popularity in buildi...

Please sign up or login with your details

Forgot password? Click here to reset